Shulou(Shulou.com)06/01 Report--

This article is about a sample analysis of the use of the find command in Linux. The editor thinks it is very practical, so share it with you as a reference and follow the editor to have a look.

Find files based on access / modify / change Tim

You can find files based on the time attributes of the following three files.

Access time file. The access time is updated when the file is accessed.

The modification time of the file. When the contents of the file are modified, the modification time is updated.

The time when the file was changed. The change in the inode data that is updated when the time is changed.

In the following example, the difference between the min option and the time option is a parameter.

The argument takes its parameter to minutes. For example, 60 minutes (1 hour) = 60 minutes.

Time parameter, set its parameter to 24 hours. For example, time 2 = 2 * 24 hours (2 days).

Although the 24-hour calculation of doing so, the decimal part will be ignored, so 25 hours is 24 hours, and 47 hours is 24 hours, and only 48 hours is 48 hours. For a clearer reference to the man pages of some of the find commands of atime.

Example 1: find a file that has been changed within 1 hour

To find a file by its modification time, you can use the parameter-mmin-mtime. Here are the definitions of mmin and mtime in the man manual.

-mmin n file * once modified within n minutes

-mtime n file * once modified within 24 hours.

Execute the command in the following example, and you will find files or directories in the current directory and its subdirectories that were last modified within 1 hour (60 minutes).

# find. -mmin-60

In the same way, execute the command in the following example, and you will find files that have been modified within 24 hours (1 day) (file system root / under)

# find /-mtime-1

Example 2: find files that have been accessed within 1 hour

To find a file by file access time, you can use the parameter-amin-atime. Here are the definitions of amin and atime in the man manual.

-amin n file * one visit is within n minutes

-atime n file * one visit is within 24 hours

Execute the command in the following example, and you will find files or directories in the current directory and its subdirectories that were last accessed within 1 hour (60 minutes).

# find. -amin-60

In the same way, execute the command in the following example, and you will find files that have been accessed within 24 hours (1 day) (file system root / under)

# find /-atime-1

Example 3: find files whose status has been changed within an hour

(translator's note: the change here more than the first example of changing the file content time is a different concept, here is to change the file inode data, such as file permissions, ownership, and so on.)

To find the change time of the file's inode, use the-cmin and-ctime options.

The state of the-cmin n file is changed within n minutes

-ctime n file status is changed within 24 hours (that is, within n days)

(translator's note: if the above n is in the form of-n, it means within n minutes / day, and if n is + n, it means before n minutes / day)

The following example looks under the current directory and its subdirectories for files whose state has changed within an hour (that is, within 60 minutes):

# find. -cmin-60

By the same token, the following example is a list of files whose state has been changed within the next day (within 24 hours) of the root directory / and its subdirectories:

# find /-ctime-1

Example 4: search is limited to files and does not display folders

The above example searches for not only files, but also folders. Because when a file is accessed, its folder will also be accessed, if you are not interested in the folder, you can use the-type f option

The following example shows files that have been modified within 30 minutes, and folders are not displayed:

# find / etc/sysconfig-amin-30. . / console. / network-scripts. / i18n. / rhn. / rhn/clientCaps.d. / networking. / networking/profiles. / networking/profiles/default. / networking/profiles/default/resolv.conf. / networking/profiles/default/hosts. / networking/devices. / apm-scripts

[note: the output above contains files and folders]

# find / etc/sysconfig-amin-30-type f. / i18n. / networking/profiles/default/resolv.conf. / networking/profiles/default/hosts

[note: the output above contains only files]

Example 5: only find non-hidden files (do not show hidden files):

If we don't want to hide the file and show it when we look for it, we can use the following regular formula to find it:

The following command displays files whose contents have been modified within 15 minutes under the current directory and its subdirectories, and lists only non-hidden files. In other words, in order to. The beginning of the file will not be displayed

# find. -mmin-15\ (!-regex ". * /\.. *"\)

Find command based on file comparison

It is easier for us to remember some things by comparing with other things. For example, I want to find out the files I edited after I edited the test file. You can use the editing time of the test file as a baseline to find later edited files:

Example 6: find the file whose modification time is after a certain file has been modified:

Syntax: find-newer FILE

The following example shows a file that has been modified after the / etc/passwd change. For the system administrator, it is helpful to know that you have added a user to track the activity of the system (in case the new user is dishonest and cheats up, you will soon know ^ _ ^):

# find-newer / etc/passwd

Example 7: find files whose access time is after the modification time of a file:

# find-newer / etc/passwd

The following example shows all the files accessed after the / etc/hosts file was modified. If you add a new host / port to the / etc/hosts file, you'll probably want to know what files have been accessed after that. Here's the command:

# find-anewer / etc/hosts

Example 8: find files whose status change time is after the modification time of a file:

Syntax: find-cnewer FILE

The following example shows all files whose state has changed after modifying the file / etc/fstab. If you add a mount point to / etc/fstab, you probably want to know which files have changed since then, you can use the following command:

# find-cnewer / etc/fstab

Execute the command directly on the results of the list of files found:

You have seen before that if you use the find command to find a list of files for various conditions. If you are not familiar with these find commands, I suggest you finish reading the * * section above

In the next section, we will show you how to execute different commands on the find command, that is, how to manipulate the list of files found by the find command.

We can specify any action on the list of file names found by the find command:

# find-exec\

The OPERATION can be any command. Here is a list of the more commonly used commands:

The rm command, which is used to delete files found by find

Mv command to rename the found file

The ls-l command, which displays the details of the files found

Md5sum, a string can be obtained by performing md5sum operation on the found file, which is used to detect the validity of the file content.

Wc command, which is used to count the number of words in a file, file size, etc.

Execute any Unix shell command

Execute the shell script you wrote yourself, and the parameter is the name of each file you find.

Example 9: use ls-l on the output of the find command to list the details of the files that have been edited within 1 hour

# find-mmin-60. / cron. / secure # find-mmin-60-exec ls-l {}\;-rw- 1 root root 1028 Jun 21 15:01. / cron-rw- 1 root root 831752 Jun 21 15:42. / secure

Example 10: search only in the current file system

Sometimes system administrators just want to search on / mounted file system partitions rather than other mounted partitions, such as / home/ mounted partitions. If you have multiple partitions mounted and you want to search under /, you can generally do this as follows

The following command searches for the file names at the end of .log under the root directory / and its subdirectories. If you have multiple partitions below /, this search will search for all mounted partitions:

# find /-name "* .log"

If we use the-xdev option, it will only be searched in the current file system. Here is the definition of-xdev found on the man page of xdev:

-xdev Don't descend directories on other filesystems.

The following command searches the / directory and its subdirectories for all files ending in .log in the current file system (that is, the mounted file system), that is, if you have multiple partitions mounted under /, the following search will not search for other partitions (for example, / home/)

# find /-xdev-name "* .log"

Example 11: using multiple {} in the same command

The linux manual says that only one {} can be used in a command, but you can use multiple {} in the same command as below.

# find-name "* .txt" cp {}. Bkup\

Note that it's okay to use this {} in the same command, but not in different commands, that is, it doesn't work if you imagine renaming the file as follows

Find-name "* .txt"-exec mv {} `basename {} .htm`.html\

Example 12: using multiple {} instances

You can write a shell script like this to simulate the renaming example above

# mv "$1"`basename" $1 ".htm`.html"

The double quotation marks above are used to prevent spaces in the file name, which will be problematic if you don't add them. Then you save the shell script as mv.sh, and you can use the find command as follows

Find-name "* .html"-exec. / mv.sh'{}'\

So, in any case, if you want to use the same file name multiple times in the execution of the find command, write a script first, and then execute the script through-exec in find, passing in the file name parameter. This is the easiest way.

Example 13: redirect errors to / dev/nul

Redirecting error output is generally not a good idea. An experienced programmer understands that it is important to display an error at the terminal and correct it in a timely manner.

In particular, redirecting errors in find commands is not a good practice. But if you really don't want to see those annoying mistakes, you want to redirect them to the null device (that is, the black hole device on linux, where anything thrown in disappears without a trace). You can do something like this:

Find-name "* .txt" 2 > > / dev/null

Sometimes this is very useful. For example, if you want to find all the * .conf files in the / directory through your own account, you will get a lot of "Permission denied" error messages, like this:

$find /-name "* .conf" / sbin/generate-modprobe.conf find: / tmp/orbit-root: Permission denied find: / tmp/ssh-gccBMp5019: Permission denied find: / tmp/keyring-5iqiGo: Permission denied find: / var/log/httpd: Permission denied find: / var/log/ppp: Permission denied / boot/grub/grub.conf find: / var/log/audit: Permission denied find: / var/log/squid: Permission denied find: / var/log/ Samba: Permission denied find: / var/cache/alchemist/printconf.rpm/wm: Permission denied [Note: There are two valid * .conf files burned in the "Permission denied" messages]

Do you say annoying? So, if you only want to see the actual search results of the find command instead of these "Permission denied" error messages, you can redirect these error messages to / dev/null

$find /-name "* .conf" 2 > > / dev/null / sbin/generate-modprobe.conf / boot/grub/grub.conf [Note: All the "Permission denied" messages are not displayed]

Example 14: replace the spaces in the file name with an underscore

Many of the audio files you download from the Internet have spaces in their names. But file names with spaces are not good in linux (Unix-like) systems. You can use find and then add the replace function of the rename command to rename these files and convert spaces to underscores.

The following shows how to replace the spaces in the filenames of all mp3 files with _

$find. -type f-iname "* .mp3"-exec rename "s / / _ / g" {}\

Example 15: execute two commands simultaneously in the find result

On the man page page of find, the following is an example of a syntax for using two commands in a file lookup traversal

The following example of the find command, which traverses the file system once, lists the files and directories with the setuid attribute, writes to the / root/suid.txt file, and logs it to / root/big.txt if the file size is more than 100m

# find /\ (- perm-4000-fprintf / root/suid.txt'% # m% u% p\ n'\),\\ (- size + 100m-fprintf / root/big.txt'%-10s% p\ n'\) Thank you for reading! This is the end of this article on "sample analysis of using find commands in Linux". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, you can share it for more people to see!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.