find

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

find walks through every folder below a starting point and checks each file against an expression of tests. By default it prints the matching names; with actions it can list, delete or run any command on them.

The pattern is: find WHERE TESTS ACTIONS. Several tests are joined with AND; use -o for OR, ! (or -not) for NOT, and $ … $ for groups.

Numbers in tests: +N = more than N, -N = less than N, N = exactly N. Times are in days (-mtime) or minutes (-mmin).

It reads the real file system, so it is always correct (unlike locate, which uses a database), but it can be slow on big trees. Errors like "Permission denied" go to stderr: add 2>/dev/null.

Zo schrijf je het

find [-H] [-L] [-P] [-D DEBUG] [-O LEVEL] [STARTING-POINT...] [EXPRESSION]

Opties 68

Meest gebruikt

Before the starting point

-P: Never follow symbolic links (the default).
-L: Follow symbolic links.
-H: Follow links only for the starting points.
-D opts: Print debug information (help, tree, search, stat, rates, opt, exec).
-Olevel: Optimize the order of tests (0 to 3).

Global options (put them first in the expression)

-maxdepth n: Go at most N levels deep (1 = only the starting folder).
-mindepth n: Do not test the first N levels.
-xdev, -mount: Stay on the file system where you started.
-depth, -d: Handle the content of a folder before the folder itself.
-daystart: Measure times from the start of today, not from now.
-files0-from file: Read the starting points from a file (NUL separated).
-ignore_readdir_race, -noignore_readdir_race: Ignore (or report) files that disappear during the search.
-noleaf: Do not optimize for Unix file systems (for CD-ROMs, some network file systems).
-regextype type: Regex style for -regex: emacs, posix-extended, posix-basic …
-warn, -nowarn: Turn warnings on or off.
-follow: Old form of -L.
-help, --help: Show help.
-version, --version: Show the version.

Tests: name and path

-name pattern: The file name matches the pattern (wildcards, quote them).
-iname pattern: Like -name, ignore upper/lower case.
-path pattern, -wholename pattern: The whole path matches the pattern.
-ipath pattern, -iwholename pattern: Like -path, ignore case.
-regex pattern: The whole path matches the regular expression.
-iregex pattern: Like -regex, ignore case.
-lname pattern, -ilname pattern: The file is a link whose target matches the pattern.

Tests: type, owner, permissions

-type c: The type: f file, d folder, l link, b block, c character, p pipe, s socket.
-xtype c: The type of the link target (-xtype l = broken link).
-user name: Owned by this user.
-group name: Owned by this group.
-uid n, -gid n: Owned by this user/group number.
-nouser, -nogroup: The owner/group number has no name (deleted users).
-perm mode: Exactly these permissions (like 644).
-perm -mode: At least all these permission bits (like -4000 for SUID).
-perm /mode: Any of these permission bits.
-readable, -writable, -executable: You can read / write / run the file.
-context pattern: The SELinux context matches the pattern.
-fstype type: The file is on this file system type (xfs, nfs …).

Tests: size and content

-size n[ckMG]: The size: c bytes, k KiB, M MiB, G GiB (+ bigger, - smaller).
-empty: Empty file or empty folder.
-links n: Has N hard links.
-inum n: Has this inode number.
-samefile name: Is a hard link to the same inode as NAME.

Tests: time

-mtime n: Data changed N days ago (+ more, - less).
-mmin n: Data changed N minutes ago.
-atime n, -amin n: Last read N days / minutes ago.
-ctime n, -cmin n: Status (owner, permissions) changed N days / minutes ago.
-newer file: Changed more recently than FILE.
-anewer file, -cnewer file: Accessed / status-changed more recently than FILE's modification.
-newerXY ref: Compare time X of the file with time Y of the reference (a = access, c = change, m = modify, B = birth, t = a date text).
-used n: Accessed N days after its status changed.

Operators

$ expr $: Group tests.
! expr, -not expr: NOT.
expr1 expr2, expr1 -a expr2, -and: AND (the default).
expr1 -o expr2, -or: OR.
expr1 , expr2: Run both, use the result of the second.
-true, -false: Always true / always false.

Actions

-print: Print the path (the default action).
-print0: Print the path with a NUL byte at the end (safe with xargs -0).
-printf format: Print with a format: %p path, %s size, %u owner, %m mode, %t time …
-ls: Print details like ls -dils.
-delete: Delete the matching files (implies -depth). Test with -print first!
-exec cmd {} \;: Run CMD for each file ({} = the file).
-exec cmd {} +: Run CMD once with many files (faster).
-execdir cmd {} \;: Like -exec, but run in the file's folder (safer).
-ok cmd {} \;, -okdir cmd {} \;: Like -exec / -execdir, but ask first.
-prune: Do not go into this folder.
-quit: Stop at the first match.
-fprint file, -fprint0 file, -fprintf file format, -fls file: Write the output to a file.

Voorbeelden 17

$ als gewone gebruiker# als root (of met sudo)

1Find files by name
```
$find /etc -name "*.conf"
```
Quote the pattern, so the shell does not expand it first.
2Find all files of a user (exam classic)
```
#find / -user student -type f 2>/dev/null
```
2>/dev/null hides the "Permission denied" lines.
3Copy all files of a user to a folder
```
#mkdir -p /root/found
#find / -user student -type f -exec cp -a --parents {} /root/found/ \; 2>/dev/null
```
--parents keeps the paths, so files with the same name do not overwrite each other.
4Find big files that fill a disk
```
#find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null
```
-xdev stays on one file system, for example only /.
5Find files changed in the last 24 hours
```
#find /etc -mtime -1 -type f
```
After an incident or an update: what changed?
6Find SUID and SGID programs (security audit)
```
#find / -xdev -type f $ -perm -4000 -o -perm -2000 $ -ls 2>/dev/null
```
Compare the list with a known-good list. A new SUID file can be a backdoor.
7Find world-writable files
```
#find / -xdev -type f -perm -0002 ! -path "/proc/*" 2>/dev/null
```
Files everyone can change are a risk, except on purpose in /tmp.
8Find files without an owner
```
#find / -xdev $ -nouser -o -nogroup $ 2>/dev/null
```
Left over from deleted users. Give them an owner or remove them.

9Delete old logs safely

#find /var/log/myapp -name "*.log" -mtime +30 -print
#find /var/log/myapp -name "*.log" -mtime +30 -delete

Run with -print first, look at the list, then use -delete.

10Run a command on many files at once (fast)
```
$find . -name "*.sh" -exec chmod 750 {} +
```
+ passes many names in one call.

11Find text inside files

$find /etc -type f -name "*.conf" -exec grep -l "PermitRootLogin" {} + 2>/dev/null

grep -l prints only the names of files that contain the text.

12Handle names with spaces safely
```
$find /srv/uploads -type f -name "*.tmp" -print0 | xargs -0 rm -f
```
NUL separators work with any file name.
13Search only the top level of a folder
```
$find /var/www -maxdepth 1 -type d
```
Lists the sites, not every folder inside them.

14Skip a folder

$find /srv -path /srv/backup -prune -o -name "*.php" -print

Everything except what is under /srv/backup.

15Find files with a wrong SELinux label
```
#find /var/www/html ! -context "*httpd_sys_content_t*" -ls
```
Files that Apache cannot read because of their label.
16Find broken symbolic links
```
$find /etc -xtype l
```
Links whose target was removed.

17Print a custom report

$find /home -type f -size +100M -printf "%s\t%u\t%p\n" | sort -n

Size, owner and path; sorted by size.

Let op

Order matters: -delete before a test deletes everything. Put tests first, the action last.
-delete and -exec rm are permanent. Always run the same command with -print first.
Quote patterns ("*.log"), or the shell expands them in the current folder first.
-mtime +1 means "more than 1 full day ago", which is at least 48 hours.

Tips om te onthouden

find WHERE WHAT DO: find /var -name "*.log" -size +100M -ls.
-exec … {} \; = one call per file, -exec … {} + = few calls (faster).

`find`

Wat het doet

Zo schrijf je het

Opties 68

Before the starting point

Global options (put them first in the expression)

Tests: name and path

Tests: type, owner, permissions

Tests: size and content

Tests: time

Operators

Actions

Voorbeelden 17

1Find files by name

2Find all files of a user (exam classic)

3Copy all files of a user to a folder

4Find big files that fill a disk

5Find files changed in the last 24 hours

6Find SUID and SGID programs (security audit)

7Find world-writable files

8Find files without an owner

9Delete old logs safely

10Run a command on many files at once (fast)

11Find text inside files

12Handle names with spaces safely

13Search only the top level of a folder

14Skip a folder

15Find files with a wrong SELinux label

16Find broken symbolic links

17Print a custom report

Let op

Tips om te onthouden

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 68

Before the starting point

Global options (put them first in the expression)

Tests: name and path

Tests: type, owner, permissions

Tests: size and content

Tests: time

Operators

Actions

Voorbeelden 17

1Find files by name

2Find all files of a user (exam classic)

3Copy all files of a user to a folder

4Find big files that fill a disk

5Find files changed in the last 24 hours

6Find SUID and SGID programs (security audit)

7Find world-writable files

8Find files without an owner

9Delete old logs safely

10Run a command on many files at once (fast)

11Find text inside files

12Handle names with spaces safely

13Search only the top level of a folder

14Skip a folder

15Find files with a wrong SELinux label

16Find broken symbolic links

17Print a custom report

Let op

Tips om te onthouden

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`find`