Red Hat System Administration I

Objectives

After completing this section, students should be able to search for files on mounted file systems using find and locate.

Tools for finding files

A system administrator needs tools for searching files matching certain criteria on the file system. This section discusses two commands that can search files in the file system. The locate command searches a pregenerated database for file names or file paths and returns the results instantly. The find command searches the file system in real time by crawling through the file system.

Locating files by name with locate

The locate command returns search results based on file name or path from the locate database. The database stores file name and path information.

When searching entries as a regular user, results are returned only for where the user invoking the locate search has read permissions on the directory tree that contains the matching element.

Search for files with "passwd" in the name or path in directory trees readable by user student on serverX.

[student@serverX ~]$ locate passwd
/etc/passwd
/etc/passwd-
/etc/pam.d/passwd
/etc/security/opasswd
/usr/bin/gpasswd
/usr/bin/grub2-mkpasswd-pbkdf2
/usr/bin/lppasswd
/usr/bin/passwd
/usr/bin/userpasswd
/usr/bin/vino-passwd
/usr/bin/vncpasswd

Results are returned even when the file name or path is only a partial match to the search query.

[root@serverX ~]# locate image
/home/myuser/boot.image
/home/someuser/my_family_image.png
/home/student/myimages-vacation/picture.png

The -i option performs a case-insensitive search. With this option, all possible combinations of upper- and lowercase letters match the search.

[student@serverX ~]$ locate -i messages
...
/usr/share/vim/vim74/lang/zh_TW/LC_MESSAGES
/usr/share/vim/vim74/lang/zh_TW/LC_MESSAGES/vim.mo
/usr/share/vim/vim74/lang/zh_TW.UTF-8/LC_MESSAGES
/usr/share/vim/vim74/lang/zh_TW.UTF-8/LC_MESSAGES/vim.mo
/usr/share/vim/vim74/syntax/messages.vim
/usr/share/vim/vim74/syntax/msmessages.vim
/var/log/messages

The -n option limits the number of returned search results by locate. The following example limits the search results returned by locate to the first five matches.

[student@serverX ~]$ locate -n 5 snow.png
/usr/share/icons/HighContrast/16x16/status/weather-snow.png
/usr/share/icons/HighContrast/22x22/status/weather-snow.png
/usr/share/icons/HighContrast/24x24/status/weather-snow.png
/usr/share/icons/HighContrast/256x256/status/weather-snow.png
/usr/share/icons/HighContrast/32x32/status/weather-snow.png

[root@serverX ~]# updatedb

Searching for files with find

The find command performs a real-time search in the local file systems to find files that match the criteria of the command-line arguments. The find command is looking at files in the file system as your user account. The user invoking the find command must have read and execute permission on a directory to examine its contents.

The first argument to the find command is the directory to search. If the directory argument is omitted, find will start the search in the current directory and look for matches in any of the subdirectories.

To search the home directory of user student, give find a starting directory of /home/student. To search the entire system, provide a starting directory of /.

The -name option followed by a file name looks up files matching the given file name and returns all exact matches. To search for files named sshd_config in the / directory and all subdirectories on serverX, run:

[root@serverX ~]# find / -name sshd_config
/etc/ssh/sshd_config

Wild cards are available to search for a file name and return all results that are a partial match. When using wild cards, it is important to quote the file name to look for to prevent the terminal from interpreting the wild card.

The following example searches for files in the / directory on serverX that end in .txt:

[root@serverX ~]# find / -name '*.txt'
/etc/pki/nssdb/pkcs11.txt
/etc/brltty/brl-lt-all.txt
/etc/brltty/brl-mb-all.txt
/etc/brltty/brl-md-all.txt
/etc/brltty/brl-mn-all.txt
...

To search for files in /etc/ that contain pass anywhere in their names on serverX, run:

[root@serverX ~]# find /etc -name '*pass*'
/etc/passwd
/etc/passwd-
/etc/fonts/conf.d/60-overpass.conf
/etc/selinux/targeted/modules/active/modules/passenger.pp
/etc/security/opasswd
/etc/pam.d/passwd
/etc/pam.d/password-auth-ac
/etc/pam.d/password-auth
/etc/pam.d/gdm-password

To perform a case-insensitive search for a given file name, use the -iname option, followed by the file name to search. To search case-insensitively for files that have messages in their names in the / directory on serverX, run:

[root@serverX ~]# find / -iname '*messages*'
/var/log/messages
/usr/lib64/python2.7/site-packages/orca/notification_messages.py
/usr/lib64/python2.7/site-packages/orca/notification_messages.pyc
/usr/lib64/python2.7/site-packages/orca/notification_messages.pyo
/usr/share/locale/aa/LC_MESSAGES
/usr/share/locale/ab/LC_MESSAGES
/usr/share/locale/ace/LC_MESSAGES

find can search for files based on their ownership or permissions. Useful options when searching by owner are -user and -group, which search by name, and -uid and -gid, which search by ID.

Search for files owned by the user student in the /home/student directory on serverX.

[student@serverX ~]$ find -user student
.
./.bash_logout
./.bash_profile
./.bashrc
./.ssh
...

Search for files owned by the group student in the /home/student directory on serverX.

[student@serverX ~]$ find -group student
.
./.bash_logout
./.bash_profile
./.bashrc
./.ssh
...

Search for files owned by user ID 1000 in the /home/student directory on serverX.

[student@serverX ~]$ find -uid 1000
.
./.bash_logout
./.bash_profile
./.bashrc
./.ssh
...

Search for files owned by group ID 1000 in the /home/student directory on serverX.

[student@serverX ~]$ find -gid 1000
.
./.bash_logout
./.bash_profile
./.bashrc
./.ssh
...

Search for files owned by user root and group mail on the serverX machine.

[root@serverX ~]# find / -user root -group mail
/var/spool/mail
/var/spool/mail/root

The -perm option is used to look for files with a particular set of permissions. Permissions can be described as octal values, with some combination of 4, 2, and 1 for read, write, and execute. Permissions can be preceded by a / or - sign.

A numeric permission preceded by / will match files that have at least one bit of user, group, or other for that permission set. A file with permissions r--r--r-- does not match /222, but one with rw-r--r-- does. A - sign before a permission means that all three instances of that bit must be on, so neither of the previous examples would match, but something like rw-rw-rw- would.

To use a more complex example, the following command would match any file for which the user has read, write, and execute permissions, members of the group have read and write permissions, and others have read-only access:

[root@serverX ~]# find /home -perm 764

To match files for which the user has at least write and execute permissions, and the group has at least write permissions, and others have at least read access:

[root@serverX ~]# find /home -perm -324

To match files for which the user has read permissions, or the group has at least read permissions, or others have at least write access:

[root@serverX ~]# find /home -perm /442

When used with / or -, a value of 0 works like a wild card, since it means "a permission of at least nothing."

To match any file in the /home/student directory for which others have at least read access on serverX, run:

[student@serverX ~]$ find -perm -004

Find all files in the /home/student directory where other has write permissions on serverX.

[student@serverX ~]$ find -perm -002

The find command can look up files that match a size specified with the -size option, followed by a numerical value and the unit.

Units to be used with the -size option are:

Search for files with a size of exactly 10 megabytes.

[student@serverX ~]$ find -size 10M

Find files with a size more than 10 gigabytes.

[student@serverX ~]$ find -size +10G

List all files with a size less than 10 kilobytes.

[student@serverX ~]$ find -size -10k

The -mmin option, followed by the time in minutes, searches for all files that had their content changed at exactly the given time in the past.

To find all files that had their file content changed exactly 120 minutes ago on serverX, run:

[root@serverX ~]# find / -mmin 120

The + modifier in front of the amount of minutes looks for all files in the / that have been modified more than 200 minutes ago.

[root@serverX ~]# find / -mmin +200

The - modifier changes the search to look for all files in the / directory which have been changed less than 150 minutes ago.

[root@serverX ~]# find / -mmin -150

The -type option limits the search scope to a given file type, such as:

Search for all directories in the /etc folder on serverX.

[root@serverX ~]# find /etc -type d
/etc
/etc/tmpfiles.d
/etc/systemd
/etc/systemd/system
/etc/systemd/system/getty.target.wants
...

Search for all soft links on the serverX system.

[root@serverX ~]# find / -type l

Generate a list of all block devices in the /dev directory on serverX:

[root@serverX ~]# find /dev -type b
/dev/vda1
/dev/vda

The -links option followed by a number looks for all files that have a certain hard link count. The number can be preceded by a + modifier to look for files with a count higher than the given hard link count. If the number is preceded with a - modifier, the search is limited to all files with a hard link count that is less than the given number.

Search for all regular files with more than one hard link on the serverX machine:

[root@serverX ~]# find / -type f -links +1