using the ‘find’ command

Posted on by Jeff

Using the find command
find ~/bin -iname filename

or:

find ~/bin -iname “filen*”

Moving large number of files
find /source/directory -mindepth 1 -maxdepth 1 -name ‘*’ -print0 | xargs -0 mv -t /target/directory;

using find with rename recursively
find . -depth -exec rename -v ‘s!\texttoremove/newtext/’ {} +
you may have to run it twice if the subfolders get renamed in the process
or:
find . -type f -iname “Ghost*” -exec rename -v ‘s/S02\ E/S02E/g’ {} \;

move files from subfolders to parent folder

Move to target folder and execute:

find . -mindepth 2 -type f -print -exec mv {} . \;

Delete empty directories

find . -empty -type d -delete

Delete empty files

find . -empty -type f -delete

Command
find /tmp -name “foo.txt” Find a file a called foo.txt in /tmp
find /tmp -iname “foo.txt” Find a file (case insensitive) called foo.txt in /tmp
find /tmp -name “foo*” Find a file starting with the substring foo
find /tmp -regex “.*f.*t” Find regex pattern (regex must include the full path)


Time
-mtime -7 Modified within the last 7 days
-mtime +1 -mtime -7Modified more than 1 day ago, but no more than 7
-daystart Start from today rather than from 24 hours ago


Recursion
-maxdepth 2 Go no more than 2 subdirectories deep during search
-mindepth 4Ignore results that are less than 4 subdirectories deep
-mount -xdev Don’t search directories contained on another filesystem


File type
find ~ -type d -iname “foo” Find a directory in ~ called foo
d directory l symlink p named pipe (FIFO)
f file s socket b block (buffered) special
c character (unbuffered) special D Door (GNU find on Solaris)

Other attributes
-uid 1000User ID is 1000
-user tux User name is tux
-writable -readable File is writable, readable
-perm u=rwx -perm 700Permissions are exactly 700
-perm -u+w,g+w -perm -220User or group has write permission –
-perm /a+w -perm /222 At least one permission is set to write /
-size +5M File is larger than 5 MB
-true Always true


Actions
-exec grep foo {} \; Execute grep on each file found
-ok sed ‘s/foo/bar/g’ {} \; Prompt user to execute sed on each file found
-execdir chmod 700 {} \; Run chmod (in subdirectory of result) on each file found
-fprint Add a newline to output -fprint0Do not add a newline
-ls Print results in ls -dils format
-fls output.txt Write results, in ls -dils frormat, to output.txt
-fprint -fprint0Write output to out.txt …with no newline
-prune Don’t descend into subdirectories
-quit Quit (usually used after other actions) 

Find multiple files in Linux

The find command is used in various ways. One thing you don’t want to do as a system administrator is work harder than you need to. Instead of running the same command to search for one file over and over, you can use the find command to locate multiple files at the same time.

sudo find /home -type f -name file.txt -exec {} \;

This one-liner can be broken down. I find it best almost to read it as a sentence:

  • searching the /home directory
  • searching for a file (-type f) or a directory (-type d)
  • filename is file.txt (-name file.txt)
  • executing another command from the previous output

Find large files in Linux

You can also use find to discover large files in Linux. Finding large files has proven helpful to me in the long run. find can help to locate large files quickly, such as backups and ISO files.

sudo find / -type f -size +500000k -exec ls -lh {} \;

This one-liner can be broken down:

  • searching the / directory
  • searching for a file (type -f)
  • searching for a file larger than 500000k
  • executing the command ls -lh on the files found in the previous output

Find specific file types in Linux

Another good method is to locate file extensions using the find command. I find this helpful, as it has shown me ways of finding specific files with only a specific keyword. In this case, the example below is looking for files that only contain a specific extension:

sudo find / -type f \( -name "*.sh" -o -name "*.txt" )

To dissect this:

  • searching in the / directory
  • searching for a file (-type f) or a directory (-type d)
  • searching for a file name that is a wildcard but ends with the extension .sh or .txt

Find modified files in Linux

The last example shows how to find a file modified in the last 50 days. This can be helpful when you need to locate recently modified files due to a security reason or if there are unwanted users on the network accessing other files.

sudo find / -type f -ctime +50 -exec rm -f {} \;

The command above shows:

  • searching in the / directory
  • searching for a file (-type f) or a directory (-type d)
  • searching for files older than 50 days
  • executing the command rm -f on the files found in the previous output

This can help remove those malicious files all in one go. You just have to make sure that the files you select are the files you want to remove. One way to check is to run the command without the exec section to see the files that come up in the output. If there are a large number of files, redirect the output into a file:

find / -type f -ctime +50 > files.txt

The content can be reviewed and verified before you run a one-liner that removes the /etc folder. Not ideal.

 check out:   find . -criteria etc -print0 | xargs -0 command
(might be safer than -exec stuff)

List Symlinks

sudo find / -type l

Finding files by size

find -size +1G -ls 2>/dev/nullthe +1G means “larger than a gigabyte”

Finding files by inode number

find -inum 919674 -ls 2>/dev/null919674 is the inode number

Finding files with a specific file owner or group

find /home -user bob -name “*.png”-lsfind /tmp -group admins -ls

Finding files with no owners or groups

find /tmp -nouser -ls

Finding files by last update time

find /home/bob -mtime -1

Finding files by when permissions were last changed

find . -ctime -1 -ls

Finding files based on last access times

find -name “*.pdf” -atime -2

Finding files based on their age relative to another file

find . -newer dig1 -ls

Finding files by type
b block (buffered) special

c character (unbuffered) special

d directory

p named pipe (FIFO)

f regular file

l symbolic link

s socket


find . -type l -ls

Limiting how deeply find should look

The -mindepth and -maxdepth options control how deeply into the file system the search will look (from the current location or starting point).
find -maxdepth 3 -name “*loop”


Finding files only if empty

find . -maxdepth 2 -empty -type f -ls

Finding files by permissions

find -perm 777 -type f -ls

Using find to help you get rid of files

find . -name filename -exec rm {} \;

The {} represents the name of each of the files located by the search criteria.

replace -exec with -ok if you want it to ask for a confirmation before it removes any file.

find . -name runme -ok rm -rf {} \;