How can we look for a file name?
What if we don’t know which directory that file is located in?
Can we start a fgrep at the root and ask the fgrep command to look in all subdirectories?
People confuse fgrep, which looks for text inside files (and doesn’t look at the file names), with find, which finds files by name (and doesn’t look inside the files).
The fgrep (and grep and egrep) commands look for patterns or text inside files whose names you already know. They aren’t directly useful for finding and generating the names of those pathnames. (To use fgrep to find the full name of a pathname, you would first have to use some other command to generate a list of all pathnames and feed that to fgrep in a pipeline as standard input – see the example below.)
You can tell fgrep to search the contents of an entire directory tree of files by turning on the fgrep “recursive” option; but, that won’t help you find the name of a pathname in that directory. The fgrep command searches content inside files, it doesn’t find the names of files.
To find pathnames by name you can use the find command. If the pathname has existed for some time and is saved in the right database, you might be able to use the faster locate or slocate commands to search by name.
To find pathnames by anything other than name, e.g. size, or owner, or modify date (etc.), use the find command with the right expression. See below.
The [startdir...] is an optional list of starting directories in which find will do the search, instead of using the current directory.
You rarely need to use any options, so the first thing following the find command name is usually the one directory or list of directories in which to look. The current directory is the default.
The find command has its own huge set of expressions for finding pathnames precisely and efficiently. The expressions follow the starting directories on the command line.
Below are five important uses of find, each explained in detail. You can find:
all pathnames under a list of starting directories
only pathnames containing a particular basename pattern
only pathnames owned by a particular userid
only pathnames modified within some number of days
only pathnames with a size greater than some number
The optional startdir... list in which to search comes first, followed by the optional expression that says what to find. If you don’t specify any startdir, find uses . (the current directory).
The optional expression must follow the starting directories. The expression limits the pathnames that are found or changes the output format. It consists of keywords, each preceded by dashes and usually followed by some argument, e.g. -name 'basename', -size +100M, -print, or -ls.
Without any expression, find finds all pathnames. With modern versions of find, you can omit the -print keyword; it’s the default behaviour.
The -name expression allows you to give a matching pattern that is the basename, found in any directory, starting from each of the starting_directories. The basename patterns can include shell-GLOB-style path metacharacters such as * and ?, and the patterns must be quoted to protect them from GLOB expansion by the shell, e.g. find -name '*.txt'
The -user expression allows you to give a userid that must be the owner of the pathnames found, e.g. find -user 'root'
The -mtime expression allows you to give a modify time expression. Using +10 means “older than 10 days” and -5 means “younger than 5 days, etc., e.g. find -mtime +365
The -size expression allows you give a size number, to match pathnames based on their rounded-up size. The size can have various size multipliers such as M for “MegaByte”, and the actual size of the file is rounded up to that multiplier before comparing. A leading minus on the number means “less than” and a leading plus on the number means “greater than” the given rounded size. The expression -size -100k means “rounded-up size less than 100 kilobytes”. Using -size 0 is a useful expression, to find pathnames that are empty (zero size), and -size +0 finds pathnames that are not empty (size greater than zero).
Note that the size rounding means that -size -1M only matches zero-size files (because even a one-byte file rounds up to 1M and doesn’t match)! If you really want to see all files smaller than 1M, you have to avoid the rounding and use 1024x1024 characters: -1048576c
See the man page for more help, and search the net for examples. For example, the -type f and -type d expressions are useful for finding only file names or only directory names:
$ find . -type f
$ find . -type d
The find command has expressions that can find pathnames based on any combination of any of the attributes you see in the output of ls -dils.
With more syntax, you can also have find show pathnames that match one expression or another expression, or any Boolean combination of expressions. See the man page.
The find command can output detailed attribute information about the pathnames it displays using the -ls expression instead of using the default -print expression:
$ find . -ls
The detailed output is similar to the output you would get if you typed ls -dils for the displayed names:
$ find /etc/passwd -ls
2101779 4 -rw-r--r-- 1 root root 2879 Oct 4 10:59 /etc/passwd
$ ls -dils /etc/passwd
2101779 4 -rw-r--r-- 1 root root 2879 Oct 4 10:59 /etc/passwd
This is the option to use if you want to display attribute information about the pathnames as well as the names.
5 Examples of uses of find, including World-WritableIndex
You can try these examples. Some will produce error messages as well as pathnames, since you don’t have permission to search all the system directories. Ignore the errors (or redirect standard error to /dev/null); look at the results:
you can combine multiple find expressions and only pathnames that meet all the criteria will be listed
If you use a pattern in the -name expression, remember to quote the pattern to protect any GLOB pattern characters from expansion by the shell! The characters need to be quoted to be GLOB-expanded by find, not by the shell.
While find has powerful pattern matching expressions, some people prefer to pipe the pathname output of find into one of the grep family of text searching programs because they better know how to use grep regular expression pattern matching.
You can generate a list of all pathnames under a given directory using the find command and then use grep on that piped output, e.g.
$ find
... all pathnames under the current directory list here ...
$ find "$HOME"
... all pathnames under your HOME directory list here ...
$ find /bin | wc -l # count pathnames under /bin
107
$ find /bin | fgrep 'sh' # only pathnames containing 'sh'
/bin/bash
/bin/dash
/bin/static-sh
/bin/sh
/bin/rbash
/bin/sh.distrib
$ find /bin | grep 'sh$' # only pathnames ending in 'sh'
/bin/bash
/bin/dash
/bin/static-sh
/bin/sh
/bin/rbash
The grep program uses a pattern matching language similar to GLOB patterns but more powerful called Regular Expressions. Don’t use grep to look for text until you become familiar with this pattern matching language; use the safer fgrep command instead.
Yes, you can do find / (find, starting at the top-most ROOT directory) and it will generate a list of all the pathnames on the whole machine that you have permissions to see – tens of thousands of them. This will take a long time. (You will also see many error messages about permissions, since your userid does not have permissions to look in every directory on the whole system.) Don’t run find / on a shared computer unless you really have to. (But feel free to try it on your own machine!)
7 Finding files using the locate or slocate commandsIndex
Many Unix systems run a weekly or nightly find / late at night and save the results in a small database. The locate or slocate commands can quickly search that saved database for you much faster than find, even using a file GLOB pattern, e.g.
$ locate passwd | less
... see all the names containing the string "passwd" here ...
$ locate '/etc/*passwd*'
/etc/passwd
/etc/passwd-
/etc/cron.daily/passwd
/etc/dovecot/conf.d/auth-passwdfile.conf.ext
/etc/init/passwd.conf
/etc/init.d/passwd
/etc/pam.d/chpasswd
/etc/pam.d/passwd
/etc/security/opasswd
Note the use of quotes to stop the shell from interpreting the GLOB pattern. (We want the locate command to process the GLOB pattern against the pathnames in the database; we do not want the shell to process the GLOB pattern against current pathnames in the file system before it calls the locate command.)
If you are looking for a pathname that has been around for a while and is entered into the database, the locate database lookup is much, much faster than a huge ROOT find /. If you are looking for a new pathname that isn’t in the locate database yet, only find will find it for you.
Author:
| Ian! D. Allen, BA, MMath - idallen@idallen.ca - Ottawa, Ontario, Canada
| Home Page: http://idallen.com/ Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom: http://eff.org/ and have fun: http://fools.ca/
