17.1 The find Command Is Great; The Problem Is Finding How to Use It

find is one of UNIX's most useful and important utilities. It finds files that match a given set of parameters, ranging from the file's name to its modification date. In this chapter, we'll be looking at many of the things it can do. As an introduction, here's a quick summary of its features and operators:

% find path operators

where path is the directory in which find will begin to search and operators (or, in more customary jargon, options) tell find which files you're interested in. The operators are:

-name filename

Find files with the given filename. This is the most commonly used operator. filename may include wildcards (15.2), but if it does, it must be quoted to prevent the shell from interpreting the wildcards. See article 17.4.

-perm mode

Find files with the given access mode (22.2). You must give the access mode in octal (1.23). See articles 17.10 and 17.15.

-type c

The files of the given type, specified by c. c is a one-digit code; for example, f for a plain file, b for a block special file, l for a symbolic link, etc. See article 17.13.

-user name

Find files belonging to user name. name may also be a user ID number (38.3). See article 17.16.

-group name

Find files belonging to group name. name may also be a group ID number (38.3). See article 17.16.

-size n

Find files that are n blocks long. A block equals 512 bytes. The notation +n says "find files that are over n blocks long." The notation nc says "find files that are n characters long." Can you guess what +nc means? See article 17.14.

-inum n

Find files with the inode number (1.22) n. See article 17.10.

-atime n

Find files that were accessed n days ago. +n means "find files that were accessed over n days ago" (i.e., not accessed in the last n days). -n means "find files that were accessed less than n days ago" (i.e., accessed in the last n days). See articles 17.5 and 17.7.

-mtime n

Similar to atime, except that it checks the time the file's contents were modified. See articles 17.5 and 17.7.

-ctime n

Similar to atime, except that it checks the time the inode (1.22) was last changed. "Changed" means that the file was modified or that one of its attributes (for example, its owner) was changed. See articles 17.5 and 17.7.

-newer file

Find files that have been modified more recently than the given file. See articles 17.8 and 17.9.

Of course, you often want to take some action on files that match several criteria. So we need some way to combine several operators:

operator1 -a operator2

Find files that match both operator1 and operator2. The -a isn't necessary; when two search parameters are juxtaposed, find assumes you want files that match both of them. See article 17.12.

operator1 -o operator2

Find files that match either operator1 or operator2. See article 17.6.

! operator

Find all files that do not match the given operator. The ! performs a logical NOT operation. See article 17.6.

\( expression \)

Logical precedence; in a complex expression, evaluate this part of the expression before the rest. See article 17.6.

Another group of operators tells find what action to take when it locates a file:

-print

Print the file's name on standard output. See articles 17.2 and 17.3.

-exec command

Execute command. To include the pathname of the file that's just been found in command, use the special symbol {}. command must end with a backslash followed by a semicolon (\;). For example:

% find -name "*.o" -exec rm -f {} \;

tells find to delete any files whose names end in .o. See article 17.10.

-ok command

Same as -exec, except that find prompts you for permission before executing command. This is a useful way to test find commands. See article 17.10.

A last word: find is one of the tools that vendors frequently fiddle with, adding (or deleting) a few operators that they like (or dislike). The operators listed above should be valid on virtually any system. If you check your system's manual page, you may find a few others.