| find | |
| Author: | Dick Haight |
| Developer: | AT&T Bell Laboratories |
| Operating System: | Unix, Unix-like, Plan 9, IBM i |
| Platform: | Cross-platform |
| Genre: | Command |
In Unix-like operating systems, '''find''' is a command-line utility that locates files based on some user-specified criteria and either prints the pathname of each matched object or, if another action is requested, performs that action on each matched object.
It initiates a search from a desired starting location and then recursively traverses the nodes (directories) of a hierarchical structure (typically a tree). find can traverse and search through different file systems of partitions belonging to one or more storage devices mounted under the starting directory.[1]
The possible search criteria include a pattern to match against the filename or a time range to match against the modification time or access time of the file. By default, find returns a list of all files below the current working directory, although users can limit the search to any desired maximum number of levels under the starting directory.
The related [[locate (Unix)|locate]] programs use a database of indexed files obtained through find (updated at regular intervals, typically by [[cron]] job) to provide a faster method of searching the entire file system for files by name.
find appeared in Version 5 Unix as part of the Programmer's Workbench project, and was written by Dick Haight alongside cpio,[2] which were designed to be used together.[3]
The GNU find implementation was originally written by Eric Decker. It was later enhanced by David MacKenzie, Jay Plett, and Tim Wood.[4]
The command has also been ported to the IBM i operating system.[5]
find command should treat symbolic links. The default behaviour is never to follow symbolic links. The flag will cause the find command to follow symbolic links. The flag will only follow symbolic links while processing the command line arguments. These flags are specified in the POSIX standard for find. A common extension is the flag, for explicitly disabling symlink following.
At least one path must precede the expression. find is capable of interpreting wildcards internally and commands must be quoted carefully in order to control shell globbing.
Expression elements are separated by the command-line argument boundary, usually represented as whitespace in shell syntax. They are evaluated from left to right. They can contain logical elements such as AND (or) and OR (or) as well as predicates (filters and actions).
GNU find has a large number of additional features not specified by POSIX.
Commonly-used primaries include:
-name ''pattern'': tests whether the file name matches the shell-glob pattern given.-type ''type'': tests whether the file is a given type. Unix file types accepted include:b: block device (buffered);c: character device (unbuffered);d: directory;f: regular file;l: symbolic link;p: named pipe;s: socket;D: door.-print: always returns true; prints the name of the current file plus a newline to the stdout.-print0: always returns true; prints the name of the current file plus a null character to the stdout. Not required by POSIX.-exec ''program'' ''[arguments...]'' ;: runs program with the given arguments, and returns true if its exit status was 0, false otherwise. If program, or an argument is , it will be replace by the current path (if program is , find will try to run the current path as an executable). POSIX doesn't specify what should happen if multiple are specified. Most implementations will replace all with the current path, but that is not standard behavior.-exec ''program'' ''[arguments...]'' {} +: always returns true; run program with the given arguments, followed by as many paths as possible (multiple commands will be run if the maximum command-line size is exceeded, like for xargs).-ok ''program'' ''[arguments...]'' ;: for every path, prompts the user for confirmation; if the user confirms (typically by entering y or yes), it behaves like -exec ''program [arguments...]'' ;, otherwise the command is not run for the current path, and false is returned.If the expression uses none of -print0, -print, -exec, or -ok, find defaults to performing -print if the conditions test as true.
Operators can be used to enhance the expressions of the find command. Operators are listed in order of decreasing precedence:
(expr): forces precedence;! expr: true if expr is false;expr1 expr2 (or expr1 -a expr2: AND. is not evaluated if is false;expr1 -o expr2: OR. expr2 is not evaluated if is true.! so that it's not interpreted by the shell as the history substitution character.
Real-world file systems often contain looped structures created through the use of hard or soft links. The POSIX standard requires that
The previous examples created listings of results because, by default, find executes the -print action. (Note that early versions of the find command had no default action at all; therefore the resulting list of files would be discarded, to the bewilderment of users.)
find. More complex filenames including characters special to the shell may need to be enclosed in single quotes.
-prune action, for a regular file whose name is myfile.
If you're doing this as a user other than root, you might want to ignore permission denied (and any other) errors. Since errors are printed to stderr, they can be suppressed by redirecting the output to /dev/null. The following example shows how to do this in the bash shell:
If you are a csh or tcsh user, you cannot redirect stderr without redirecting stdout as well. You can use sh to run the find command to get around this:
-ls operator prints extended information, and the example finds any regular file whose name ends with either 'jsp' or 'java'. Note that the parentheses are required. In many shells the parentheses must be escaped with a backslash (\( and \)) to prevent them from being interpreted as special shell characters. The -ls operator is not available on all versions of find.
-exec [[chmod]] 644 {} \; in the command. For every regular file whose name ends in .mp3, the command chmod 644 {} is executed replacing {} with the name of the file. The semicolon (backslashed to avoid the shell interpreting it as a command separator) indicates the end of the command. Permission 644, usually shown as rw-r--r--, gives the file owner full permission to read and write the file, while other users have read-only access. In some shells, the {} must be quoted. The trailing "" is customarily quoted with a leading "", but could just as effectively be enclosed in single quotes.
Note that the command itself should not be quoted; otherwise you get error messages likefind is trying to run a file called '' and failing.
If you will be executing over many results, it is more efficient to use a variant of the exec primary that collects filenames up to and then executes COMMAND with a list of filenames.
The -delete action is a GNU extension, and using it turns on -depth. So, if you are testing a find command with -print instead of -delete in order to figure out what will happen before going for it, you need to use -depth -print.
Delete empty files and print the names (note that -empty is a vendor unique extension from GNU find that may not be available in all find implementations):
Delete empty regular files:
Delete empty directories:
Delete empty files named 'bad':
Warning. — The -delete action should be used with conditions such as -empty or -name:
This command will search all files from the /tmp directory tree for a string:[[/dev/null]] argument is used to show the name of the file before the text that is found. Without it, only the text found is printed. (Alternatively, some versions of grep support a flag that forces the file name to be printed.)GNU grep can be used on its own to perform this task:
Example of search for "LOG" in jsmith's home directory tree:
Example of search for the string "ERROR" in all XML files in the current working directory tree:
Note that -iname is not in the standard and may not be supported by all implementations.
If the -iname switch is not supported on your system then workaround techniques may be possible such as:
Searching files whose size is between 100 kilobytes and 500 kilobytes:
Searching empty files:
Searching non-empty files:
Date ranges can be used to, for example, list files changed since a backup.
Files modified a relative number of days ago:
-daystart to measure time from the beginning of a day (0 o'clock) rather than the last 24 hours.Example to find all text files in the document folder modified since a week (meaning 7 days):
Files modified before or after an absolute date and time:
-newermt YYYY-MM-DD: Last modified after date-not -newermt YYYY-MM-DD: Last modified before dateExample to find all text files last edited in February 2017:
-newer [file]More recently modified than specified file.
-cnewer: Same with inode change time.-anewer: Same with access time.-not for inverse results or range.List all text files edited more recently than "document.txt":
[[locate (Unix)|locate]] is a Unix search tool that searches a prebuilt database of files instead of directory trees of a file system. This is faster than find but less accurate because the database may not be up-to-date.[[grep]] is a command-line utility for searching plain-text data sets for lines matching a regular expression and by default reporting matching lines on standard output.[[tree (command)|tree]] is a command-line utility that recursively lists files found in a directory tree, indenting the filenames according to their position in the file hierarchy.find and [[xargs]].find.[[dir (command)|dir]] has the /s option that recursively searches for files or directories.findfindfind