Embedded Files
Concept
Concept
find [Location to search] [Criteria] [Action]
Location to search Default is current directory if not defined
Action Default is show find all finding result if not defined
Example
find / -name "hosts" 2> /dev/null
Location to search Root (/) directory
Criteria File named "hosts"
Action Only show non-error result
Criteria
Criteria
Name
Case-insensitive: -iname
Type
Directory: -type d
Regular file: -type f
Content
Find file which contain text: -exec grep -l "[Text]" {} \;
File Size
Larger than: -size +[File Size in B]
Smaller than: -size -[File Size in B]
Example: -size +100M, -size -10k
Action
Action
-exec
-exec [Command 1 which may contain {}] \;[Command 2 - Optional]
-exec Pass every found file into another command
{} Means file that found
\; Terminates the command
** Command 2 will be executed together during find stage and -exec stage.
Exp Command 2 is 2> /dev/null, means find and -exec only show success result.
xargs
| xargs [Command]
xargs Pass all files from find to command at once
Differences between -exec and xargs
Goal: Find log file and delete
-exec
find . -name "*.log" -exec rm {} \;
For every single file find identifies, it starts a brand new rm process.
If you have 1,000 files, your computer starts and stops the rm program 1,000 times.
It's like a mailman driving back to the post office after every single letter he drops off.
This is surgically precise but incredibly "expensive" in terms of CPU time and memory.
xargs
find . -name "*.log" | xargs rm
find gathers the list of 1,000 files and hands the whole list to xargs.
xargs then runs the rm command once, passing all 1,000 filenames as arguments.
This is like the mailman delivering all 1,000 letters in one organized route.
Your computer starts the rm program only once. It is significantly faster and more efficient.
Logical Operators
You can combine criteria using -and, -or, and -not.
Example: find . -type f -not -name "*.html" (Finds all files that do not end in .html)
Ignore Permission Denied Errors
Action: 2>/dev/null
When searching system directories, the output is often cluttered with "Permission denied" errors. Redirect these to the void.
Tutorial
Tutorial
Grant Permission to root directory
sudo -i
Find in root directory, file & directory that named hosts, just display success match result
find / -name "hosts" 2> /dev/null
Find in root directory, file only which its size > 100MB
find / -type f -size +100M
Find in root directory etc folder, file which its size > 1kB , then search the matched file whether contain text "student" (grep -l), ignore error result for all command
find /etc -size +1k -exec grep -l student {} \; 2> /dev/null
Why can this command only find file type but not directory? Because grep only able to search file, it will return error when the search result is directory
Find in root directory etc folder, file , search the matched file whether contain text "student" (grep -l), Only if the grep is successful, it proceeds to the second -exec, which copies (cp) that specific file into the find/contents/ directory, ignore error result for all command
find /etc -exec grep -l "student" {} \; -exec cp {} /find/contents/ \; 2> /dev/null
Find in root directory etc folder, every file regardless name, then use the full list of search result find which file contain text "127.0.0.1"
find /etc -name '*' -type f | xargs grep "127.0.0.1"
Result
student@localhost:~$ sudo -i
[sudo] password for student:
root@localhost:~# find / -name "hosts" 2> /dev/null
/etc/hosts
/etc/avahi/hosts
root@localhost:~# find / -type f -size +100M
/boot/initramfs-0-rescue-a6bc2c1625c94353ba65ae990fba8767.img
/proc/kcore
find: ‘/proc/3720/task/3742/fdinfo/229’: No such file or directory
find: ‘/proc/3720/task/3847/fdinfo/288’: No such file or directory
find: ‘/proc/3720/task/3982/fdinfo/243’: No such file or directory
find: ‘/proc/3720/task/3985/fdinfo/229’: No such file or directory
find: ‘/proc/3720/task/4234/fdinfo/288’: No such file or directory
find: ‘/proc/3720/task/4720/fdinfo/288’: No such file or directory
find: ‘/proc/4638’: No such file or directory
find: ‘/proc/4726/task/4726/fdinfo/6’: No such file or directory
find: ‘/proc/4726/fdinfo/5’: No such file or directory
find: ‘/run/user/1000/gvfs’: Permission denied
find: ‘/run/user/1000/doc’: Permission denied
/var/cache/PackageKit/10.1/metadata/rhel-10-for-x86_64-appstream-rpms-10-x86_64/packages/firefox-140.9.0-1.el10_1.x86_64.rpm
/var/cache/PackageKit/10.1/metadata/rhel-10-for-x86_64-appstream-rpms-10-x86_64/packages/firefox-140.7.0-1.el10_1.x86_64.rpm
/var/cache/PackageKit/10.1/metadata/rhel-10-for-x86_64-appstream-rpms-10-x86_64/packages/firefox-140.8.0-2.el10_1.x86_64.rpm
/usr/lib/sysimage/rpm/rpmdb.sqlite
/usr/lib/locale/locale-archive
/usr/lib/locale/locale-archive.real
/usr/lib64/firefox/libxul.so
/usr/lib64/libLLVM.so.20.1
root@localhost:~# find /etc -size +1k -exec grep -l student {} \; 2> /dev/null
/etc/shadow-
/etc/passwd
/etc/shadow
/etc/passwd-
/etc/security/limits.conf
root@localhost:~# find /etc -exec grep -l "student" {} \; -exec cp {} /find/contents/ \; 2> /dev/null
/etc/gshadow-
/etc/shadow-
/etc/group
/etc/gshadow
/etc/passwd
/etc/shadow
/etc/subgid
/etc/subuid
/etc/cups/subscriptions.conf.O
/etc/cups/subscriptions.conf
/etc/group-
/etc/passwd-
/etc/security/limits.conf
/etc/subuid-
/etc/subgid-
root@localhost:~# find /etc -name '*' -type f | xargs grep "127.0.0.1"
/etc/hosts:127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
/etc/security/access.conf:#+:root:127.0.0.1
/etc/samba/lmhosts:127.0.0.1 localhost
/etc/dnsmasq.conf:#address=/double-click.net/127.0.0.1
/etc/dnsmasq.conf:# Or which to listen on by address (remember to include 127.0.0.1 if
Page updated
Google Sites
Report abuse