做为DBA日常巡检工作，是必不可少的，FIND命令是常用的，下面简单说说
find path -option [ -print ] [ -exec -ok command ] {} \;
#-print 将查找到的文件输出到标准输出
#-exec command {} \; -----将查到的文件执行command操作,{} 和 \;之间有空格
#-ok 和-exec相同，只不过在操作前要询用户
====================================================
-name filename #查找名为filename的文件
-perm #按执行权限来查找
-user username #按文件属主来查找
-group groupname #按组来查找
-mtime -n +n #按文件更改时间来查找文件，-n指n天以内，+n指n天以前
-atime -n +n #按文件访问时间来查GIN: 0px">-perm #按执行权限来查找
-user username #按文件属主来查找
-group groupname #按组来查找
-mtime -n +n #按文件更改时间来查找文件，-n指n天以内，+n指n天以前
-atime -n +n #按文件访问时间来查找文件，-n指n天以内，+n指n天以前
-ctime -n +n #按文件创建时间来查找文件，-n指n天以内，+n指n天以前
-nogroup #查无有效属组的文件，即文件的属组在/etc/groups中不存在
-nouser #查无有效属主的文件，即文件的属主在/etc/passwd中不存
-newer f1 !f2 找文件，-n指n天以内，+n指n天以前
-ctime -n +n #按文件创建时间来查找文件，-n指n天以内，+n指n天以前
-nogroup #查无有效属组的文件，即文件的属组在/etc/groups中不存在
-nouser #查无有效属主的文件，即文件的属主在/etc/passwd中不存
-newer f1 !f2 #查更改时间比f1新但比f2旧的文件
-type b/d/c/p/l/f #查是块设备、目录、字符设备、管道、符号链接、普通文件
-size n[c] #查长度为n块[或n字节]的文件
-depth #使查找在进入子目录前先行查找完本目录
-fstype #查更改时间比f1新但比f2旧的文件
-type b/d/c/p/l/f #查是块设备、目录、字符设备、管道、符号链接、普通文件
-size n[c] #查长度为n块[或n字节]的文件
-depth #使查找在进入子目录前先行查找完本目录
-fstype #查位于某一类型文件系统中的文件，这些文件系统类型通常可 在/etc/fstab中找到
-mount #查文件时不跨越文件系统mount点
-follow #如果遇到符号链接文件，就跟踪链接所指的文件
-cpio %; #查位于某一类型文件系统中的文件，这些文件系统类型通常可 在/etc/fstab中找到
-mount #查文件时不跨越文件系统mount点
-follow #如果遇到符号链接文件，就跟踪链接所指的文件
-cpio #对匹配的文件使用cpio命令，将他们备份到磁带设备中
-prune #忽略某个目录
====================================================
$find ~ -name "*.txt" -print #在$HOME中查.txt文件并显示
$find . -name "*.txt" -print
$find . -name "[A-Z]*" -pri26nbsp; #对匹配的文件使用cpio命令，将他们备份到磁带设备中
-prune #忽略某个目录
=====================================================
$find ~ -name "*.txt" -print #在$HOME中查.txt文件并显示
$find . -name "*.txt" -print
$find . -name "[A-Z]*" -print #查以大写字母开头的文件
$find /etc -name "host*" -print #查以host开头的文件
$find . -name "[a-z][a-z][0--9][0--9].txt" -print #查以两个小写字母和两个数字开头的txt文件
$find . -perm 755 -print
$find . -perm -007 -exec ls -l {} \; #查所有用户都可读写执行的文件同-perm 777
$find . -type d -print
$find . ! -type d -print
$find . -type l -print
$find . -size +1000000c -print #查长度大于1Mb的文件
$find . -size 100c -print # 查长度为100c的文件
$find . -size +10 -print #查长度超过期作废10块的文件（1块=512字节）
$cd /
$find etc home apps -depth -print | cpio -ivcdC65536 -o /dev/rmt0
$find /etc -name "passwd*" -exec grep "cnscn" {} \; #看是否存在cnscn用户
$find . -name "yao*" | xargs file
$find . -name "yao*" | xargs echo "" > /tmp/core.log
$find . -name "yao*" | xargs chmod o-w
======================================================
find -name april* 在当前目录下查找以april开始的文件
find -name april* fprint file 在当前目录下查找以april开始的文件，并把结果输出到file中
find -name ap* -o -name may* 查找以ap或may开头的文件
find /mnt -name tom.txt -ftype vfat 在/mnt下查找名称为tom.txt且文件系统类型为vfat的文件
find /mnt -name t.txt ! -ftype vfat 在/mnt下查找名称为tom.txt且文件系统类型不为vfat的文件
find /tmp -name wa* -type l 在/tmp下查找名为wa开头且类型为符号链接的文件
find /home -mtime -2 在/home下查最近两天内改动过的文件
find /home -atime -1 查1天之内被存取过的文件
find /home -mmin +60 在/home下查60分钟前改动过的文件
find /home -amin +30 查最近30分钟前被存取过的文件
find /home -newer tmp.txt 在/home下查更新时间比tmp.txt近的文件或目录
find /home -anewer tmp.txt 在/home下查存取时间比tmp.txt近的文件或目录
find /home -used -2 列出文件或目录被改动过之后，在2日内被存取过的文件或目录
find /home -user cnscn 列出/home目录内属于用户cnscn的文件或目录
find /home -uid +501 列出/home目录内用户的识别码大于501的文件或目录
find /home -group cnscn 列出/home内组为cnscn的文件或目录
find /home -gid 501 列出/home内组id为501的文件或目录
find /home -nouser 列出/home内不属于本地用户的文件或目录
find /home -nogroup 列出/home内不属于本地组的文件或目录
find /home -name tmp.txt -maxdepth 4 列出/home内的tmp.txt 查时深度最多为3层
find /home -name tmp.txt -mindepth 3 从第2层开始查
find /home -empty 查找大小为0的文件或空目录
find /home -size +512k 查大于512k的文件
find /home -size -512k 查小于512k的文件
find /home -links +2 查硬连接数大于2的文件或目录
find /home -perm 0700 查权限为700的文件或目录
find /tmp -name tmp.txt -exec cat {} \;
find /tmp -name tmp.txt -ok rm {} \;
find / -amin -10 # 查找在系统中最后10分钟访问的文件
find / -atime -2 # 查找在系统中最后48小时访问的文件
find / -empty # 查找在系统中为空的文件或者文件夹
find / -group cat # 查找在系统中属于 groupcat的文件
find / -mmin -5 # 查找在系统中最后5分钟里修改过的文件
find / -mtime -1 #查找在系统中最后24小时里修改过的文件
find / -nouser #查找在系统中属于作废用户的文件
find / -user fred #查找在系统中属于FRED这个用户的文件
查当前目录下的所有普通文件
--------------------------------------------------------------------------------
# find . -type f -exec ls -l {} \;
-rw-r--r-- 1 root root 34928 2003-02-25 ./conf/httpd.conf
-rw-r--r-- 1 root root 12959 2003-02-25 ./conf/magic
-rw-r--r-- 1 root root 180 2003-02-25 ./conf.d/README
查当前目录下的所有普通文件，并在- e x e c选项中使用ls -l命令将它们列出
=================================================
在/ l o g s目录中查找更改时间在5日以前的文件并删除它们：
$ find logs -type f -mtime +5 -exec -ok rm {} \;
=================================================
查询当天修改过的文件
[root@book class]# find ./ -mtime -1 -type f -exec ls -l {} \;
=================================================
查询文件并询问是否要显示
[root@book class]# find ./ -mtime -1 -type f -ok ls -l {} \;
< ls ... ./classDB.inc.php > ? y
-rw-r--r-- 1 cnscn cnscn 13709 1月 12 12:22 ./classDB.inc.php
[root@book class]# find ./ -mtime -1 -type f -ok ls -l {} \;
< ls ... ./classDB.inc.php > ? n
[root@book class]#
=================================================
查询并交给awk去处理
[root@book class]# who | awk ‘{print $1"\t"$2}‘
cnscn pts/0
=================================================
awk---grep---sed
[root@book class]# df -k | awk ‘{print $1}‘ | grep -v ‘none‘ | sed s"/\/dev\///g"
文件系统
sda2
sda1
[root@book class]# df -k | awk ‘{print $1}‘ | grep -v ‘none‘
文件系统
/dev/sda2
/dev/sda1
1)在/tmp中查找所有的*.h，并在这些文件中查找“SYSCALL_VECTOR"，最后打印出所有包含"SYSCALL_VECTOR"的文件名
A) find /tmp -name "*.h" | xargs -n50 grep SYSCALL_VECTOR
B) grep SYSCALL_VECTOR /tmp/*.h | cut -d‘:‘ -f1| uniq > filename
C) find /tmp -name "*.h" -exec grep "SYSCALL_VECTOR" {} \; -print
2)find / -name filename -exec rm -rf {} \;
find / -name filename -ok rm -rf {} \;
3)比如要查找磁盘中大于3M的文件：
find . -size +3000k -exec ls -ld {} ;
4)将find出来的东西拷到另一个地方
find *.c -exec cp ‘{}‘ /tmp ‘;‘
如果有特殊文件，可以用cpio，也可以用这样的语法：
find dir -name filename -print | cpio -pdv newdir
6)查找2004-11-30 16:36:37时更改过的文件
# A=`find ./ -name "*php"` | ls -l --full-time $A 2>/dev/null | grep "2004-11-30 16:36:37"
Apart from the basic operation of looking for files under a directory structure, you can also perform several practical operations using find command that will make your command line journey easy.
Find命令除了在目录结构中查找文件之外，还可以用来做一些其他比较有实际意义的操作。
In this article, let us review 15 practical examples of Linux find command that will be very useful to both newbies and experts.
本文中的15条tips，对老鸟和菜鸟都会很有帮助
First, create the following sample empty files under your home directory to try some of the find command examples mentioned below.
首先在你的HOME目录下建立一些空的文件，并尝试下面的一些命令。
# vim create_sample_files.sh //使用vi创建文件，并输入下面的内容
touch MybashProgram.sh
touch mycprogram.c
touch MyCProgram.c
touch Program.c
mkdir backup
cd backup
touch MybashProgram.sh
touch mycprogram.c
touch MyCProgram.c
touch Program.c
# chmod +x create_sample_files.sh //添加可运行属性
# ./create_sample_files.sh //运行脚本
# ls -R //查看执行的结果
.:
backup MybashProgram.sh MyCProgram.c
create_sample_files.sh mycprogram.c Program.c
./backup:
MybashProgram.sh mycprogram.c MyCProgram.c Program.c
This is a basic usage of the find command. This example finds all files with name — MyCProgram.c in the current directory and all it’s sub-directories.
这个是Find命令最基本的操作，下面的例子是在当前目录和它所有子目录中查找MyCProgramm.c
# find -name "MyCProgram.c"
./backup/MyCProgram.c
./MyCProgram.c
This is a basic usage of the find command. This example finds all files with name — MyCProgram.c (ignoring the case) in the current directory and all it’s sub-directories.
这也是Find命令的基本操作之一.下面的例子是在当前目录及所有子目录中查找MyCProgram.c(忽略大小写)
# find -iname "MyCProgram.c"
./mycprogram.c
./backup/mycprogram.c
./backup/MyCProgram.c
./MyCProgram.c
查找指定目录并且设置查找的目录深度
Find the passwd file under all sub-directories starting from root directory.
下面的例子是在根目录及所有子目录中查找passwd文件
# find / -name passwd
./usr/share/doc/nss_ldap-253/pam.d/passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd
Find the passwd file under root and one level down. (i.e root — level 1, and one sub-directory — level 2)
查找根目录和根目录的和只展开一级的子目录中查找
# find -maxdepth 2 -name passwd
./etc/passwd
Find the passwd file under root and two levels down. (i.e root — level 1, and two sub-directories — level 2 and 3 )
在根目录和根目录下展开两级查找passwd文件
# find / -maxdepth 3 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd
Find the password file between sub-directory level 2 and 4.
在根目录的第二级和第四级之间查找
# find -mindepth 3 -maxdepth 5 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd
查找到文件后，执行其他的命令
In the example below, the find command calculates the md5sum of all the files with the name MyCProgram.c (ignoring case). {} is replaced by the current file name.
下面的例子展示了在查找到文件后，计算文件的MD5值
# find -iname "MyCProgram.c" -exec md5sum {} /;
d41d8cd98f00b204e9800998ecf8427e ./mycprogram.c
d41d8cd98f00b204e9800998ecf8427e ./backup/mycprogram.c
d41d8cd98f00b204e9800998ecf8427e ./backup/MyCProgram.c
d41d8cd98f00b204e9800998ecf8427e ./MyCProgram.c
Shows the files or directories whose name are not MyCProgram.c .Since the maxdepth is 1, this will look only under current directory.
查找文件名不是MyCProgramm.c的文件，注意由于maxdepth是1,将只在当前目录中查找。
# find -maxdepth 1 -not -iname "MyCProgram.c"
.
./MybashProgram.sh
./create_sample_files.sh
./backup
./Program.c
Every file has an unique inode number, using that we can identify that file. Create two files with similar name. i.e one file with a space at the end.
某些时候，有些文件的文件名非常相似，肉眼比较难以分辨，这时候可以根据他们唯一的inode number进行查找
# touch "test-file-name"
# touch "test-file-name " //这个文件名最后有一个空格
[Note: There is a space at the end]
# ls -1 test*
test-file-name
test-file-name
From the ls output, you cannot identify which file has the space at the end. Using option -i, you can view the inode number of the file, which will be different for these two files.
使用ls命令查看的时候，我们不能分辨这两个文件，使用ls命令的选项-i则可以查看他们的inode number
# ls -i1 test*
16187429 test-file-name
16187430 test-file-name
You can specify inode number on a find command as shown below. In this example, find command renames a file using the inode number.
在使用find命令的时候可以指定inode number
# find -inum 16187430 -exec mv {} new-test-file-name /;
# ls -i1 *test*
16187430 new-test-file-name
16187429 test-file-name
You can use this technique when you want to do some operation with the files which are named poorly as shown in the example below. For example, the file with name — file?.txt has a special character in it. If you try to execute “rm file?.txt”, all the following three files will get removed. So, follow the steps below to delete only the “file?.txt” file.
这个技巧还可以适用于当文件名中存在特殊字符的情况
# ls
file1.txt file2.txt file?.txt
Find the inode numbers of each file.
# ls -i1
804178 file1.txt
804179 file2.txt
804180 file?.txt
Use the inode number to remove the file that had special character in it as shown below.
使用inodenumber删除包含特殊字符的文件
# find -inum 804180 -exec rm {} /;
# ls
file1.txt file2.txt
[Note: The file with name "file?.txt" is now removed]
根据文件的权限查找
Following operations are possible.
可以进行以下的这几种操作
· Find files that match exact permission
· Check whether the given permission matches, irrespective of other permission bits
· Search by giving octal / symbolic representation
For this example, let us assume that the directory contains the following files. Please note that the file-permissions on these files are different.
# ls -l
total 0
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
---------- 1 root root 0 2009-02-19 20:31 no_for_all
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r----- 1 root root 0 2009-02-19 20:27 others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27 others_can_only_read
Find files which has read permission to group. Use the following command to find all files that are readable by the world in your home directory, irrespective of other permissions for that file.
# find . -perm -g=r -type f -exec ls -l {} /;
-rw-r--r-- 1 root root 0 2009-02-19 20:30 ./everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 ./all_for_all
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read
-rw-r----- 1 root root 0 2009-02-19 20:27 ./others_can_also_read
Find files which has read permission only to group.
# find . -perm g=r -type f -exec ls -l {} /;
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read
Find files which has read permission only to group [ search by octal ]
# find . -perm 040 -type f -exec ls -l {} /;
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read
Most files of the following command output will be lock-files and place holders created by other applications.
# find ~ -empty
List all the empty files only in your home directory.
# find . -maxdepth 1 -empty
List only the non-hidden empty files only in the current directory.
# find . -maxdepth 1 -empty -not -name ".*"
The following command will display the top 5 largest file in the current directory and it’s subdirectory. This may take a while to execute depending on the total number of files the command has to process.
# find . -type f -exec ls -s {} /; | sort -n -r | head -5
Technique is same as finding the bigger files, but the only difference the sort is ascending order.
# find . -type f -exec ls -s {} /; | sort -n | head -5
In the above command, most probably you will get to see only the ZERO byte files ( empty files ). So, you can use the following command to list the smaller files other than the ZERO byte files.
# find . -not -empty -type f -exec ls -s {} /; | sort -n | head -5
Find only the socket files.
# find . -type s
Find all directories
# find . -type d
Find only the normal files
# find . -type f
Find all the hidden files
# find . -type f -name ".*"
Find all the hidden directories
# find -type d -name ".*"
Show files which are modified after the specified file. The following find command displays all the files that are created/modified after ordinary_file.
# ls -lrt
total 0
-rw-r----- 1 root root 0 2009-02-19 20:27 others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27 others_can_only_read
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
---------- 1 root root 0 2009-02-19 20:31 no_for_all
# find -newer ordinary_file
.
./everybody_read
./all_for_all
./no_for_all
Using the -size option you can find files by size.
Find files bigger than the given size
# find ~ -size +100M
Find files smaller than the given size
# find ~ -size -100M
Find files that matches the exact given size
# find ~ -size 100M
Note: – means less than the give size, + means more than the given size, and no symbol means exact given size.
If you find some thing as pretty useful, then you can make it as an alias. And execute it whenever you want.
Remove the files named a.out frequently.
# alias rmao="find . -iname a.out -exec rm {} /;"
# rmao
Remove the core files generated by c program.
# alias rmc="find . -iname core -exec rm {} /;"
# rmc
The following command removes *.zip files that are over 100M.
# find / -type f -name *.zip -size +100M -exec rm -i {} /;"
Remove all *.tar file that are over 100M using the alias rm100m (Remove 100M). Use the similar concepts and create alias like rm1g, rm2g, rm5g to remove file size greater than 1G, 2G and 5G respectively.
# alias rm100m="find / -type f -name *.tar -size +100M -exec rm -i {} /;"
# alias rm1g="find / -type f -name *.tar -size +1G -exec rm -i {} /;"
# alias rm2g="find / -type f -name *.tar -size +2G -exec rm -i {} /;"
# alias rm5g="find / -type f -name *.tar -size +5G -exec rm -i {} /;"
# rm100m
# rm1g
# rm2g
# rm5g
This article was written by SathiyaMoorthy, author of numbertotext Vim plugin, which will replace the numbers with the equivalent text inside Vim. The Geek Stuff welcomes your tips and guest articles.
How do you use find command? What is your favorite find command example? Please leave a comment and let us know. Also, if you would like to know how to use find command under a specific scenario, please let us know your questions in the comments section.
本文出自 “李鹏飞oracle” 博客，请务必保留此出处http://lipengfei666666.blog.51cto.com/6384154/1641491
原文地址：http://lipengfei666666.blog.51cto.com/6384154/1641491
