Linux/find

find

Find file syntax:

find [path] [expression]
# case sensitive
find [path] -name [pattern]
# case insensitive
find [path] -iname [pattern]

find . -iname "test"

man find:

      -mtime n
             File’s data was last modified n*24 hours ago.  See the comments for -atime to  understand  how
             rounding affects the interpretation of file modification times.

Time modifier:

+n     for greater than n,
-n     for less than n,
n      for exactly n.

Find all files modified within the last 'n' days:

find [path] -mtime [+//-][n]

# to find all files modified today:
find /etc -mtime -1

Find all files modified within the last 'n' minutes:

find [path] -mmin [+//-][n]

# to find all files modified within the last hour:
find /etc -mmin -60

Filter (exclude) certain folders:

find . -type d -not -path "./badpath/*" -not "./badpath2/*" -print

Find files between two dates: [1]

find Your_Mail_Dir/ -newermt "2011-01-01" ! -newermt "2011-12-31"

Perform operation on found results

Use -exec, result gets replaced with {} and terminate command with either ; or + and should be escaped or quoted to keep the shell from interpreting it

find . type f -exec ls {} -la \;
find . type f -exec ls {} -la ';'
find . type f -exec ls {} -la ";"

Note: the

find . type f -exec ls {} +

Note: the "{} +" acts similar to xargs, dumping all into one command execution, and it MUST end with the "{} +" format. Not as flexible as the \; option

Remove path from find command output

Use %P with printf:

find . -type d -mtime 14 -printf "%P\n" > deploy.txt

ref: https://serverfault.com/questions/354403/remove-path-from-find-command-output

Indicate directories and files

Print the file type along with the name with -printf "%y %p\n":

$ sudo find . -name 'example.com*' -printf "%y %p\n"
d ./archive/example.com
f ./renewal/example.com.conf
d ./live/example.com

Or:

find . -name 'example.com*' -exec ls -f -d -p {} +

NOTE: just found out you can terminate -exec with a + instead of a \;

find large files

find files larger than 100M:

# RHEL
find / -type f -size +100M -not -path "/proc/*" -not -path "/sys/*" -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'

# Ubuntu
find / -type f -size +100M -not -path "/proc/*" -not -path "/sys/*" -exec ls -lh {} \; | awk '{ print $8 ": " $5 }'

find small files

Find files smaller than 500 bytes:

find ~ -size -500b

Find Executable Files

Files and folders (natural):

find <path> -executable

Files only:

find <path> -executable -type f

Delete files older than n days

Delete files older than 30 days: [2]

find /path/to/files/ -type f -name '*.jpg' -mtime +30 -exec rm {} \;

Files Owned by User

Find by user:

find /var -user vivek

Find by group:

find /home -group ftpusers