Qualifying Your Search with the find Command

75

Qualifying Your Search with the find Command

find gives you a wide variety of qualifiers, and this section delves into the more timesaving ones. For details on using qualifiers with find, see the preceding section.

Doing updated filename searches

Two of the most frequently used qualifiers are -name and -iname, both of which must be followed by a filename pattern:

-name tells find to operate on any files that match the given pattern.

-iname does the same except that it ignores case differences.

You can use the normal shell wildcards with -name and -iname. For example, -name “*.c” matches any filenames that end with .c. If you include wildcards, you must surround the filename pattern with quotes to prevent the shell from expanding them before find gets a chance to see it.

The -name and -iname qualifiers make find very similar to the locate command. locate searches through a database of filenames, whereas find searches through the file system. find gives you more up-to-date results but takes much longer to perform a thorough search.

Adding time-based qualifications

You can also search for files based on time of last access, content-modification time, or attributemodification time. The content-modification time of a file is updated whenever you write to that file. The attribute-modification time of a file is updated whenever you make a change to the file’s attributes (by changing ownership or permissions, for example).

Table 12-1 lists qualifications that select files based on their timestamps.

TABLE 12-1: QUALIFICATIONS THAT SEARCH FOR TIMESTAMPS

Qualification	What It Finds
-atime n	True if the file was last accessed n days ago
-amin n	True if the file was last accessed n minutes
	ago
-ctime n	True if the file’s attributes were last changed
	n days ago
-cmin n	True if the file’s attributes were last changed
	n minutes ago
-mtime n	True if the file’s contents were last changed
	n days ago
-mmin n	True if the file’s contents were last changed
	n minutes ago

To find files in your home directory (and all subdirectories) that were last changed a week ago, use this command:

$ find ~ -mtime 7 -print

If you run this command, you may be surprised by the results. -mtime 7 does not show you all the files modified in the previous seven days; it shows the files modified exactly seven days ago. To locate files modified in the previous seven days (yesterday, or the day before, or the day before that, . . .), specify -mtime -7 (note the minus sign in front of the 7), as follows:

$ find ~ -mtime -7 -print

You can read that command as “find files where the date of last modification is less than seven days ago.” Now suppose you change the command to this:

$ find ~ -mtime +7 -print

76 Technique 12: Finding What You Need

You see a list of files whose dates of last modification are greater than seven days ago. You can find files modified within a range of dates by using both the + and - signs. For example, to find all files modified four or five days ago, use this command:

$ find ~ find . -mtime +3 -mtime -6 -print

Read this command as “modified more than three days ago but less than six days ago.”

You can use the -atime qualifier to find unused (or at least not recently used) user files on your system:

$ find / -atime +90 -print

Filtering by file size

The find command also lets you filter files based on their size. The -size n qualifier selects any files whose size is n.

The + and - tricks that you can use for time qualifications work with -size qualifications, too: -size +n selects all files larger than n, and -size -n selects all files smaller than n. When you use -size n, you can specify n in terms of bytes, kilobytes, or 512-byte blocks:

To specify a byte count, follow -size n with a c.

To specify a number of kilobytes (1024 bytes), follow -size n with the letter k.

The default unit is 512-byte blocks, but you can make your intention explicit with a suffix of b.

As find examines each file, it rounds the file’s size up to the nearest unit (kilobyte or block) and then applies the qualifier. For example, -size 2k selects files between 1025 and 2048 bytes long.

Table 12-2 shows a few examples using the -size qualifier.

TABLE 12-2: EXAMPLES USING THE -SIZE QUALIFIER

Command	Result
-size 2048c	Files exactly 2048 bytes long
-size +2048c	Files 2049 bytes or larger
-size -2048c	Files smaller than 2048 bytes
-size 2k	Files between 1024 and 2048 bytes long
-size +2k	Files larger than 2048 bytes
-size -2k	Files smaller than 1025 bytes
-size +1k	Files larger than 1024 bytes and smaller
-size -3k	than 2049 bytes

The rounding that find performs can be confusing, so we’ve written a short shell function that translates a value like 2M (megabytes) or 3G (gigabytes) into the equivalent number of bytes. Listing 12-1 shows the unit function.

LISTING 12-1: THE UNIT FUNCTION

function unit ()

{

#Extract the last character from

#the first (and only) parameter.

#Given a value like 5M, the suffix

#is the character ‘M’

suffix=${1: -1: 1}

#Remove the suffix from the argument

#and we should be left with number

#units (‘5’ if we were given 5M)

count=${1%%$suffix}

case $suffix in

K|k) echo $(expr $count \* 1024)c;; M|m) echo $(expr $count \* 1048576)c;;

G|g) echo $(expr $count \* 1073741824)c;;

*) echo $1”c” esac;

}

Qualifying Your Search with the find Command

77

Use the unit function to make find behave a bit more predictably. For example, the following command

$ find ~ -size +$(unit 2M) -print

translates into

$ find ~ -size +2097152c -print

Press Esc-E to view the translated command line before you press Enter. (Notice that unit included the c suffix, which forces find to turn off its funky rounding trick.) The unit function translates kilobytes (K or k), megabytes (M or m), and gigabytes (G or g).

Joining qualifications with

AND and OR operators

By joining qualifications, you can get more mileage out of the find command.

To quickly find large files that haven’t been used in a while, combine -size and -atime.

For example, use the following command to search for files 5 megabytes or larger that haven’t been used in the last 30 days:

$find ~ -size +$(unit 5M) -atime +30 -print

TABLE 12-3: COMMONLY USED QUALIFIERS

By default, find joins multiple qualifiers together with the AND operator. Given two qualifiers —

-size +$(unit 5M) and -atime +30 — a file qualifies only if it meets both criteria.

You can also join qualifiers with the OR operator. To find all files that are either empty or haven’t been used in a while (or both), stick an -or between the qualifiers, like this:

$ find ~ -size 0 -or -atime +30 -print

With the -or operator, a file must meet either (or both) of the qualifiers to be selected. You can also use -not to reverse a qualifier (for example,

-not -size 0) and -and to explicitly and qualifiers together. Use quoted parentheses to build complex expressions. For example, the following command finds large files (larger than 5M) that have not been accessed in the previous 30 days and adds empty files to the list as well:

find / “(“ -size +$(unit 5M) -and -atime +30 “)” -or -empty -ls

The -empty qualifier is a synonym for -size 0.

Perusing commonly used qualifications

Table 12-3 shows the most commonly used qualifiers.

Qualifier	Result
-name pattern	Select files that match the given filename pattern.
-iname pattern	Select files that match the given filename pattern, ignoring differences in letter case.
-regex expression	Select files that match the given pathname regular expression (similar to -name except that
	-regex matches the entire path where -name matches only the filename).

-iregex expression

-atime [+|-]n -ctime [+|-]n -mtime [+|-]n

Select files that match the given pathname regular expression, ignoring differences in letter case (similar to -iname except that -iregex matches the entire path where -name matches only the filename).

Select files that have been accessed (-atime), attribute-changed (-ctime), or content-changed (-mtime) n days ago. If n is preceded by a +, select files last accessed more than n days ago. If n is preceded by a -, select files last accessed within that previous n days.

(continued)