1. Basic information of find command

• Command name: find
• search for files in a directory hierarchy
• Path: / bin/find
• Execution permission: all users.
• Function Description: search for files in the directory.

find command format:

[root@localhost ~ # find search path [options] search content

Options:
  -name: Search by file name
  -iname: Search by file name, case insensitive
  -inum: according to inode Number search

2. Basic use of find command

# 1. Basic use of find command
# Search by file name
[root@192 ~]# find . -name abcde
./abcde

# Tip: the larger the search location, the more system resources will be consumed.
# When searching on the production server, try not to search under the root directory and minimize the search scope.

# 2.-iname
[root@192 ~]# find . -iname abcde
./ABCDE
./abcde

# Tip: i means ignore, that is, ignore case.

# 3.-inum

# Previously, we can view the i node number of the file through the file name
[root@192 ~]# ls -i abcde 
1043285 abcde

# Here, you can use the - inum option of the find command to view the file name through the i node number.
[root@192 ~]# find . -inum 1043285
./abcde

# These two are a pair of commands, which are more convenient to remember.

Extension:
As we said before, hard connection is very difficult to identify links. The reference count of source files and hard link files has increased, and other information cannot be identified. As follows:

[root@192 ~]# ls -il abcde /tmp/abcde_h 
1043285 -rw-r--r--. 2 root root 0 12 June 30-18:24 abcde
1043285 -rw-r--r--. 2 root root 0 12 June 30-18:24 /tmp/abcde_h

We can see that the I node number of the hard connection file is the same as that of the source file. We can query whether there are multiple files corresponding to it through the I node number. In Linux system, one file corresponds to one i-node number. If multiple files correspond to one i-node number, it indicates that there is a hard connection relationship.

[root@192 ~]# find / -inum 1043285
find: "/proc/39609/task/39609/fd/5": There is no such file or directory
find: "/proc/39609/task/39609/fdinfo/5": There is no such file or directory
find: "/proc/39609/fd/5": There is no such file or directory
find: "/proc/39609/fdinfo/5": There is no such file or directory
/tmp/abcde_h
/root/abcde

We can see that through the above method, we can determine that the two files are hard linked. However, when we usually use Linux system, it is not recommended to create hard links to files.

Supplement: the first 4 lines of the above code block are interference items. When searching the entire root directory, the proc directory will be searched, and the proc directory is memory. When the find command is running, it will consume certain memory resources. These four lines are the temporary files generated by the find command when running. At the same time, this temporary file disappears immediately when it is found, so the "no file or directory" at the end of each line will appear.

3. Search by file size

[root@localhost ~]# find search path [options] search content

Options:
  -size[+|-]Size: searches for files of a specified size

Tip: here + means to search for files larger than the specified size, and - means to search for files smaller than the specified size.

(1) find command unit:

[root@localhost ~ ] # man find
    -size n[cwbkMG]
        File uses n units of space.The following suffixes can be used: 

        #This is the default unit. If the unit is b or no write unit, search according to 512 Byte.
        ' b': for 512-byte blocks(this is the default if no suffix is used)

        #The search unit is c, which is searched by bytes.
        'c': for bytes

        #The search unit is w, and the search is based on double bytes (Chinese).
        'w': for two-byte words

        #Search in KB units, which must be lowercase k.
        'k': for Kilobytes(units of 1024 bytes)

        #Search in MB units, must be an uppercase M
        'M': for Megabytes(units of 1048576 bytes)

        #Search in GB units, it must be a capital G
        ' G': for Gigabytes(units of 1073741824 bytes)

(2) Example:

# 1. View the file information under the root directory
[root@DevOps ~]# ll -h
 Total dosage 48 K
-rw-r--r--. 1 root root   17 1 September 17:08 abc
-rw-------. 1 root root 1.3K 12 June 23-20:46 anaconda-ks.cfg
-rw-r--r--. 1 root root  28K 12 June 23-20:46 install.log
-rw-r--r--. 1 root root 7.4K 12 June 23-20:45 install.log.syslog

# 2. Search for files with a file size of 28k in the current directory
[root@DevOps ~]# find . -size 28k
./install.log

# 3. Search for files larger than 1k in the current directory.
[root@DevOps ~]# find . -size +1k
.
./install.log
./anaconda-ks.cfg
./install.log.syslog

# Note: see the above list for specific unit letters.

# 4. Pay attention to a small problem
# If you search by file size, and the file size has no case unit, the default is to search by b (bytes), but we can see that there is no abc file in the query below.

[root@DevOps ~]# ll -h
 Total dosage 48 K
-rw-r--r--. 1 root root   17 1 September 17:08 abc
-rw-------. 1 root root 1.3K 12 June 23-20:46 anaconda-ks.cfg
-rw-r--r--. 1 root root  28K 12 June 23-20:46 install.log
-rw-r--r--. 1 root root 7.4K 12 June 23-20:45 install.log.syslog
[root@DevOps ~]# find . -size 17
[root@DevOps ~]# 

# as a result of:
# See the unit description ` 'b' above: for 512 byte blocks (this is the default if no suffix is used)`
# The default unit of B is 512byte, which is a default attribute value. For example, we entered 17 above, which is the result of 17*512b, calculate it, and then find it.
# `c ` is search by byte.

[root@DevOps ~]# find . -size 17c
./abc

4. Search by modification time

Files in Linux include access time (atime), data modification time (mtime) and status modification time (ctime). We can also search files according to time.

Note: if the time unit ends with time, the default unit time is day.

The command format is as follows:

[root@localhost ~ ] # find search path [options] search content

Options:
  -atime[+|-]Time: search by file access time
  -mtime[+|-]Time: search by file data modification time
  -ctime[+|-]Time: modify the time search according to the file status

Tip: there are also - amin, - mmin and other time options. The time unit is minutes.

Take mtime data modification time as an example, focusing on the meaning of + and - time.

Let's draw a timeline to explain, as shown below:

explain:

• -5: Represents documents modified within 5 days.
• 5: Represents the documents modified on the previous 5 ~ 6 days.
• +5: Represents the document modified 6 days ago.

5. Search by permissions

The command format is as follows:

[root@localhost ~]# find search path [options] search content

Options:
  -perm: Permission mode: find the file whose permission is just equal to "permission mode"
  -perm: -Permission mode: find files whose permissions all include permission mode
  -perm: +Permission mode: find files with any permission in permission mode

give an example:

# 1. View folder contents
[root@DevOps test]# ll
 Total consumption 0
-rw-r--r--. 1 root root 0 1 September 18:17 abc
-rw-r--r--. 1 root root 0 1 September 18:17 def

# 2. Find files according to permissions
[root@DevOps test]# find . -perm 644
./def
./abc

# Note: 644 represents authority rw-r--r--

# 3. Modify the def permission of the file to 600, and then perform +, - Search
[root@DevOps test]# chmod 600 def 
[root@DevOps test]# ll
 Total consumption 0
-rw-r--r--. 1 root root 0 1 September 18:17 abc
-rw-------. 1 root root 0 1 September 18:17 def

# lookup
[root@DevOps test]# find . -perm +444
.(Represents the current directory (not considered)
./def
./abc
[root@DevOps test]# find . -perm -444
.
./abc
[root@DevOps test]# 

explain:

• If it is +, it represents the owner, the group to which it belongs and others. If one of the three permissions is greater than the search permission, it can be found.
• If yes -, it means that the three permissions must meet each permission. For example, the permission of abc file is 644, and each permission is greater than 444, so it is searched.
• Summary: + means that only one of the three permissions can be satisfied, and - only three permissions can be satisfied.

Tip: it's good to understand the authority search of find, + and - are generally not used too much in work.

6. Search by owner and group

The command format is as follows:

[root@localhost ~]# find search path [options] search content

Options:
  -uid user ID: By user ID Find owner is specified ID File
  -gid group ID: By user group ID Find the group to which you belong ID File
  -user User name: find the file whose owner is the specified user according to the user name
  -group Group name: find the files belonging to the specified user group according to the group name
  -nouser: Find files without owners

give an example:

# Find files by owner
[root@DevOps test] # find . -user root
.
./def
./abc

Tips:

• (important) the above method is not commonly used. When searching by owner and group, the - nouser option is commonly used. It is mainly used to find garbage files.
• (important) there is only one exception, that is, external documents. For example, if the files on the CD-ROM and U SB flash disk are copied by Windows (that is, the files are created by Windows), they are files without owners when viewed in Linux; Another example is that the files installed by manual source packages may not have an owner (source packages played by other systems).
• Except for foreign files, all files under Linux system should have an owner, otherwise at least it is a garbage file. It needs users to deal with it.

The common commands for owner and group search are:

[root@DevOps test] # find / -nouser
find: "/proc/5244/task/5244/fd/5": There is no such file or directory
find: "/proc/5244/task/5244/fdinfo/5": There is no such file or directory
find: "/proc/5244/fd/5": There is no such file or directory
find: "/proc/5244/fdinfo/5": There is no such file or directory

Note: as mentioned earlier, these four lines are temporary files generated in memory when the find command is executed. They disappear after execution.
The above command results show that there are no garbage files in the Linux system.

7. Search by file type

The command format is as follows:

[root@localhost ~]# find search path [options] search content

Options:
  -type d: find directory
  -type f: Find normal files
  -type l: Find soft link files

give an example

# Find a directory in the current file
[root@DevOps ~]# find . -type d
.
./test

# Other options are the same.

8. Logical operator

The find command supports some complex search methods: logical and, logical or, and logical non.

The command format is as follows:

[root@localhost ~]# find search path [options] search content

Options:
  -a:and Logic and
  -o:or Logical or
  -not:not Logical non

(1) - a: and logic and

The find command also supports the logical operator option, where - a represents logic and operation, that is, if both conditions of - a are true, the find search result is true (if one of them is not true, it will not work).

for instance:

# Search for files larger than 2KB in the current directory and the file type is ordinary files
[root@localhost ~]# find . -size +2k -a -type f

(2) - o: or logical or

-The o option represents a logical or operation, that is, as long as one of the two conditions of - O is true, the find command can find the result.

for instance:

# Search for files in the current directory, either cangls files or bols files. You can search for both. 
[root@localhost ~]# find . -name cangls -o -name bols
./cang1s
./bols

(3) - not: not logical

not is logical non, which means taking the opposite.

for instance:

# Search the current directory for files whose file name is not cangls
[root@localhost ~]# find . -not -name cangls

# below! The expression of and - not above are the same meaning. They are both logical non operators.
[root@localhost ~]# find . ! -name cangls

# (note! There should be spaces on the left and right sides)

9. Other options

Here we mainly explain the two options - exec and - ok. The basic functions of these two options are very similar.

Let's first look at the format of the - exec option.

(1) - exec option

[root@localhost ~]# find search path [options] search content - exec Command 2 {} \;

explain:

1. The basic format, as long as you write - exec, you must write \; at the end of the command;.
2. The function is to take the search result of command 1 (find search path [options] search content) as the operation object of Command 2. (in fact, it can be understood that the operation result of command 1 is placed in {} after Command 2, and then command 2 is used to search the content in {}.)
3. The alias is not recognized in Command 2, that is, the alias cannot be used in Command 2, if the ll command.

(2) - ok option

-The functions of the ok option and the - exec option are basically the same. The difference is that the command 2 of - exec will be processed directly without asking- ok Command 2 will ask the user whether to handle it like this before processing. It will be executed only after receiving the confirmation command.

Examples are as follows:

# When deleting some zero files generated by yourself and not used for a long time, you can delete them with the following command.
[ root@ localhost ~] # find /var/log -mtime +10 -ok rm -rf 0\; 
〈 rm.../var/log/samba/old〉?n
〈 rm.../var/log/sssd〉?n
〈 rm...I/var/log/ntpstats〉?n
〈 rm.../var/log/cups〉?n