find

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

find walks through every folder below a starting point and checks each file against an expression of tests. By default it prints the matching names; with actions it can list, delete or run any command on them.

The pattern is: find WHERE TESTS ACTIONS. Several tests are joined with AND; use -o for OR, ! (or -not) for NOT, and $ … $ for groups.

Numbers in tests: +N = more than N, -N = less than N, N = exactly N. Times are in days (-mtime) or minutes (-mmin).

It reads the real file system, so it is always correct (unlike locate, which uses a database), but it can be slow on big trees. Errors like "Permission denied" go to stderr: add 2>/dev/null.

طريقة الكتابة

find [-H] [-L] [-P] [-D DEBUG] [-O LEVEL] [STARTING-POINT...] [EXPRESSION]

الخيارات 68

الأكثر استخدامًا

Before the starting point

-P: Never follow symbolic links (the default).
-L: Follow symbolic links.
-H: Follow links only for the starting points.
-D opts: Print debug information (help, tree, search, stat, rates, opt, exec).
-Olevel: Optimize the order of tests (0 to 3).

Global options (put them first in the expression)

-maxdepth n: Go at most N levels deep (1 = only the starting folder).
-mindepth n: Do not test the first N levels.
-xdev, -mount: Stay on the file system where you started.
-depth, -d: Handle the content of a folder before the folder itself.
-daystart: Measure times from the start of today, not from now.
-files0-from file: Read the starting points from a file (NUL separated).
-ignore_readdir_race, -noignore_readdir_race: Ignore (or report) files that disappear during the search.
-noleaf: Do not optimize for Unix file systems (for CD-ROMs, some network file systems).
-regextype type: Regex style for -regex: emacs, posix-extended, posix-basic …
-warn, -nowarn: Turn warnings on or off.
-follow: Old form of -L.
-help, --help: Show help.
-version, --version: Show the version.

Tests: name and path

-name pattern: The file name matches the pattern (wildcards, quote them).
-iname pattern: Like -name, ignore upper/lower case.
-path pattern, -wholename pattern: The whole path matches the pattern.
-ipath pattern, -iwholename pattern: Like -path, ignore case.
-regex pattern: The whole path matches the regular expression.
-iregex pattern: Like -regex, ignore case.
-lname pattern, -ilname pattern: The file is a link whose target matches the pattern.

Tests: type, owner, permissions

-type c: The type: f file, d folder, l link, b block, c character, p pipe, s socket.
-xtype c: The type of the link target (-xtype l = broken link).
-user name: Owned by this user.
-group name: Owned by this group.
-uid n, -gid n: Owned by this user/group number.
-nouser, -nogroup: The owner/group number has no name (deleted users).
-perm mode: Exactly these permissions (like 644).
-perm -mode: At least all these permission bits (like -4000 for SUID).
-perm /mode: Any of these permission bits.
-readable, -writable, -executable: You can read / write / run the file.
-context pattern: The SELinux context matches the pattern.
-fstype type: The file is on this file system type (xfs, nfs …).

Tests: size and content

-size n[ckMG]: The size: c bytes, k KiB, M MiB, G GiB (+ bigger, - smaller).
-empty: Empty file or empty folder.
-links n: Has N hard links.
-inum n: Has this inode number.
-samefile name: Is a hard link to the same inode as NAME.

Tests: time

-mtime n: Data changed N days ago (+ more, - less).
-mmin n: Data changed N minutes ago.
-atime n, -amin n: Last read N days / minutes ago.
-ctime n, -cmin n: Status (owner, permissions) changed N days / minutes ago.
-newer file: Changed more recently than FILE.
-anewer file, -cnewer file: Accessed / status-changed more recently than FILE's modification.
-newerXY ref: Compare time X of the file with time Y of the reference (a = access, c = change, m = modify, B = birth, t = a date text).
-used n: Accessed N days after its status changed.

Operators

$ expr $: Group tests.
! expr, -not expr: NOT.
expr1 expr2, expr1 -a expr2, -and: AND (the default).
expr1 -o expr2, -or: OR.
expr1 , expr2: Run both, use the result of the second.
-true, -false: Always true / always false.

Actions

-print: Print the path (the default action).
-print0: Print the path with a NUL byte at the end (safe with xargs -0).
-printf format: Print with a format: %p path, %s size, %u owner, %m mode, %t time …
-ls: Print details like ls -dils.
-delete: Delete the matching files (implies -depth). Test with -print first!
-exec cmd {} \;: Run CMD for each file ({} = the file).
-exec cmd {} +: Run CMD once with many files (faster).
-execdir cmd {} \;: Like -exec, but run in the file's folder (safer).
-ok cmd {} \;, -okdir cmd {} \;: Like -exec / -execdir, but ask first.
-prune: Do not go into this folder.
-quit: Stop at the first match.
-fprint file, -fprint0 file, -fprintf file format, -fls file: Write the output to a file.

أمثلة 17

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Find files by name
```
$find /etc -name "*.conf"
```
Quote the pattern, so the shell does not expand it first.
2Find all files of a user (exam classic)
```
#find / -user student -type f 2>/dev/null
```
2>/dev/null hides the "Permission denied" lines.
3Copy all files of a user to a folder
```
#mkdir -p /root/found
#find / -user student -type f -exec cp -a --parents {} /root/found/ \; 2>/dev/null
```
--parents keeps the paths, so files with the same name do not overwrite each other.
4Find big files that fill a disk
```
#find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null
```
-xdev stays on one file system, for example only /.
5Find files changed in the last 24 hours
```
#find /etc -mtime -1 -type f
```
After an incident or an update: what changed?
6Find SUID and SGID programs (security audit)
```
#find / -xdev -type f $ -perm -4000 -o -perm -2000 $ -ls 2>/dev/null
```
Compare the list with a known-good list. A new SUID file can be a backdoor.
7Find world-writable files
```
#find / -xdev -type f -perm -0002 ! -path "/proc/*" 2>/dev/null
```
Files everyone can change are a risk, except on purpose in /tmp.
8Find files without an owner
```
#find / -xdev $ -nouser -o -nogroup $ 2>/dev/null
```
Left over from deleted users. Give them an owner or remove them.

9Delete old logs safely

#find /var/log/myapp -name "*.log" -mtime +30 -print
#find /var/log/myapp -name "*.log" -mtime +30 -delete

Run with -print first, look at the list, then use -delete.

10Run a command on many files at once (fast)
```
$find . -name "*.sh" -exec chmod 750 {} +
```
+ passes many names in one call.

11Find text inside files

$find /etc -type f -name "*.conf" -exec grep -l "PermitRootLogin" {} + 2>/dev/null

grep -l prints only the names of files that contain the text.

12Handle names with spaces safely
```
$find /srv/uploads -type f -name "*.tmp" -print0 | xargs -0 rm -f
```
NUL separators work with any file name.
13Search only the top level of a folder
```
$find /var/www -maxdepth 1 -type d
```
Lists the sites, not every folder inside them.

14Skip a folder

$find /srv -path /srv/backup -prune -o -name "*.php" -print

Everything except what is under /srv/backup.

15Find files with a wrong SELinux label
```
#find /var/www/html ! -context "*httpd_sys_content_t*" -ls
```
Files that Apache cannot read because of their label.
16Find broken symbolic links
```
$find /etc -xtype l
```
Links whose target was removed.

17Print a custom report

$find /home -type f -size +100M -printf "%s\t%u\t%p\n" | sort -n

Size, owner and path; sorted by size.

انتبه

Order matters: -delete before a test deletes everything. Put tests first, the action last.
-delete and -exec rm are permanent. Always run the same command with -print first.
Quote patterns ("*.log"), or the shell expands them in the current folder first.
-mtime +1 means "more than 1 full day ago", which is at least 48 hours.

نصائح للحفظ

find WHERE WHAT DO: find /var -name "*.log" -size +100M -ls.
-exec … {} \; = one call per file, -exec … {} + = few calls (faster).

`find`

ماذا يفعل

طريقة الكتابة

الخيارات 68

Before the starting point

Global options (put them first in the expression)

Tests: name and path

Tests: type, owner, permissions

Tests: size and content

Tests: time

Operators

Actions

أمثلة 17

1Find files by name

2Find all files of a user (exam classic)

3Copy all files of a user to a folder

4Find big files that fill a disk

5Find files changed in the last 24 hours

6Find SUID and SGID programs (security audit)

7Find world-writable files

8Find files without an owner

9Delete old logs safely

10Run a command on many files at once (fast)

11Find text inside files

12Handle names with spaces safely

13Search only the top level of a folder

14Skip a folder

15Find files with a wrong SELinux label

16Find broken symbolic links

17Print a custom report

انتبه

نصائح للحفظ

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الخيارات 68

Before the starting point

Global options (put them first in the expression)

Tests: name and path

Tests: type, owner, permissions

Tests: size and content

Tests: time

Operators

Actions

أمثلة 17

1Find files by name

2Find all files of a user (exam classic)

3Copy all files of a user to a folder

4Find big files that fill a disk

5Find files changed in the last 24 hours

6Find SUID and SGID programs (security audit)

7Find world-writable files

8Find files without an owner

9Delete old logs safely

10Run a command on many files at once (fast)

11Find text inside files

12Handle names with spaces safely

13Search only the top level of a folder

14Skip a folder

15Find files with a wrong SELinux label

16Find broken symbolic links

17Print a custom report

انتبه

نصائح للحفظ

أوامر مرتبطة

مُستخدم في هذه الدروس

مُستخدم في هذه المعامل

الدليل الكامل

`find`