Introduction to Unix

3.5. Finding Files

Linux for Programmers and Users, Section 4.5

The find command is a very powerful program to find files that match almost any combination of criteria imaginable. Find is useful for locating and correcting problems with files and also just to find a file that you can not remember where the file is.

See also

Other commands that can find files are: locate, whereis and which.

locate

Uses a database to find files names matching a search pattern very quickly. Files newer than the last time the database was will not be found.

whereis

Locates system provided source/binary and manuals sections for specified files. It only searches in common locations for files.

which

Searches your PATH for programs matching executable programs. When finding a file in the PATH, it is convenient to use which with command substitution. It will also report if a command has an alias definition.

type

A Bash shell builtin command. It produces similar output as the which command. The output is intended for human reading, rather than for use with command substitution. Unlike which, type will report if a command is a shell built-in command.

3.5.1. find

SYNOPSIS

find [-H] [-L] [-P] [path…] [expression]

DESCRIPTION

search for files in a directory hierarchy

The find -H, find -L and find -P options control the treatment of symbolic links. Command-line arguments following these are taken to be names of files or directories to be examined, up to the first argument that begins with ‘-‘, ‘(‘ , ‘)’, ‘,’ , or ‘!’. That argument and any following arguments are taken to be the expression describing what is to be searched for.

-P

Never follow symbolic links. This is the default behaviour.

-L

Follow symbolic links.

-H

Do not follow symbolic links, except while processing the command line arguments.

EXPRESSIONS

-depth

Process each directory’s contents before the directory itself.

-mount

Don’t descend directories on other filesystems.

-xdev

Don’t descend directories on other filesystems.

Numeric arguments can be specified as:

+n

for greater than n,

-n

for less than n,

n

for exactly n.

FILE MATCHING EXPRESSIONS

-amin n

File was last accessed n minutes ago.

-anewer file

File was last accessed more recently than file was modified.

-atime n

File was last accessed n*24 hours ago.

-cmin n

File’s status was last changed n minutes ago.

-cnewer file

File’s status was last changed more recently than file was modified.

-ctime n

File’s status was last changed n*24 hours ago.

-empty

File is empty and is either a regular file or a directory.

-gid n

File’s numeric group ID is n.

-group gname

File belongs to group gname (numeric group ID allowed).

-ilname pattern

Like -lname, but the match is case insensitive.

-iname pattern

Like -name, but the match is case insensitive.

-inum n

File has inode number n. It is normally easier to use the -samefile test instead.

-iregex pattern

Like -regex, but the match is case insensitive.

-links n

File has n links.

-lname pattern

File is a symbolic link whose contents match shell pattern pattern.

-mmin n

File’s data was last modified n minutes ago.

-mtime n

File’s data was last modified n*24 hours ago.

-name pattern

Base of file name (the path with the leading directories removed) matches shell pattern pattern. The metacharacters (‘*’, ‘?’, and ‘[]’) match a ‘.’ at the start of the base name.

-newer file

File was modified more recently than file.

-nouser

No user corresponds to file’s numeric user ID.

-nogroup

No group corresponds to file’s numeric group ID.

-perm mode

-perm mode

File’s permission bits are exactly mode (octal or symbolic). Since an exact match is required, if you want to use this form for symbolic modes, you may have to specify a rather complex mode string. It is more likely that you will want to use the ‘/’ or ‘-‘ forms, for example ‘-perm -g=w’, which matches any file with group write permission.

-perm -mode

All of the permission bits mode are set for the file. Symbolic modes are accepted in this form, and this is usually the way in which would want to use them. You must specify ‘u’, ‘g’ or ‘o’ if you use a symbolic mode.

-perm +mode

On some systems, this may use /mode instead of +mode. Any of the permission bits mode are set for the file. Symbolic modes are accepted in this form. You must specify ‘u’, ‘g’ or ‘o’ if you use a symbolic mode.

-regex pattern

File name matches regular expression pattern. This is a match on the whole path, not a search.

-size n[bcwk]

True if the file uses n units of space. b is for 512-byte blocks, c is for characters (bytes), w is for two-byte words, k is for kilobytes.

-samefile name

File refers to the same inode as name. When -L is in effect, this can include symbolic links.

-true

Always true.

-type c

File is of type c:

d – directory

f – regular file

l – symbolic link; this is never true if the -L option or the

-follow option is in effect

-uid n

File’s numeric user ID is n.

-used n

File was last accessed n days after its status was last changed.

-user uname

File is owned by user uname (numeric user ID allowed).

ACTIONS (see xargs)

-delete

Delete files

-exec

-exec command ;

Execute command; true if 0 status is returned. All following arguments to find are taken to be arguments to the command until an argument consisting of ‘;’ is encountered. The string ‘{}’ is replaced by the current file name being processed everywhere it occurs in the arguments to the command.

-exec command {} +

This variant of the -exec option runs the specified command on the selected files, but the command line is built by appending each selected file name at the end.

-print

Print the full file name on the standard output. The GNU find turns this option on by default, so it is not necessary to add this option. It is needed with the AT&T UNIX find program.

-print0

True; print the full file name on the standard output, followed by a null character (instead of the newline character that find -print uses). This allows file names that contain newlines or other types of white space to be correctly interpreted by programs that process the find output.

OPERATORS

Listed in order of decreasing precedence:

( expr )

Force precedence.

! expr True if expr is false.

-not expr

Same as ! expr, but not POSIX compliant.

expr1 expr2

Two expressions in a row are taken to be joined with an implied “and”; expr2 is not evaluated if expr1 is false.

expr1 -a expr2

Same as expr1 expr2.

expr1 -and expr2

Same as expr1 expr2, but not POSIX compliant.

expr1 -o expr2

Or; expr2 is not evaluated if expr1 is true.

expr1 -or expr2

Same as expr1 -o expr2, but not POSIX compliant.

3.5.2. xargs

The xargs command works very well along with find to execute a command for each file found.

SYNOPSIS

xargs [OPTIONS] [command [initial-arguments]]

DESCRIPTION

xargs reads items from the standard input, delimited by blanks (which can be protected with double or single quotes or a backslash) or newlines, and executes the command (default is /bin/echo).

Because Unix filenames can contain blanks and newlines, this default behaviour is often problematic; filenames containing blanks and/or new lines are incorrectly processed by xargs. In these situations it is better to use the xargs -0 option, which prevents such problems. When using this option you will need to ensure that the program which produces the input for xargs also uses a null character as a separator. If that program is GNU find for example, the find -print0 option does this for you.

--arg-file=file, -a file

Read items from file instead of standard input.

--null, -0

Input items are terminated by a null character instead of by whitespace, and the quotes and backslash are not special (every character is taken literally).

--delimiter=delim, -d delim

Input items are terminated by the specified character.