Published on 2016 - 07 - 19

Even a basic Linux installation can have thousands of files installed on it. To help you find files on your system, you can use commands such as locate (to find commands by name), find (to find files based on lots of different attributes), and grep (to search within text files to find lines in files that contain search text).

Using locate to find files by name

On most Linux systems (Fedora and RHEL included), the updatedb command runs once per day to gather the names of files throughout your Linux system into a database. By running the locate command, you can search that database to find the location of files stored in that database.

Here are a few things you should know about searching for files using the locate command:

  • There are advantages and disadvantages to using locate to find filenames instead of the find command. A locate command finds files faster because it searches a database instead of having to search the whole filesystem live. A disadvantage is that the locate command cannot find any files added to the system since the previous time the database was created. Not every file in your filesystem is stored in the database. The contents of the /etc/updatedb.conf file limit which filenames are collected by pruning out select mount types, filesystem types, file types, and mount points. For example, filenames are not gathered from remotely mounted filesystems (cifs, nfs, and so on) or locally mounted CDs or DVDs (iso9660). Paths containing temporary files (/tmp) and spool files (/var/spool/cups) are also pruned. You can add items to prune (or remove some items that you don't want pruned) the locate database to your needs. In RHEL 7, the updatedb.conf file contains the following:
PRUNEFS = "9p afs anon_inodefs auto autofs bdev binfmt_misc cgroup cifs coda configfs cpuset debugfs devpts ecryptfs exofs fuse fuse.sshfs fusectl gfs gfs2 hugetlbfs inotifyfs iso9660 jffs2 lustre mqueue ncpfs nfs nfs4 nfsd pipefs proc ramfs rootfs rpc_pipefs securityfs selinuxfs sfs sockfs sysfs tmpfs ubifs udf usbfs"
PRUNENAMES = ".git .hg .svn"
PRUNEPATHS = "/afs /media /mnt /net /sfs /tmp /udev /var/cache/ccache /var/lib/yum/yumdb /var/spool/cups /var/spool/squid /var/tmp"
  • As a regular user, you can't see any files from the locate database that you can't see in the filesystem normally. For example, if you can't type ls to view files in the /root directory, you can't locate files stored in that directory.
  • When you search for a string, the string can appear anywhere in a file's path. For example, if you search for passwd, you could turn up /etc/passwd, /usr/bin/passwd, /home/chris/passwd/pwdfiles.txt, and many other files with passwd in the path.
  • If you add files to your system after updatedb runs, you can't locate those files until updatedb runs again (probably that night). To get the database to contain all files up to the current moment, you can simply run updatedb from the shell as root.

Here are some examples of using the locate command to search for files:

$ locate .bashrc
# locate .bashrc

When run as a regular user, locate only finds .bashrc in /etc/skel and the user's own home directory. Run as root, the same command locates .bashrc files in everyone's home directory.

$ locate muttrc
$ locate -i muttrc

Using locate -i, filenames are found regardless of case. In the previous example, Muttrc and Muttrc.local were found with -i whereas they weren't found without that option.

$ locate services

Unlike the find command, which uses the -name option to find filenames, the locate command locates the string you enter if it exists in any part of the file's path. For example, if you search for services using the locate command, you find files and directories that contain the “services” string of text.

Searching for files with find

The find command is the best command for searching your filesystem for files, based on a variety of attributes. After files are found, you can act on those files as well (using the -exec or -okay options) by running any commands you want on them.

When you run find, it searches your filesystem live, which causes it to run slower than locate, but gives you an up-to-the-moment view of the files on your Linux system. However, you can also tell find to start at a particular point in the filesystem, so the search can go faster by limiting the area of the filesystem being searched.

Nearly any file attribute you can think of can be used as a search option. You can search for filenames, ownership, permission, size, modification times, and other attributes. You can even use combinations of attributes. Here are some basic examples of using the find command:

$ find
$ find /etc
# find /etc
$ find $HOME -ls

Run on a line by itself, the find command finds all files and directories below the current directory. If you want to search from a particular point in the directory tree, just add the name of the directory you want to search (such as /etc). If you run find as a regular user, you do not have special permission to find files that are readable only by the root user. So find produces a bunch of error messages. If you run find as the root user, find /etc finds all files under /etc.

A special option to the find command is -ls. A long listing (ownership, permission, size, and so on) is printed with each file when you add -ls to the find command (similar to output of the ls -l command). This option helps you in later examples when you want to verify that you have found files that contain the ownership, size, modification times, or other attributes you are trying to find.

Finding files by name

To find files by name, you can use the -name and -iname options. The search is done by base name of the file; the directory names are not searched by default. To make the search more flexible, you can use file-matching characters, such as asterisks (*) and question marks (?), as in the following examples:

# find /etc -name passwd
# find /etc -iname '*passwd*'

Using the -name option and no asterisks, the first example above lists any files in the /etc directory that are named passwd exactly. By using -iname instead, you can match any combination of upper and lower case. Using asterisks, you can match any filename that includes the word passwd.

Finding files by size

If your disk is filling up and you want to find out where your biggest files are, you can search your system by file size. The -size option enables you to search for files that are exactly, smaller than, or larger than a selected size, as you can see in the following examples:

$ find /usr/share/ -size +10M
$ find /mostlybig -size -1M
$ find /bigdata -size +500M -size -5G -exec du -sh {} \;
4.1G   /bigdata/images/rhel6.img
606M   /bigdata/Fedora-16-i686-Live-Desktop.iso
560M   /bigdata/dance2.avi

The first example in the preceding code finds files larger than 10MB. The second finds files less than 1MB. In the third example, I'm searching for ISO images and video files that are between 500MB and 5GB. This includes an example of the -exec option (which I describe later) to run the du command on each file to see its size.

Finding files by user

You can search for a particular owner (-user) or group (-group) when you try to find files. By using -not and -or, you can refine your search for files associated with specific users and groups, as you can see in the following examples:

$ find /home -user chris -ls
131077    4 -rw-r--r--   1 chris   chris 379 Jun 29  2014 ./.bashrc
# find /home -user chris -or -user joe -ls
131077    4 -rw-r--r--   1 chris   chris 379 Jun 29  2014 ./.bashrc
181022    4 -rw-r--r--   1 joe      joe    379 Jun 15  2014 ./.bashrc
# find /etc -group ntp -ls
131438    4 drwxrwsr-x   3 root     ntp   4096 Mar  9 22:16 /etc/ntp
# find /var/spool -not -user root -ls
262100 0 -rw-rw---- 1 rpc   mail 0 Jan 27 2014 /var/spool/mail/rpc
278504 0 -rw-rw---- 1 joe   mail 0 Apr 3 2014  /var/spool/mail/joe
261230 0 -rw-rw---- 1 bill  mail 0 Dec 18 2014 /var/spool/mail/bill
277373 0 -rw-rw---- 1 chris mail 0 Mar 15 2014 /var/spool/mail/chris

The first example outputs a long listing of all files under the /home directory that are owned by the user chris. The next lists files owned by chris or joe. The find command of /etc turns up all files that have ntp as their primary group assignment. The last example shows all files under /var/spool that are not owned by root. You can see files owned by other users in the sample output.

Finding files by permission

Searching for files by permission is an excellent way to turn up security issues on your system or uncover access issues. Just as you changed permissions on files using numbers or letters (with the chmod command), you can likewise find files based on number or letter permissions along with the -perm options.

If you use numbers for permission, as I do below, remember that the three numbers represent permissions for the user, group, and other. Each of those three numbers varies from no permission (0) to full read/write/execute permission (7), by adding read (4), write (2), and execute (1) bits together. With a hyphen (-) in front of the number, all three of the bits indicated must match; with a plus (+) in front of it, any of the numbers can match for the search to find a file. The full, exact numbers must match if neither a hyphen or plus is used.

Consider the following examples:

$ find /bin -perm 755 -ls
788884 28 -rwxr-xr-x 1 root root 28176 Mar 10 2014 /bin/echo
$ find /home/chris/ -perm -222 -type d -ls
144503 4 drwxrwxrwx 8 chris chris 4096 June 23 2014 /home/chris

By searching for -perm 755, any files or directories with exactly rwxr-xr-x permission are matched. By using -perm -222, only files that have write permission for user, group, and other are matched. Notice that, in this case, the -type d is added to match only directories.

$ find /myreadonly -perm +222 -type f
685035 0 -rw-rw-r-- 1 chris chris 0 Dec 30 2014 /tmp/write/abc
$ find . -perm -002 -type f -ls
266230 0 -rw-rw-rw- 1 chris chris 0 Dec 20 2014 ./LINUX_BIBLE/a

Using -perm +222, you can find any file (-type f) that has write permission turned on for the user, group, or other. You might do that to make sure that all files are read-only in a particular part of the filesystem (in this case, beneath the /myreadonly directory). The last example, -perm -002, is very useful for finding files that have open write permission for “other,” regardless of how the other permission bits are set.

Finding files by date and time

Date and time stamps are stored for each file when it is created, when it is accessed, when its content is modified, or when its metadata is changed. Metadata includes owner, group, time stamp, file size, permissions, and other information stored in the file's inode. You might want to search for file data or metadata changes for any of the following reasons:

  • You just changed the contents of a configuration file, and you can't remember which one. So you search /etc to see what has changed in the past 10 minutes:

    $ find /etc/ -mmin -10
  • You suspect that someone hacked your system three days ago. So you search the system to see if any commands have had their ownership or permissions changed in the past three days:

    $ find /bin /usr/bin /sbin /usr/sbin -ctime -3

    You want to find files in your FTP server (/var/ftp) and web server (/var/www) that have not been accessed in more than 300 days, so you can see if any need to be deleted:

    $ find /var/ftp /var/www -atime +300

As you can glean from the examples, you can search for content or metadata changes over a certain number of days or minutes. The time options (-atime, -ctime, and -mtime) enable you to search based on the number of days since each file was accessed, was changed, or had its metadata changed. The min options (-amin, -cmin, and -mmin) do the same in minutes.

Numbers that you give as arguments to the min and time options are preceded by a hyphen (to indicate a time from the current time to that number of minutes or days ago) or a plus (to indicate time from the number of minutes or days ago and older). With no hyphen or plus, the exact number is matched.

Using ‘not’ and ‘or’ when finding files

With the -not and -or options, you can further refine your searches. There may be times when you want to find files owned by a particular user, but not assigned to a particular group. You may want files larger than a certain size, but smaller than another size. Or you might want to find files owned by any of several users. The -not and -or options can help you do that. Consider the following examples:

  • There is a shared directory called /var/all. This command line enables you to find files that are owned by either joe or chris.

    $ find /var/all \( -user joe -or -user chris \) -ls
    679967 0 -rw-r--r-- 1 chris chris 0    Dec 31 2014 /var/all/cn
    679977 0 -rw-r--r-- 1 joe   joe   4379 Dec 31 2014 /var/all/jj
    679972 0 -rw-r--r-- 1 joe   sales 0    Dec 31 2014 /var/all/js
  • This command line searches for files owned by the user joe, but only those that are not assigned to the group joe:

    $ find /var/all/ -user joe -not -group joe -ls
    679972 0 -rw-r--r-- 1 joe   sales 0    Dec 31 2014 /var/all/js
  • You can also add multiple requirements on your searches. Here, a file must be owned by the user joe and must also be more than 1MB in size:

    $ find /var/all/ -user joe -and -size +1M -ls
    679977 0 -rw-r--r-- 1 joe   joe   4379 Dec 31 2014 /var/all/jj

Finding files and executing commands

One of the most powerful features of the find command is the capability to execute commands on any files you find. With the -exec option, the command you use is executed on every file found, without stopping to ask if that's okay. The -ok option stops at each matched file and asks whether you want to run the command on it.

The advantage of using -ok is that, if you are doing something destructive, you can make sure that you okay each file individually before the command is run on it. The syntax for using -exec and -ok is the same:

$ find [options] -exec command {} \;
$ find [options] -ok command {} \;

With -exec or -ok, you run find with any options you like to find the files you are looking for. Then enter the -exec or -ok option, followed by the command you want to run on each file. The set of curly braces indicates where on the command line to read in each file that is found. Each file can be included in the command line multiple times, if you like. To end the line, you need to add a backslash and semicolon (\;). Here are some examples:

  • This command finds any file named iptables under the /etc directory and includes that name in the output of an echo command:

    $ find /etc -iname iptables -exec echo "I found {}" \;
    I found /etc/bash_completion.d/iptables
    I found /etc/sysconfig/iptables
  • This command finds every file under the /usr/share directory that is more than 5MB in size. Then it lists the size of each file with the du command. The output of find is then sorted by size, from largest to smallest. With -exec entered, all entries found are processed, without prompting:

    $ find /usr/share -size +5M -exec du {} \; | sort -nr
    116932  /usr/share/icons/HighContrast/icon-theme.cache
    69048   /usr/share/icons/gnome/icon-theme.cache
    20564   /usr/share/fonts/cjkuni-uming/uming.ttc
  • The -ok option enables you to choose, one at a time, whether each file found is acted upon by the command you enter. For example, you want to find all files that belong to joe in the /var/allusers directory (and its subdirectories) and move them to the /tmp/joe directory:

    # find /var/allusers/ -user joe -ok mv {} /tmp/joe/ \;
    < mv ... /var/allusers/dict.dat > ? y
    < mv ... /var/allusers/five > ? y

    Notice in the preceding code that you are prompted for each file that is found before it is moved to the /tmp/joe directory. You would simply type y and press Enter at each line to move the file, or just press Enter to skip it.

Searching in files with grep

If you want to search for files that contain a certain search term, you can use the grep command. With grep, you can search a single file or search a whole directory structure of files recursively.

When you search, you can have every line containing the term printed on your screen (standard output) or just list the names of the files that contain the search term. By default, grep searches text in a case-sensitive way, although you can do case-insensitive searches as well.

Instead of just searching files, you can also use grep to search standard output. So, if a command turns out lots of text and you want to find only lines that contain certain text, you can use grep to filter just want you want.

Here are some examples of grep command lines, used to find text strings in one or more files:

$ grep desktop /etc/services
desktop-dna 2763/tcp  # Desktop DNA
desktop-dna 2763/udp  # Desktop DNA
$ grep -i desktop /etc/services
sco-dtmgr   617/tcp   # SCO Desktop Administration Server
sco-dtmgr   617/udp   # SCO Desktop Administration Server
airsync     2175/tcp  # Microsoft Desktop AirSync Protocol

In the first example, a grep for the word desktop in the /etc/services file turned up two lines. Searching again, using the -i to be case-insensitive (as in the second example), there were 29 lines of text produced.

To search for lines that don't contain a selected text string, use the -v option. In the following example, all lines from the /etc/services file are displayed except those containing the text tcp (case-insensitive):

$ grep -vi tcp /etc/services

To do recursive searches, use the -r option and a directory as an argument. The following example includes the -l option, which just lists files that include the search text, without showing the actual lines of text. That search turns up files that contain the text peerdns (case-insensitive).

$ grep -rli peerdns /usr/share/doc/

The next example recursively searches the /etc/sysconfig directory for the term root. It lists every line in every file beneath the directory that contains that text. To make it easier to have the term root stand out on each line, the --color option is added. By default, the matched term appears in red.

$ grep -ri --color root /etc/sysconfig/

To search the output of a command for a term, you can pipe the output to the grep command. In this example, I know that IP addresses are listed on output lines from the ip command that include the string inet. So, I use grep to just display those lines:

$ ip addr show | grep inet
inet scope host lo
inet brd scope global wlan0