The find Command

The find command enables you to perform a search through the entire system (or across the network to other systems) for a file that meets specific criteria. You can search for a file by its filename, I-node number, size, data, or any other piece of information you might have about that file. Use the find command to locate misplaced files. Maybe you’ve forgotten the name of the file or simply want a list of files created by a particular user on a particular date.

To begin using find, you need to understand the syntax for the command, which is as follows:

find <search-path> <search-criteria> actions
					

The following list explains each of the components for the preceding syntax:

• <search-path> The directory (or file system) from which you want to begin the search. If you specify the root (/) directory, you’ll search all of the system’s file systems beginning from root (/). On a system with several gigabytes of disk space, the search will recursively search the directory structure, including all subdirectories, looking for the file. This search could take a long time, eating up CPU resources and disk I/O. Try to limit the search to an area that you suspect the file could be in.

• <search-criteria> An expression made up of keywords and arguments that specify criteria used to locate the file(s). Perhaps you know the filename or maybe just part of the name. Perhaps you know who created the file. All of this information can be used as criteria to narrow the search.

  For example, if you know that the filename ends in .exe, the find command will list all files that end in .exe. If you know the file was created by bcalkins, it will only list files with an .exe extension that were created by bcalkins. The more criteria you specify, the more you’ll narrow your search to the specific file(s) for which you are looking. There are many keywords you can use to specify criteria by which to search. Here are some of the more useful:

  • File or directory name

  • File type (file, directory, special device file)

  • User or group name

  • Access or modification time

  • Permissions

  • actions This is where you specify the task to perform once the file(s) is found. You can simply list its location, you can remove it, or you can use find to execute any UNIX command on the list of files that you’ve located.

Search Criteria

Here are some of the more common <search-criteria> keywords you’ll use to specify criteria when searching for a file. Use these keywords alone or together:

• -atime <n> Use this option to specify a file’s access time. Access time on a file is set to when a file was last read or changed. In the case of directories, it refers to when they have been listed or changed.

• -mtime <n> Use this option to specify a file’s modification time. Modification time on a file is set to when a file was last altered in some way such as editing, moving, or renaming.

  Note

  When specifying the value <n> for –atime or –mtime, you’ll specify the number of days. You can precede the number with a + (plus) or – (minus). A (+) plus sign means “more than” the specified number of days. A (–) minus sign means “less than” the specified number of days. If no sign is used, it means “exactly” the specified number of days.

  For example, -atime 4 instructs find to search files that have been accessed exactly four days ago. If you specify –time –4, all files accessed within the last four days will be listed, and –atime +4 will list all files that have been accessed more than four days ago.

  
  

• -fstype <v> Use this option locate files of a specific type, where <v> is a value for the file type and can be nfs, ufs, cachefs, or any other Solaris-supported fstype.

• -group <gid> Use this option to search for files that belong to the group specified by <gid>. The GID or the groupname (as it appears in /etc/group) can be specified.

• -inum <n> Use this option to search for a file(s) by its I-node number <n>.

• -local This instructs find to search local file systems only. With this option, find will not search remote file systems.

• -mount This restricts the search to the file system containing the specified directory only. For example, if I specify root (/) as the search path, only directories in the root file system will be searched. find will not search other file systems such as /var, /usr, and /export.

• -name <filename> Use this option to specify the name of the file (if you know it). If you don’t know the full name, you can use normal shell filename metacharacters to search for patterns. See the example later in this section.

• -perm <perm-mode> Use this option to search for files that have the specified permission modes set. For example, specify -perm u=rwx,g=rx,o=rx to search for all files with permission modes that match read, write, and execute access for user and read and execute access for group and other.

• -size <n>c Use this option to search for files based on their size. Use the c after the file size to indicate bytes rather than blocks.

  The value of <n> is a numeric value that specifies the file size as follows:

  +<n>c	True if the file is larger than <n> bytes
  -<n>c	True if the file is less than <n> bytes
  <n>c	True of the file size is exactly <n> bytes

  
  

• -type <v> True if the type of the file is <v>, where <v> is one of the following file types:

  b	Block special file
  c	Character special file
  d	Directory
  D	Door
  f	Regular file
  l	Symbolic link
  p	Named pipe
  s	Socket

  
  

• -user <uid> Use this option to search for files that belong to the user specified by <uid>. The UID or the username (as it appears in /etc/passwd) can be specified.

Actions

Here are some of the more common action keywords that you’ll use to specify the task to be performed after the file has been found.

• -ls Use this option to get a long listing of the files that were found. The long listing will display:

  • I-node number

  • Size in kilobytes (1,024 bytes)

  • Protection mode

  • Number of hard links

  • User

  • Group

  • Size in bytes

  • Modification time

    If the file is a symbolic link, the pathname of the linked-to file is printed preceded by ->, just like you see when you issue the ls –l command. If you don’t specify –ls, the default is to list only the filename.

• -exec <command> Use this option to specify a command to execute on each file that is found. See the examples at the end of this section that illustrate how to use this option.

• -ok <command> This is just like the -exec option, except you will be asked to confirm the execution of the command by typing y.

find examples

To describe how to use the find command, it’s useful to show specific examples. Here are a few examples of how to perform some of the more common tasks using the find command.

Example 1:

Here’s how to find files of a specific size:

find / -size 5000c -ls 

The find command will begin the search at the root (/) directory. It will search for files that are larger than 5,000 bytes. The results will be printed to the screen with a long listing:

89770   1 -rw-r--r--   1 root   sys     500 Nov  8  2001 /usr/lib/adb/glm_cmd 
167218  1 -r--r--r--   1 root   bin     500 Nov  5  2001  
/usr/lib/help/auths/locale/C/AuthSerialmgrModify.html 
363967  1 -r--r--r--   1 root   sys     500 Nov  5  2001  
/usr/sadm/lib/wbem/help/cimworkshop/locale/C/qualifiers_001.htm 
167189  1 -r--r--r--   1 root   bin     500 Nov  5  2001  
/usr/sadm/lib/smc/prereg/SUNWmc/ViperXClientProvider_classlist.txt 
204238  1 -rw-r--r--   1 root   sys     500 Nov  5  2001  
/usr/sadm/lib/logviewer/LogViewerCliInfo.xml 
219134  1 -rw-r--r--   1 root   sys     500 Nov  5  2001  
/usr/sadm/lib/serialmgr/SerialMgrCliInfo.xml 

Example 2:

Here’s how to search for several files at the same time using the logical or operator:

find /etc ( -name 'rc*' -o -name 'hos*' ) -mount -ls 

In this example, I’ll look for files in the /etc directory that begin with rc or (-o) that begin with hos, and I’ll list them out on the screen with a long listing. I specified the –mount option so that only the root (/) file system is searched.

As the system locates files that meet the criteria, they are displayed on the screen:

182800  1 lrwxrwxrwx   1 root     root     12 Feb 26 15:34 /etc/hosts -> ./inet/hosts 
215043  1 -r--r--r--   1 root     sys     117 Jun  5 21:02 /etc/inet/hosts 
10754   1 -rw-r--r--   1 root     sys      79 Feb 26 16:00 /etc/net/ticlts/hosts 
14338   1 -rw-r--r--   1 root     sys      79 Feb 26 16:00 /etc/net/ticots/hosts 
17922   1 -rw-r--r--   1 root     sys      79 Feb 26 16:00 /etc/net/ticotsord/hosts 
182817  1 lrwxrwxrwx   1 root     root     11 Feb 26 15:34 /etc/rc0 -> ../sbin/rc0 
25089   1 drwxr-xr-x   2 root     sys    1024 Feb 27 09:28 /etc/rc0.d 
182818  1 lrwxrwxrwx   1 root     root     11 Feb 26 15:34 /etc/rc1 -> ../sbin/rc1 

Searching for multiple files using multiple find commands makes multiple passes through file systems and wastes disk I/O. It’s much more efficient to look for all files at the same time, thus only making one pass across the file systems. Use the method previously described utilizing the logical or operator (-o) to search for more than one file in a single search. It’s more efficient.

Example 3:

To search for files based on their modification dates, issue the following command:

find /export -mtime +10 -mtime -30 -ls 

In this example, I’m specifying a range to search for files that have been modified (-mtime) more than 10 days ago but less than 30.

Example 4:

You can find files that are owned by a particular user as follows:

find / -user root -ls 

Beginning from the root (/) directory, all file systems will be searched for files that belong to the user root.

The exact opposite can be performed by using the ! (exclamation point) in front of a pattern. The ! is the unary not operator. It’s used to search for files that do not meet your search criteria. In the next example, the system will be searched for all files that do not belong to the user root.

find / ! -user root -ls 

Example 5:

To perform an action on a file, use the –exec option as follows:

find / -name core –exec rm {} ; 

In the previous example, the system will be searched for all files named core. The rm command will be executed on each file found. A safer version of this command uses the –ok action, which prompts you before removing each file. Here’s an example:

find / -name core –ok rm {} ; 

The system responds with the following:

< rm ... /core >? 

Answer either y (yes) or n (no). A y will complete the operation, and an n will abort the operation.