The Linux Command Line (2012)

---

find—Find Files the Hard Way

While the locate program can find a file based solely on its name, the find program searches a given directory (and its subdirectories) for files based on a variety of attributes. We’re going to spend a lot of time with find because it has a bunch of interesting features that we will see again and again when we start to cover programming concepts in later chapters.

In its simplest use, find is given one or more names of directories to search. For example, it can produce a list of our home directory:

[me@linuxbox ˜]$ find ˜

On most active user accounts, this will produce a large list. Since the list is sent to standard output, we can pipe the list into other programs. Let’s use wc to count the number of files:

[me@linuxbox ˜]$ find ˜ | wc -l
47068

Wow, we’ve been busy! The beauty of find is that it can be used to identify files that meet specific criteria. It does this through the (slightly strange) application of tests, actions, and options. We’ll look at the tests first.

Tests

Let’s say that we want a list of directories from our search. To do this, we could add the following test:

[me@linuxbox ˜]$ find ˜ -type d | wc -l
1695

Adding the test -type d limited the search to directories. Conversely, we could have limited the search to regular files with this test:

[me@linuxbox ˜]$ find ˜ -type f | wc -l
38737

Table 17-1 lists the common file-type tests supported by find.

Table 17-1. find File Types

File Type	Description
b	Block special device file
c	Character special device file
d	Directory
f	Regular file
l	Symbolic link

We can also search by file size and filename by adding some additional tests. Let’s look for all the regular files that match the wildcard pattern *.JPG and are larger than 1 megabyte:

[me@linuxbox ˜]$ find ˜ -type f -name "*.JPG" -size +1M | wc -l
840

In this example, we add the -name test followed by the wildcard pattern. Notice that we enclose it in quotes to prevent pathname expansion by the shell. Next, we add the -size test followed by the string +1M. The leading plus sign indicates that we are looking for files larger than the specified number. A leading minus sign would change the string to mean “smaller than the specified number.” Using no sign means “match the value exactly.” The trailing letter M indicates that the unit of measurement is megabytes. The characters shown in Table 17-2 may be used to specify units.

Table 17-2. find Size Units

Character	Unit
b	512-byte blocks (the default if no unit is specified)
c	Bytes
w	2-byte words
k	Kilobytes (units of 1024 bytes)
M	Megabytes (units of 1,048,576 bytes)
G	Gigabytes (units of 1,073,741,824 bytes)

find supports a large number of different tests. Table 17-3 provides a rundown of the common ones. Note that in cases where a numeric argument is required, the same + and - notation discussed above can be applied.

Table 17-3. find Tests

Test	Description
-cmin n	Match files or directories whose content or attributes were last modified exactly n minutes ago. To specify fewer than n minutes ago, use -n; to specify more than n minutes ago, use +n.
-cnewer file	Match files or directories whose contents or attributes were last modified more recently than those of file.
-ctime n	Match files or directories whose contents or attributes (i.e., permissions) were last modified n*24 hours ago.
-empty	Match empty files and directories.
-group name	Match file or directories belonging to group name. name may be expressed as either a group name or as a numeric group ID.
-inamepattern	Like the -name test but case insensitive.
-inum n	Match files with inode number n. This is helpful for finding all the hard links to a particular inode.
-mmin n	Match files or directories whose contents were modified n minutes ago.
-mtime n	Match files or directories whose contents only were last modified n*24 hours ago.
-namepattern	Match files and directories with the specified wildcard pattern.
-newer file	Match files and directories whose contents were modified more recently than the specified file. This is very useful when writing shell scripts that perform file backups. Each time you make a backup, update a file (such as a log) and then use find to determine which files have changed since the last update.
-nouser	Match file and directories that do not belong to a valid user. This can be used to find files belonging to deleted accounts or to detect activity by attackers.
-nogroup	Match files and directories that do not belong to a valid group.
-perm mode	Match files or directories that have permissions set to the specified mode. mode may be expressed by either octal or symbolic notation.
-samefilename	Similar to the -inum test. Matches files that share the same inode number as file name.
-size n	Match files of size n.
-type c	Match files of type c.
-user name	Match files or directories belonging to name. name may be expressed by a username or by a numeric user ID.

This is not a complete list. The find man page has all the details.

Operators

Even with all the tests that find provides, we may still need a better way to describe the logical relationships between the tests. For example, what if we needed to determine if all the files and subdirectories in a directory had secure permissions? We would look for all the files with permissions that are not 0600 and the directories with permissions that are not 0700. Fortunately, find provides a way to combine tests using logical operators to create more complex logical relationships. To express the aforementioned test, we could do this:

[me@linuxbox ˜]$ find ˜ \
( -type f -not -perm 0600 \) -or \( -type d -not -perm 0700 \)

Yikes! That sure looks weird. What is all this stuff? Actually, the operators are not that complicated once you get to know them (see Table 17-4).

Table 17-4. find Logical Operators

Operator	Description
-and	Match if the tests on both sides of the operator are true. May be shortened to -a. Note that when no operator is present, -and is implied by default.
-or	Match if a test on either side of the operator is true. May be shortened to -o.
-not	Match if the test following the operator is false. May be shortened to -!.
( )	Groups tests and operators together to form larger expressions. This is used to control the precedence of the logical evaluations. By default, find evaluates from left to right. It is often necessary to override the default evaluation order to obtain the desired result. Even if not needed, it is helpful sometimes to include the grouping characters to improve readability of the command. Note that since the parentheses characters have special meaning to the shell, they must be quoted when using them on the command line to allow them to be passed as arguments to find. Usually the backslash character is used to escape them.

With this list of operators in hand, let’s deconstruct our find command. When viewed from the uppermost level, we see that our tests are arranged as two groupings separated by an -or operator:

(expression 1) -or (expression 2)

This makes sense, since we are searching for files with a certain set of permissions and for directories with a different set. If we are looking for both files and directories, why do we use -or instead of -and? Because as find scans through the files and directories, each one is evaluated to see if it matches the specified tests. We want to know if it is either a file with bad permissions or a directory with bad permissions. It can’t be both at the same time. So if we expand the grouped expressions, we can see it this way:

(file with bad perms) -or (directory with bad perms)

Our next challenge is how to test for “bad permissions.” How do we do that? Actually we don’t. What we will test for is “not good permissions,” since we know what “good permissions” are. In the case of files, we define good as 0600; for directories, 0700. The expression that will test files for “not good” permissions is:

-type f -and -not -perms 0600

and the expression for directories is:

-type d -and -not -perms 0700

As noted in Table 17-4, the -and operator can be safely removed, since it is implied by default. So if we put this all back together, we get our final command:

find ˜ (-type f -not -perms 0600) -or (-type d -not -perms 0700)

However, since the parentheses have special meaning to the shell, we must escape them to prevent the shell from trying to interpret them. Preceding each one with a backslash character does the trick.

There is another feature of logical operators that is important to understand. Let’s say that we have two expressions separated by a logical operator:

expr1 -operator bexpr2

In all cases, expr1 will always be performed; however, the operator will determine if expr2 is performed. Table 17-5 shows how it works.

Table 17-5. find AND/OR Logic

Results of expr1	Operator	expr2 is...
True	-and	Always performed
False	-and	Never performed
True	-or	Never performed
False	-or	Always performed

Why does this happen? It’s done to improve performance. Take -and, for example. We know that the expression expr1 -and expr2 cannot be true if the result of expr1 is false, so there is no point in performing expr2. Likewise, if we have the expression expr1 -or expr2 and the result of expr1 is true, there is no point in performing expr2, as we already know that the expression expr1 -or expr2 is true.

Okay, so this helps things go faster. Why is this important? Because we can rely on this behavior to control how actions are performed, as we shall soon see.

Actions

Let’s get some work done! Having a list of results from our find command is useful, but what we really want to do is act on the items on the list. Fortunately, find allows actions to be performed based on the search results.

Predefined Actions

There are a set of predefined actions and several ways to apply user-defined actions. First let’s look at a few of the predefined actions in Table 17-6.

Table 17-6. Predefined find Actions

Action	Description
-delete	Delete the currently matching file.
-ls	Perform the equivalent of ls -dils on the matching file. Output is sent to standard output.
-print	Output the full pathname of the matching file to standard output. This is the default action if no other action is specified.
-quit	Quit once a match has been made.

As with the tests, there are many more actions. See the find man page for full details.

In our very first example, we did this:

find ˜

This command produced a list of every file and subdirectory contained within our home directory. It produced a list because the -print action is implied if no other action is specified. Thus, our command could also be expressed as

find ˜ -print

We can use find to delete files that meet certain criteria. For example, to delete files that have the file extension .BAK (which is often used to designate backup files), we could use this command:

find ˜ -type f -name '*.BAK' -delete

In this example, every file in the user’s home directory (and its subdirectories) is searched for filenames ending in .BAK. When they are found, they are deleted.