Daddy, I found it!, 15 Awesome Linux Find Command Examples (Part2)

by SathiyaMoorthy on June 29, 2009

Find Command Examples on Ubuntu, Debian, Fedora, CentOS, RedHat and AIXA while back we reviewed 15 practical find command examples (Part I). Find command can do lot more than just searching for files based on name.
 
In this article (Part 2), let us discuss 15 advanced examples of find command including — finding files based on the time it is accessed, modified or changed, finding files comparatively, performing operation on found files etc.,
 
Ramesh Natarajan: That is my sweet little daughter in that picture. She was very happy to spot the sea lion in the California Long Beach Aquarium.

Find Files Based on Access / Modification / Change Time

You can find files based on following three file time attribute.

  1. Access time of the file. Access time gets updated when the file accessed.
  2. Modification time of the file. Modification time gets updated when the file content modified.
  3. Change time of the file. Change time gets updated when the inode data changes.

 
In the following examples, the difference between the min option and the time option is the argument.

  • min argument treats its argument as minutes. For example, min 60 = 60 minutes (1 hour).
  • time argument treats its argument as 24 hours. For example, time 2 = 2*24 hours (2 days).
  • While doing the 24 hours calculation, the fractional parts are ignored so 25 hours is taken as 24 hours, and 47 hours is also taken as 24 hours, only 48 hours is taken as 48 hours. To get more clarity refer the -atime section of the find command man page.

Example 1: Find files whose content got updated within last 1 hour

To find the files based up on the content modification time, the option -mmin, and -mtime is used. Following is the definition of mmin and mtime from man page.

  • -mmin n File’s data was last modified n minutes ago.
  • -mtime n File’s data was last modified n*24 hours ago.

 
Following example will find files in the current directory and sub-directories, whose content got updated within last 1 hour (60 minutes)

# find . -mmin -60

 
In the same way, following example finds all the files (under root file system /) that got updated within the last 24 hours (1 day).

# find / -mtime -1

Example 2: Find files which got accessed before 1 hour

To find the files based up on the file access time, the option -amin, and -atime is used. Following is the definition of amin and atime from find man page.

  • -amin n File was last accessed n minutes ago
  • -atime n File was last accessed n*24 hours ago

 
Following example will find files in the current directory and sub-directories, which got accessed within last 1 hour (60 minutes)

# find -amin -60

 
In the same way, following example finds all the files (under root file system /) that got accessed within the last 24 hours (1 day).

# find / -atime -1

Example 3: Find files which got changed exactly before 1 hour

To find the files based up on the file inode change time, the option -cmin, and -ctime is used. Following is the definition of cmin and ctime from find man page.

  • -cmin n File’s status was last changed n minutes ago.
  • -ctime n File’s status was last changed n*24 hours ago.

 
Following example will find files in the current directory and sub-directories, which changed within last 1 hour (60 minutes)

# find . -cmin -60

 
In the same way, following example finds all the files (under root file system /) that got changed within the last 24 hours (1 day).

# find / -ctime -1

Example 4: Restricting the find output only to files. (Display only files as find command results)

The above find command’s will also show the directories because directories gets accessed when the file inside it gets accessed. But if you want only the files to be displayed then give -type f in the find command as
 
The following find command displays files that are accessed in the last 30 minutes.

# find /etc/sysconfig -amin -30
.
./console
./network-scripts
./i18n
./rhn
./rhn/clientCaps.d
./networking
./networking/profiles
./networking/profiles/default
./networking/profiles/default/resolv.conf
./networking/profiles/default/hosts
./networking/devices
./apm-scripts
[Note: The above output contains both files and directories]

# find /etc/sysconfig -amin -30 -type f
./i18n
./networking/profiles/default/resolv.conf
./networking/profiles/default/hosts
[Note: The above output contains only files]

Example 5: Restricting the search only to unhidden files. (Do not display hidden files in find output)

When we don’t want the hidden files to be listed in the find output, we can use the following regex.
The below find displays the files which are modified in the last 15 minutes. And it lists only the unhidden files. i.e hidden files that starts with a . (period) are not displayed in the find output.

# find . -mmin -15 \( ! -regex ".*/\..*" \)

Finding Files Comparatively Using Find Command

Human mind can remember things better by reference such as, i want to find files which i edited after editing the file “test”. You can find files by referring to the other files modification as like the following.

Example 6: Find files which are modified after modification of a particular FILE

Syntax: find -newer FILE

 
Following example displays all the files which are modified after the /etc/passwd files was modified. This is helpful, if you want to track all the activities you’ve done after adding a new user.

# find -newer /etc/passwd

Example 7: Find files which are accessed after modification of a specific FILE

Syntax: find -anewer FILE

 
Following example displays all the files which are accessed after modifying /etc/hosts. If you remember adding an entry to the /etc/hosts and would like to see all the files that you’ve accessed since then, use the following command.

# find -anewer /etc/hosts

Example 8: Find files whose status got changed after the modification of a specific FILE.

Syntax: find -cnewer FILE

 
Following example displays all the files whose status got changed after modifying the /etc/fstab. If you remember adding a mount point in the /etc/fstab and would like to know all the files who status got changed since then, use the following command.

find -cnewer /etc/fstab

Perform Any Operation on Files Found From Find Command

We have looked at many different ways of finding files using find command in this article and also in our previous article. If you are not familiar in finding files in different ways, i strongly recommend you to read the part 1.
 
This section explains about how to do different operation on the files from the find command. i.e how to manipulate the files returned by the find command output.
 
We can specify any operation on the files found from find command.

find <CONDITION to Find files> -exec <OPERATION> \;

 
The OPERATION can be anything such as:

  • rm command to remove the files found by find command.
  • mv command to rename the files found.
  • ls -l command to get details of the find command output files.
  • md5sum on find command output files
  • wc command to count the total number of words on find command output files.
  • Execute any Unix shell command on find command output files.
  • or Execute your own custom shell script / command on find command output files.

Example 9: ls -l in find command output. Long list the files which are edited within the last 1 hour.

# find -mmin -60
./cron
./secure

# find -mmin -60 -exec ls -l {} \;
-rw-------  1 root root 1028 Jun 21 15:01 ./cron
-rw-------  1 root root 831752 Jun 21 15:42 ./secure

Example 10: Searching Only in the Current Filesystem

System administrators would want to search in the root file system, but not in the other mounted partitions. When you have multiple partitions mounted, and if you want to search in /. You can do the following.
 
Following command will search for *.log files starting from /. i.e If you have multiple partitions mounted under / (root), the following command will search all those mounted partitions.

# find / -name "*.log"

 
This will search for the file only in the current file system. Following is the xdev definition from find man page:

  • -xdev Don’t descend directories on other filesystems.

 
Following command will search for *.log files starting from / (root) and only in the current file system. i.e If you have multiple partitions mounted under / (root), the following command will NOT search all those mounted partitions.

# find / -xdev -name "*.log"

Example 11: Using more than one { } in same command

Manual says only one instance of the {} is possible. But you can use more than one {} in the same command as shown below.

# find -name "*.txt" cp {} {}.bkup \;

 
Using this {} in the same command is possible but using it in different command it is not possible, say you want to rename the files as following, which will not give the expected result.

find -name "*.txt" -exec mv {} `basename {} .htm`.html \;

Example 12: Using { } in more than one instance.

You can simulate it by writing a shell script as shown below.

# mv "$1" "`basename "$1" .htm`.html"

 
These double quotes are to handle spaces in file name. And then call that shell script from the find command as shown below.

find -name "*.html" -exec ./mv.sh '{}' \;

So for any reason if you want the same file name to be used more than once then writing the simple shell script and passing the file names as argument is the simplest way to do it.

Example 13: Redirecting errors to /dev/null

Redirecting the errors is not a good practice. An experienced user understands the importance of getting the error printed on terminal and fix it.
 
Particularly in find command redirecting the errors is not a good practice. But if you don’t want to see the errors and would like to redirect it to null do it as shown below.

find -name "*.txt" 2>>/dev/null

 
Sometimes this may be helpful. For example, if you are trying to find all the *.conf file under / (root) from your account, you may get lot of “Permission denied” error message as shown below.

$ find / -name "*.conf"
/sbin/generate-modprobe.conf
find: /tmp/orbit-root: Permission denied
find: /tmp/ssh-gccBMp5019: Permission denied
find: /tmp/keyring-5iqiGo: Permission denied
find: /var/log/httpd: Permission denied
find: /var/log/ppp: Permission denied
/boot/grub/grub.conf
find: /var/log/audit: Permission denied
find: /var/log/squid: Permission denied
find: /var/log/samba: Permission denied
find: /var/cache/alchemist/printconf.rpm/wm: Permission denied
[Note: There are two valid *.conf files burned in the "Permission denied" messages]

 
So, if you want to just view the real output of the find command and not the “Permission denied” error message you can redirect the error message to /dev/null as shown below.

$ find / -name "*.conf" 2>>/dev/null
/sbin/generate-modprobe.conf
/boot/grub/grub.conf
[Note: All the "Permission denied" messages are not displayed]

Example 14: Substitute space with underscore in the file name.

Audio files you download from internet mostly come with the spaces in it. But having space in the file name is not so good for Linux kind of systems. You can use the find and rename command combination as shown below to rename the files, by substituting the space with underscore.
 
The following replaces space in all the *.mp3 files with _

$ find . -type f -iname “*.mp3″ -exec rename “s/ /_/g” {} \;

Example 15: Executing two find commands at the same time

As shown in the examples of the find command in its manual page, the following is the syntax which can be used to execute two commands in single traversal.
 
The following find command example, traverse the filesystem just once, listing setuid files and directories into /root/suid.txt and large files into /root/big.txt.

# find /    \( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \
 \( -size +100M -fprintf /root/big.txt '%-10s %p\n' \)

Our Other 15 Example Series Articles

 
If you need to return, bookmark this page at del.icio.us for handy reference.


Linux Sysadmin Course Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 20 comments… read them below or add one }

1 S.RAGHU June 29, 2009 at 11:00 pm

Thanx for the nice article. multiple find , searching in a single partition are new to me.

2 fuzzycheck January 10, 2010 at 4:38 am

Example 14: Substitute space with underscore in the file name.

Hi,
I sometimes use this command in a bash shell to substitute space with underscore in a whole tree (files and directories)

find . -depth -name ‘* *’ -exec sh -c ‘D=$(dirname “$0″); F=$(basename “$0″); mv “$0″ “$D/${F// /_}”‘ ‘{}’ \;

Regards

3 hardihood07 April 13, 2010 at 11:45 am

This is good stuff. Very informative and easy to implement. Thank you for this.

4 Anwar July 24, 2010 at 2:37 pm

Well Article is really very Help Full..thnx..
your Daughter is so cute..

5 Vimarsh January 6, 2011 at 1:28 pm

sometimes when we run find command, we get permission denied errors on certain files in which find doesn’t lookup for the specified search. what if I do not want find to look in the files in which find is giving ” permission denied” warning”. if possible. please mail me the answer on icon.vimarsh@gmail.com ..

I’ve been searching google for something.. finally was directed to your website.. and it has been a great experience thereafter.. too awesome.. too amazing.. all articles are very very knowledgeable.

6 vignesh February 23, 2011 at 12:06 am

i m newbie for unix, its an excellent article with examples. very nice

7 Utkarsh December 17, 2011 at 1:53 pm

Very Nice…helps alot i believe.. short and sweet…
Have one query related to this.. if i can find the file(s) modified in the say last 10 or 15 minutes, then can i redirect those file to any other SINGLE file and after redirecting, will i be able to Open and Read all such file(s) to pick up any keyword from those that am looking to match upon? Hope to have your help on this as well.. may be you can reply here or at my email id us2n@rediffmail.com

8 Utkarsh December 17, 2011 at 1:57 pm

This process of detecting the file(s) modified in the last 10 or 15 minutes shall go on.and hence the redirecting of the files to a New SIngle file would keep bringing in new files to IT. There are totally 41 files that i have to look out from and once such files are redirected , then i have to Open and Read only the Latet ENtries from such files. Hope this would make the requirement further a bit more clear.

9 Rafal December 27, 2011 at 1:54 am

Vinmarsh: I was looking for something similat (that no warnings should be displayed)
If do not want it, simly add “2>/dev/null” to the end. Example
find / -name ’123′ 2>/dev/null
instead of
find / -name ’123′

cheers
Rafal

10 Vimarsh December 28, 2011 at 1:56 am

Thanks Rafal :)

11 lliseil January 9, 2012 at 10:48 am

I had search for such clear exemples for a loooong time before today.
Thank you very much Vimash for taking time to share your knowledge in such a nice way –especially with a beautiful baby like yours ;-D

12 Jatin February 8, 2012 at 3:54 am

I use the following alias to run find only for c and h file extensions.
alias findch=’find . -name “*.[ch]” | xargs grep ‘

What is the way to extend this to also search for .cc files. Also, how to exclude .svn directories.

13 cristian2006 April 12, 2012 at 1:01 am

About # find -name “*.txt” cp {} {}.bkup \; you don’t ever forgot the -exec command from sintax? i mean , is this the correct solution? or that # find -name “*.txt” -exec cp {} {}.bkup \;

14 sangeeta June 8, 2012 at 11:07 pm

Hi,
This is very good list of commands with very clear example.i liked it very much and it helped me a lot to get clear idea on these commands.
Please update more commands with examples like this.
great job.

Regards,
sangeeta

15 murray August 16, 2012 at 1:02 pm

Excellent article, Vinmarsh, very informative, However, you have an error in Example 12. Your script should be:

mv “$1″ “`basename “$1″ .html`.htm”

I assume that you want to change any file name ending in .html to .htm.

16 Avinash Reddy October 31, 2012 at 3:03 am

Hi Ramesh,
Thanks for all your brilliant work!!
Now , Unix looks easy to me .
The choice of your presentation is awesome.

Thanks

17 Anonymous May 8, 2013 at 7:23 am

How to find the files on specific date

18 Ramesh Oruganti September 10, 2013 at 11:30 pm

it was really a good example, these example helped me alot and easy to understand

19 suryaprathap October 23, 2013 at 5:53 am

Hi great work .thank you very much.
can you please explain \ and ( ) in the find command given below.
# find . -mmin -15 \( ! -regex “.*/\..*” \)

20 SzestKam November 8, 2013 at 7:52 am

great article that I just come in handy. I hope more of – well done

Leave a Comment

Previous post:

Next post: