File Search in Linux

^ back on top ^

^ back on top ^

^ back on top ^

• updatedb : Update the database of indexed files

  The locate command searches for files based on the index database located at "/var/lib/mlocate/mlocate.db". However, it does not create this database file itself. The database is generated by another command called updatedb (update database).

  However, using locate and updatedb together is not without drawbacks. By default, the system may execute the updatedb command only once a day, which means that locate may not find files that have been modified during that time. Fortunately, you can manually update the index database by running the updatedb command (typically only the root user can execute updatedb).

  Therefore, the characteristics of locate are as follows:

  • It searches for files based on the index database created by the updatedb command, located at "/var/lib/mlocate/mlocate.db", rather than actually searching the disk or just searching the default paths.
  • It supports wildcard characters and regular expressions for file searching.

  Additionally, the index database created by the updatedb command follows the specifications in the configuration file "/etc/updatedb.conf". Here is a brief explanation:

  # cat /etc/updatedb.conf PRUNE_BIND_MOUNTS = ←"yes" to enable these rules, "no" to disable PRUNEFS = ← Filesystems to exclude from the index database (by default, rare and CD-ROM filesystems are excluded) PRUNENAMES = ← Files whose names contain these keywords will not be searched PRUNEPATHS = ← Directories excluded from indexing and updating the database

To exclude results that are directory names, you can use locate -b to only list files or directories that match the "base name" . What is the "base name"? Taking the file "/var/lib/mlocate/mlocate.db" as an example, after excluding the path, the rightmost part "mlocate.db" is the base name.

So, in the previous example, when running locate -b 586 instead of locate 586, the line "/usr/lib/rpm/i586-linux/macros" will not be listed. Using locate -b to only list files or directories that match the "base name" is also useful when combined with wildcard characters for file or directory searching.

^ back on top ^

For example, if your hard drive is almost full and you want to find the top 5 largest files occupying space, you can use the following command to uncover the culprits hogging your disk:
find / -type f -exec du {} ; 2>&- | sort -n | tail -n 5.

Because of the powerful functionality of find, it can be a bit complex to use. Additionally, it doesn't have a default search path or use an indexed database. Instead, it actually scans through the files on the hard drive one by one, which can be time-consuming.

The basic usage of find is find PATH -name 'PATTERN' If you omit the PATH, it searches the current working directory (including subdirectories) by default.

If you're a regular user, you might not have sufficient permissions to enter every directory layer for searching, resulting in error outputs cluttering the screen. In such cases, you can combine it with redirection to STDERR, like 2> /dev/null to filter out the error output. Alternatively, you can disable the stderr file descriptor by writing find / -name 'apple??' 2>&- to make the output cleaner.

• "+" symbol represents files larger than the specified size.
• "-" symbol represents files smaller than the specified size.
• If neither "+" nor "-" is used, it represents files exactly matching the specified size.
  

• "+" symbol represents the logical OR operation.
• "-" symbol represents the logical AND operation.
• With the logical OR operation, if any of the specified permissions match, the file is considered a match.
• With the logical AND operation, all the specified permissions must match for the file to be considered a match.

• According to file name or directory or filesystem:
  Example: (Usage of "find -path")

  $ cd / $ find -path './et*et' 2>&- ← Search for files or directories matching the path pattern './etet' within the current working directory (root directory in this case) ./etc/issue.net ./etc/alternatives/servlet ./etc/auto.net $ find / -path '/et*et' 2>&- ←Same as above, but specifies the starting path for the search ./etc/issue.net ./etc/alternatives/servlet ./etc/auto.net

  
  In the above example, the path pattern matching requires the inclusion of "/" for matching paths. However, when working within the current directory, it should be written as "./".
  
  Example: (Usage of "find -path -prune")

  # find /usr -path '/usr/lib' -a -prune -o -name 'applet.*' ↑ Search for files matching the name pattern 'applet.*' within the '/usr' directory, excluding the '/usr/lib' directory /usr/share/pygtk/2.0/defs/applet.defs /usr/share/nm-applet/applet.glade /usr/share/system-config-printer/applet.pyc /usr/share/system-config-printer/applet.png /usr/share/system-config-printer/applet.py /usr/share/system-config-printer/applet.glade /usr/share/system-config-printer/applet.pyo

  
  

  At first glance, this example may seem complicated and unclear. Let's break it down to understand it better. The "-a" symbol represents the logical AND operator (similar to "&&"), and the "-o" symbol represents the logical OR operator (similar to "||"). Therefore, if the execution result of the command find /usr -path '/usr/lib' is correct (meaning there is a '/usr' directory), the option "-prune" will be executed. Otherwise, the option "-name" will be executed.

  In the find command, if two expressions are used together, "-a" is the default value and can be omitted. Hence, in the example above, "-a" can be omitted.

  When using regular expressions with find -regex, the matching rules are similar to those used with find -path. You can include the path with "/" or "./".

  Example:

  # find -regex './.*\.txt' ←Search for files with the extension ".txt" in the current working directory # find / -regex '.*/bin' ←Search for "/bin" starting from the root directory # find / -regex '.*apple.*' ← Search for files with the string "apple" starting from the root directory # find / -regextype posix-extended -regex '.*ap+le.*' ←Specify extended regular expression typ

  
  Other uses related to file names or directories or filesystems are as follows:
  
  Example:

  $ find /etc \( -name '*.conf' -o -name '*.config' \) ↑ Search for files with the extensions ".conf" or ".config" in the directory "/etc". To use parentheses within the command, escape them with the backslash character "\" $ find / -mindepth 7 -name "*ee" ←Search for files matching the pattern "*ee" with a directory depth of at least 7 $ find / -name "myfile" -fstype vfat ←Search for files named "myfile" only in the DOS FAT filesystem $ find / -name "myfile" ! -fstype fuseblk ←Exclude files in the Windows NTFS (fuseblk) filesystem from the search for files named "myfile" $ find ./ ! -name "*.thml" ←Exclude files in the current working directory that do not have the extension ".html" $ find -not -name "*.thml" ←Same as the above example "!" can also be written as "-not" $ find -name *.jpg -delete ←Delete the files that match the pattern "*.jpg" in the current working directory

  
  
• According to the file size:
  It's important to note that the "-k" option represents the unit "k" as 1024 bytes (2¹⁰), commonly known as kibibytes (KiB), not 1000 bytes. Similarly, the "-M" option represents 1024² bytes (mebibytes, MiB), and the "-G" option represents 1024³ bytes (gibibytes, GiB).
  
  Example:

  $ find /etc -size 2b -exec ls -l {} \; Lists files in the "/etc" directory with a size of two blocks (512 bytes to 1024 bytes) and executes the "ls -l" command on each file $ find ~ -size 1024c ←Searches for files in the home directory with a size of 1024 bytes $ find ./ -size -2k ←Searches for files in the current working directory with a size less than 2 kibibytes $ find my_dir/ -size +1G ←Searches for files in the "my_dir" directory with a size greater than 1 gibibyte $ find -empty ←Searches for empty directories or files with a size of 0 in the current working directory

  
  These examples demonstrate different ways to search for files based on their size using the find command. The file size can be specified in various units such as bytes, kibibytes, mebibytes, or gibibytes, allowing you to perform size-based searches according to your requirements.
  
  
• By file type:
  
  Example:

  $ find / -empty ! -type f ←Searches for empty directories in the root directory ("/"), excluding files. $ find / -links 6 -not -type d ←Searches for files with a hard link count of 6 in the root directory ("/"), excluding directories $ find / -type d -name "man1" ←Searches for directories with the name "man1" in the root directory ("/")

  
  
• According to the permission or ownership attributes:
  
  Example:

  $ find /tmp -user aaa ← Searches for files in the "/tmp" directory owned by the user "aaa" $ find /tmp -group root ← Searches for files in the "/tmp" directory belonging to the group "root" $ find /home /tmp -nouser ← Searches for files that do not belong to any user in the "/home" and "/tmp" directories. This is commonly used to find files left on the disk from deleted user accounts $ find /home -uid 501 ←Searches for files in the "/home" directory with the UID (user ID) of 501

  
  Regarding the "-perm" option and searching based on numeric representation of permissions, here are some examples:
  (Due to the inclusion of special permissions, it is common to use a four-digit representation when dealing with permissions)
  
  Example:

  $ find / -perm 0444 -exec ls -l {} \; ←Searches for files with permissions "0444" (readable by all) in the root directory ("/") and executes the "ls -l" command on each file $ find / -perm -0444 ← Searches for files with permissions "0444" in the root directory ("/") using the logical AND operation (all conditions must be met) $ find / -perm +0444 ←Searches for files with permissions "0444" in the root directory ("/") using the logical OR operation (at least one condition must be met)

  
  Let's explain the last two examples. In the command find / -perm -0444, the "-" symbol represents the logical AND operation, which means that all specified conditions must be met for a file to be found. The resulting files may have permissions as follows:
  
  

  
  〝rw- r-- rw-〞
  〝r-x r-x r--〞
  〝rwx r-x rwx〞
  〝r-x r-- r--〞

  In other words, within the given scope, all three parts highlighted in red must match (while the non-red parts are disregarded) in order for a file to be considered a match. On the contrary, in the case of find / -perm +0444, the "+" symbol represents the logical OR operation. This means that if any of the specified conditions are met, the file will be considered a match. Therefore, the resulting files may have permissions as follows:
  
  

  
  〝rwx rwx rwr〞
  〝r-x --x r--〞
  〝rwx --x -wx〞
  〝--x r-- ---〞 

  In other words, for the three parts highlighted in red, only one of them needs to match for a file to be considered a match.
  So, find / -perm +7000 means finding any files with special permissions .
  
  
• By time:
  Sometimes, you may only remember that you saved a file a few days ago, but you might have forgotten the filename. In such cases, searching based on time can be very useful.
  
  Example:

  $ find ~ -mtime -5 ←Search for files in the home directory that have been modified within the last 5 days (unit is days) $ find ~ -mtime +5 ←Search for files in the home directory that have been modified more than 5 days ago. $ find ~ -mtime 5 ← Search for files in the home directory that were modified exactly 5 days ago

  In the above examples, the usage of the "+" and "-" symbols for time-based searching should be clear. Here are some other practical applications:
  
  Example:

  $ find /tmp -mmin -30 -type f ←earch for files in the "/tmp" directory that have been modified within the last 30 minutes (note that the unit is minutes) $ find ~/ -newer ref_file ←Search for files in the home directory that have a modification time newer than the reference file "ref_file" $ find ~/ -anewer ref_file ← Search for files in the home directory that have an access time newer than the reference file "ref_file"

  
  

^ back on top ^