FIND Command

To look across the /bin and /var/html directory trees for filenames that contain the pattern *.htm*, you can use the following command:

find /usr /var/html -name “*.htm*” -print

Finding udump directory starting from ORACLE_BASE

find $ORACLE_BASE -name “udump” -print

Finding Directories

To find a list of the directories use can use the -type specifier.

find . -type d -print

 

Access,Modified,Changed Time

“-atime/-ctime/-mtime” [+|-]n

Specify selection of the files based on  three Unix timestamps: the last time a files’s “access time”, “file status” and “modification time”.  
n is time interval — an integer with optional sign. It is measured in 24-hour periods (days) or minutes counted from the current moment.

  • +n: if it has plus sing, then it means “more than n 24-hour periods (days) ago”, or older then n,
  • -n: if it has the minus sign, then it means less than n 24-hour periods (days) ago (-n), or younger than n. It’s evident that -1,  and 0 are the same and both means “today”.
  • n: If the integer n does not have sign this means exactly n 24-hour periods (days) ago, 0 means today.

find everything in your home directory modified in the last 24 hours:
                        find $HOME -mtime -1

Find everything in your home directory modified in the last seven 24-hour periods (days):
                       find $HOME -mtime -7

Find everything in your home directory that have NOT been modified in the last year:
                      find $HOME -mtime +365

To find html files that have been modified in the last seven 24-hour periods (days), I can use -mtime with the argument -7 (include the hyphen): 
                     find . -mtime -7 -name “*.html” -print

If you use the number 7 (without a hyphen), find will match only html files that were modified exactly seven 24-hour periods (days) ago:
                      find . -mtime 7 -name “*.html” -print

To find those html files that I haven’t touched for at least seven 24-hour periods (days), I use +7:
                     find . -mtime +7 -name “*.html” -print

 

-newer/-anewer/-cnewer baseline_file

The time of modification, access time or creation time are compared with the same timestamp in the baseline file. If file is a symbolic link and the -H option or the -L option is in effect, the modification time of the file it points to is always used.

  • -newer Modification time is compared with modification time of the basline_file True if file was modified more recently than baseline file.
  • -anewer Access time is compared with access time of basline_file . True if file was last accessed more recently than baseline file.
  • -cnewer Creation file is compared. For example: find everything in your home that has been modified more recently than “~joeuser/lastbatch.txt “:

find $HOME -newer ~joeuser/lastbatch.txt

 

-size

Locates files with specified size. -size attribute lets you specify how big the files should be to match. You can specify your size in kilobytes and optionally also use + or – to specify size greater than or less than specified argument. For example:

find /home -name “*.txt” -size 100k
find /home -name “*.txt” -size +100k
find /home -name “*.txt” -size -100k

 

Using Find with OR options

$ find . \( -name a.out -o -name ‘*.o’ -o -name ‘core’ \) -exec rm {} \;

File masks identifying the file types to be removed are located between the parentheses; each file mask is preceded by -name. This list can be extended to include any temporary file types you can come up with that need to be cleaned off the system. In the course of compiling and linking code, programmers and their tools generate file types like those shown in the example: a.out, *.o, and core. Other users have similar commonly generated temporary files and can edit the command accordingly, using file masks like *.tmp, *.junk, and so on. You might also find it useful to put the command into a script called clean, which you can execute whenever you need to clean a directory.

 

$ find $LOGDIR -type d -mtime +0 -exec compress -r {} \;

$ find $LOGDIR -type d -mtime +5 -exec rm -f {} \;

The first command runs all the directories (-type d) found in the $LOGDIR directory wherein a file’s data has been modified within the last 24 hours (-mtime +0) and compresses them (compress -r {}) to save disk space. The second command deletes them (rm -f {}) if they are more than a work-week old (-mtime +5), to increase the free space on the disk.

 

To list all zero-length files, use this command:

find . -empty -exec ls {} \;

FIND Logical Expressions

To negate a condition (logical NOT) . NOT should be specified with a backslash before exclamation point ( \! ). For example

find . \! -name “*.gz” -exec gzip {} \;

\( expression \)  —  “escaped parentheses” to specify any composite condition. For example

find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} \;

If you wanted to find a list of files that have been modified in the last 24 hours and which has a permission of 777, you would execute the following command:

find . -perm 777  -mtime 0 -print
Which is the same as:
find . -perm 777 -a -mtime 0 -a -print

 

Link of Checking Age of Files with FIND command

http://www.softpanorama.org/Tools/Find/selecting_files_by_age.shtml

 

Touch Command

Touch command change only mtime. For example if you need to change the date to Jun 21, 2008 9AM to example.txt, then you can go (-t parameter in touch has format [[CC]YY]MMDDhhmm[.SS]):

    touch -t 200907210900 example.txt

 

To list files in /u/bill that were last read from 2 to 6 minutes ago:
     

    find /u/bill -amin +2 -amin -6

 

Comparing TimeStamps

There are two ways to list files in /usr modified after February 1 of the current year. One uses ‘-newermt’:

     find /usr -newermt “Feb 1”

The other way of doing this works on the versions of find before 4.3.3:

     touch -t 02010000 /tmp/stamp$$
     find /usr -newer /tmp/stamp$$
     rm -f /tmp/stamp$$

 

Using -exec and XARGS with FIND

The find command is commonly used to remove core files that are more than a few 24-hour periods (days) old. These core files are copies of the actual memory image of a running program when the program dies unexpectedly. They can be huge, so occasionally trimming them is wise:

find . -name core -ctime +4 -exec /bin/rm -f {} \;

 

For example often one needs to find files containing a specific pattern in multiple directories one can use an exec option in find (please note that you should use the -l flag for grep so that grep specifies the matched filenames):

find . -type f -exec grep -li ‘/bin/ksh’ {} \;

Find how many directories are in a path (counts current directory)
# find . -type d -exec basename {} \; wc -l

Find how many files are in a path
# find . -type f -exec basename {} \; wc -l

Find files that were modified less than 7 days ago and archive
# find . -type f -mtime -7 xargs tar -cvf `date ‘+%d%m%Y’_archive.tar`

More examples on this link

 

FIND EXAMPLES

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: