Andys Unix FAQ

Note: This FAQ assumes you are familar with the concepts and terms outlined in The Unix filesystem explained

Searching for files - find

The find command is used to search for files, it is the primary tool for identifying files within Unix. Whilst the precise options vary between versions all implementations support a plethora of search criteria which include name, size, ownership and permissions. Find also has the powerful facility of executing an arbitary command on the files it finds - via the -exec option.

The basic syntax of the find command is;
    find directory [directory... ] options

Find is a powerful tool and many newcomers have difficulty gettng to grips with it owing to its unusual syntax and long options list. In this simple, but surprising useful example we ask find to locate a file somewhere in or below the current directory whose name starts with the string 'test'
      find . -name 'test*' -ls

The directory here '.' simply means the current directory. The -ls option requests find to produce an 'ls -li' style output for all files matching the search criteria. The option -name 'test*' instructs find to match only those files whose names commence with test - note that this is case sensitive. The argument to -name is a simple regular expression so if you wanted to conduct an case insensitive search you could use;
      find . -name '[Tt][Ee][Ss][Tt]*' -ls
Your version of find may support the -iname option, a somewhat simpler way of achieving the same thing.

Using file size as a search criteria
The option -size takes a single numeric argument, the size in blocks of the files to match. The '+' (plus) and '-' (minus) symbols can be prepended to the number to means 'more than' or 'less than' respectively. In this example find will list all files in the /etc directory which are larger than 100 blocks;
      find /etc -size +100 -print

Using dates & times as search criteria
All find implementations support three options for searching on file timestamps; -atime, -mtime and -ctime. Most often used is -mtime which uses the Modification time of the file. Of occasional of use is -atime , the Access time. Least useful is the mislabelled -ctime option which is NOT as many people think the Creation time but in fact the time the inode was last modified.
See Filesystem - timestamps for a fuller explanation of the three file timestamps.

In this example we use the -size and -atime options together in order to search /export/home for files that are larger than 2000 blocks and have not been accessed for more than 180 days;
      find /export/home -size +2000 -atime +180 -ls

Be aware that the numeric option to all the above time options is a number of days - where a day is 24 hours. Some find implementations support the -amin -mmin & -cmin options which take a number of minutes.

Searching for Strings in files - grep

hh