http://www.softpanorama.org/Tools/Find/find_mini_tutorial.shtml

<html>

<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Unix Find Tutorial</title>
<meta name="description" content="Unix find command">
<meta name="keywords" content="Unix utilities, find, regular expression, finding files">
<link rel="stylesheet" type="text/css" href="../../CSS/main.css">
</head>

<body>

<p align="right"><font face="Courier" size="1" color="#000000"><i><b>May the
source be with you,<br>
but remember the KISS principle ;-)</b></i></font></p>
<div align="center">
<p><big><a href="http://www.softpanorama.org/index.shtml"><font color="#FF0000"><b>
<font size="2">Softpanorama: (slightly skeptical) Open Source Software Educational Society</font></b></font></a></big></p>
<cennter>
<!-- SiteSearch Google -->
<form method="get" action="http://www.google.com/custom" target="google_window">
<table border="0" bgcolor="#ffffff">
<tr><td nowrap="nowrap" valign="top" align="left" height="32">
<a href="http://www.google.com/">
<img src="http://www.google.com/logos/Logo_25wht.gif" border="0" alt="Google" align="middle"></img></a>
</td>
<td nowrap="nowrap">
<input type="hidden" name="domains" value="www.softpanorama.org"></input>
<input type="text" name="q" size="31" maxlength="255" value=""></input>
<input type="submit" name="sa" value="Search"></input>
</td></tr>
<tr>
<td>&nbsp;</td>
<td nowrap="nowrap">
<table>
<tr>
<td>
<input type="radio" name="sitesearch" value="" checked="checked"></input>
<font size="-1" color="#000000">Web</font>
</td>
<td>
<input type="radio" name="sitesearch" value="www.softpanorama.org"></input>
<font size="-1" color="#000000">www.softpanorama.org</font>
</td>
</tr>
</table>
<input type="hidden" name="client" value="pub-4031247137266443"></input>
<input type="hidden" name="forid" value="1"></input>
<input type="hidden" name="ie" value="ISO-8859-1"></input>
<input type="hidden" name="oe" value="ISO-8859-1"></input>
<input type="hidden" name="cof" value="GALT:#008000;GL:1;DIV:#336699;VLC:663399;AH:center;BGC:FFFFFF;LBGC:336699;ALC:0000FF;LC:0000FF;T:000000;GFNT:0000FF;GIMP:0000FF;FORID:1;"></input>
<input type="hidden" name="hl" value="en"></input>
</td></tr></table>
</form>
<!-- SiteSearch Google -->
</center>
<script type="text/javascript"><!--
google_ad_client = "pub-4031247137266443";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_type = "text_image";
//2007-01-25: top
google_ad_channel = "0958472023";
google_color_border = "CC0000";
google_color_bg = "FFFF66";
google_color_link = "CC0000";
google_color_text = "6F3C1B";
google_color_url = "6131BD";
//--></script>
<script type="text/javascript"
  src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
<hr width="100%" noshade size="5" color="#FF0000"></font>


<h1>Unix Find Command Tutorial</h1>
<ul>
	<li><a href="#Introduction">Introduction</a></li>
	<li><a href="#using_exec_option">Using -exec option with find</a></li>
	<li><a href="#xarg and pipes">Feeding find output to pipes with xargs</a></li>
	<li><a href="#suid_sguid_games">SUID/SGUID games, abandoned and other abnormal 
	files</a></li>
	<li><a href="#Summary">Summary</a></li>
</ul>
<h2><b><a name="Introduction">Introduction</a></b></h2>
<p>Unix find is a pretty tricky command that can often fool even experienced 
UNIX professionals with ten on more years of sysadmins work under the belt. </p>
<p>The idea is extremely simple: this is a utility for <b><i>searching files using the directory information</i></b> 
and in this sense it is more like <font color="#0000FF"><b>ls.&nbsp; </b></font>
But it is more obscure then ls and has a special unique mini-language for specifying 
query, the language that long outlived its usefulness but nobody have a courage 
to replace it with a standard scripting language. </p>
<!---box ------->
<div align="right">
	<table border="1" width="300" height="250" id="table19" align="right">
		<tr>
			<td><script type="text/javascript"><!--
google_ad_client = "pub-4031247137266443";
google_ad_width = 300;
google_ad_height = 250;
google_ad_format = "300x250_as";
google_ad_type = "text_image";
google_ad_channel = "";
google_color_border = "336699";
google_color_bg = "FFFFFF";
google_color_link = "0000FF";
google_color_text = "000000";
google_color_url = "008000";
//--></script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script></td>
		</tr>
	</table>
</div>
<!---end of box ------->


<p>For obscure historical reasons
<font color="#0000FF"><b><tt>find</tt></b></font> has a notation that is completely 
different from all other UNIX commands: it has full-word options rather than single-letter 
options. For example, instead of&nbsp; a typical Unix-style option -n&nbsp; to match 
filenames <font color="#0000FF">find</font> uses option <font color="#0000FF">
<br>
-name</font>. </p>
<p>In general you need to specify the starting point for a search through the file 
system as the first argument, followed by any actions desired. The list of popular 
examples can be found in Reference section of this page. </p>
<p>It is simply impossible to remember 
all the details of this language unless you are need to use complex queries each 
day multiple times and that&#39;s why this page was created. </p>
<p>Major options of the find command include: </p>
<ul>
	<li><b><tt>-name</tt>:</b> Finds files with certain naming conventions in the directory 
	structure <br>
&nbsp;</li>
	<li><tt><b>-ctime </b></tt><i>time interval</i> Locates files that that <i>
	<b>were created</b></i> during the specified 
	time interval </li>
	<li><font color="#0000FF">-mtime</font>&nbsp; <i>time interval </i>Finds files that have 
    been modified during the specified 
	time interval </li>
	<li><b><tt>-atime </tt></b><i>time interval</i> Locates files that <i><b>have been accessed</b></i> during the specified 
	time interval&nbsp; <br>
&nbsp;</li>
	<li><tt><b>-perm</b> <i>permissions</i></tt> Locates files with certain permission settings </li>
	<li><tt><b>-user</b> </tt>Locates files that have specified ownership </li>
	<li><tt><b>-group</b> </tt> Locates files that are owned by specified group </li>
	<li><tt><b>-size</b> </tt>Locates files with specified size </li>
	<li><tt><b>-type</b> </tt>&nbsp;Locates a certain type of file </li>
</ul>
<p><i><b>Time interval</b></i> in options<font color="#0000FF"> -ctime</font>,
<font color="#0000FF">-mtime</font> and <font color="#0000FF">-atime</font> is 
an integer with optional sign. </p>
<ul>
  <li><b><font color="#0000FF">n: </font></b>If the integer n does not have sign this means
	<i><b>exactly n days ago</b></i>, 0 means today. </li>
  <li><b><font color="#0000FF">+n:</font></b>&nbsp; if it has plus sing, then it means
	<i><b>&quot;more 
		then n days ago&quot;, or older then n</b></i>,</li>
  <li><font color="#0000FF"><b>-n:</b></font> if it has the minus sign, then it means&nbsp;
	<i><b>less than n days ago (-n), or younger then n</b></i>.</li>
	<li>It's evident that -1 and 0 are the same and means &quot;today&quot;. </li>
</ul>
<p>It is possible to locate files and directories that match or do not match multiple 
conditions, for example: </p>
<ul>
	<li><tt>a</tt><b> </b>to have multiple conditions <tt>AND</tt>ed </li>
	<li><tt>o</tt><b> </b>to have multiple conditions <tt>OR</tt>ed </li>
	<li><tt>!</tt><b> </b>to negate a condition </li>
	<li><tt>expression</tt><b> </b>to satisfy any complex condition </li>
</ul>
<p>It is possible to specify the action to be taken on the files or directories 
that are found: </p>
<ul>
	<li><tt>print</tt><b> </b>prints the names of the files on standard output (usually 
	enabled by default)</li>
	<li><tt>exec command</tt><b> </b>executes the specified command. </li>
</ul>
<p>The most common reason for using the <tt>find</tt> command is to utilize its 
capability to recursively process the subdirectories. For example, if you want to 
obtain a list of all files accessed in the last 24 hours, execute the following 
command:</p>
<blockquote>
	<pre><font color="#0066ff">find . -atime 0 -print</font></pre>
</blockquote>
<p>If the system administrator want a list of <tt>.profile</tt> used by all users, 
the following command should be executed:</p>
<blockquote>
	<pre><b><font color="#0000FF">find / -name .profile -print</font></b></pre>
</blockquote>
<p>You can also execute the <tt>find</tt> command with multiple conditions. If you 
wanted to find a list of files that have been modified in the last 24 hours and 
which has a permission of <tt>777</tt>, you would execute the following command:</p>
<blockquote>
	<pre><b><font color="#0000FF">find . -perm 777  -a -mtime 0 -print</font></b></pre>
</blockquote>
<table cellspacing="1" cellpadding="3" width="100%" border="1" id="table1">
	<tr bgcolor="#cccccc">
		<th width="10%">Option</th>
		<th width="30%">Meaning</th>
		<th width="60%">Example</th>
	</tr>
	<tr>
		<td width="10%">-atime n<p>-atime +n</p>
		<p>-atime -n</p>
		</td>
		<td width="20%">True if file was accessed n days ago (n), accessed more 
		then n days ago(+n) or less than n days ago (-n) </td>
		<td width="70%">&nbsp;</td>
	</tr>
	<tr>
		<td width="10%">-ctime n</td>
		<td width="20%">True if the file was created n days ago.</td>
		<td width="70%"><font color="#0000FF">find . -ctime +30 -type f -exec rm 
		{} ';'</font></td>
	</tr>
	<tr>
		<td width="10%">-exec command</td>
		<td width="20%">Execute command.</td>
		<td width="70%"><font color="#0000FF">find . -mtime -2 -type f -exec mv 
		{} ../Spam_collector \;</font></td>
	</tr>
	<tr>
		<td width="10%">-mtime n</td>
		<td width="20%">True if file was modified n days ago.</td>
		<td width="70%"><font color="#0000FF">find . -mtime -2 -type f -exec mv 
		{} ../Spam_collector \;</font></td>
	</tr>
	<tr>
		<td width="10%">-name pattern</td>
		<td width="20%">True if filename matches pattern.</td>
		<td width="70%">&nbsp;</td>
	</tr>
	<tr>
		<td width="10%">-print</td>
		<td width="20%">Print names of files found.</td>
		<td width="70%">&nbsp;</td>
	</tr>
	<tr>
		<td width="10%">-type c</td>
		<td width="20%">True if file is of type c </td>
		<td width="70%"><font color="#0000FF">find . -mtime -2 -type f -exec mv 
		{} ../Spam_collector \;</font></td>
	</tr>
	<tr>
		<td width="10%">-user name</td>
		<td width="20%">True if file is owned by user name.</td>
		<td width="70%">&nbsp;</td>
	</tr>
</table>
<p>The find command checks the specified options, going from left to right, once 
for each file or directory encountered. </p>
<p>The simplest invocation of find can be used to create a list of all files and 
directories below the current directory: </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -print</b></font></pre>
</blockquote>
<p>You can use regular expressions to select files, for example those that have 
a .html suffix): </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -name &quot;*.html: -print</b></font></pre>
</blockquote>
<p>You can search for files more recent than, older than, or exactly the same age 
as a specified date, </p>
<ul>
	<li>&nbsp;-n - more recent then n days old</li>
	<li>&nbsp;+n - older then n days old </li>
	<li>&nbsp; n&nbsp; exactly of age n </li>
</ul>
<p>Here are some useful examples. To find html files that have been modified in 
the last seven days, I can use -mtime with the argument -7 (include the hyphen):
</p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -mtime -7 -name &quot;*.html&quot; -print</b></font>
</pre>
</blockquote>
<p>If I just use the number 7 (without a hyphen), I will match only html files that 
were modified exactly seven days ago: </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -mtime 7 -name &quot;*.html&quot; -print</b></font>
</pre>
</blockquote>
<p>To find those html files that I haven&#39;t touched for at least 7 days, I use +7:
</p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -mtime +7 -name &quot;*.html&quot; -print</b></font>

</pre>
</blockquote>
<ol>
	<li>You can specify more than one directory as a starting point for the search. 
	To look across the /bin and /usr directory trees for filenames that contain 
	the pattern <tt>\.htm</tt>, I can use the following command:
	<blockquote>
		<pre><font color="#0000FF"><b>find /usr /bin -name &quot;*\.htm*&quot; -print</b></font>
</pre>
	</blockquote>
	</li>
	<li>To find a list of the directories use the <tt>-type</tt> specifier. Here&#39;s 
	one example:
	<blockquote>
		<pre><font color="#0000FF"><b>find . -type d -print</b></font></pre>
	</blockquote>
	
		
		</ol>
<blockquote>
	The most typical options for <font color="#0000FF"><b>-type </b></font>are 
	as following: 

	<ul>
		<li><font color="#0000FF"><b>d </b></font>-Directory
		<li><font color="#0000FF"><b>f </b></font>- File
		
		<li><font color="#0000FF"><b>l </b></font>- Link
		</ul>
</blockquote>
<h2 align="center"><a name="using_exec_option">Using -exec option with find</a></h2>
<p>Find is able to execute one or more commands for each file it has found with 
the -exec option. Unfortunately, one cannot simply enter the command. You need 
to remeber two tricks: </p>
<ol>
	<li>the command that you want to execute need to contain a special (obsure) argument&nbsp;
	<font color="#0000FF">{}</font>, 
which will be replaced by the matched filename, </li>
	<li>and \; (or ';' ) at the end of the command. 
(If the \ is left out, the shell will interpret the ; as the end of the find command.) 
If {} id is the last item in the command then <b>it should be a space</b> 
	between the {} and the \;, for example: </li>
</ol>
<blockquote>
	<blockquote>
		<pre><font color="#0000FF"><b>find . -type d -exec ls -ld {} \;</b></font></pre>
	</blockquote>
</blockquote>
<p>Here are several &quot;global&quot; chmod tricks based on fine -exec capabilities: </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -type f -exec chmod 500 {} ';'</b></font></pre>
	<pre><font color="#0000FF"><b>find . -name &quot;rc.conf&quot; -exec chmod o+r &#39;{}&#39; ';' </b></font></pre>
</blockquote>
<p>This command will search in the current directory and all sub directories for 
a file named rc.conf. </p>
<p><font color="#0000FF">Note:</font> The -print option will print out the path 
of any file that is found with that name. In general -print will print out the path 
of any file that meets the find criteria. </p>
<p>How to apply a unix command to a set of file (-exec).</p>
<blockquote>
	<p><font color="#0000FF"><b>find . -name &quot;rc.conf&quot; -exec chmod o+r &#39;{}&#39; \;
	</b></font></p>
</blockquote>
<p>This command will search in the current directory and all sub directories. All 
files named rc.conf will be processed by the chmod -o+r command. The argument &#39;{}&#39; 
inserts each found file into the chmod command line. The \; argument indicates the 
exec command line has ended. </p>
<p>The end results of this command is all rc.conf files have the other permissions 
set to read access (if the operator is the owner of the file). </p>
<p>The find command is commonly used to remove core files that are more than a few 
days old. These core files are copies of the actual memory image of a running program 
when the program dies unexpectedly. They can be huge, so occasionally trimming them 
is wise: </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -name core -ctime +4 -exec /bin/rm -f {} \;</b></font>
</pre>
</blockquote>
<p>There&#39;s no output from this command because I didn&#39;t use the - print at the end 
of the command. What it does is find all files called &quot;core&quot; that have a creation 
time that&#39;s more than 4 days ago and remove them.</li> </p>
<p>The find command is a powerful command in UNIX. It helps you find files by owner, 
type, filename, and other attributes. The most awkward part of the command is the 
required elements of the -exec option, and that&#39;s where the xargs command helps 
immensely. </p>
<h3 align="center">&nbsp;<a name="xarg and pipes">Feeding find output to pipes with 
xargs</a></h3>
<p>One of the biggest limitations of the -exec command is that it can only run the 
specified command on one file at a time. The xargs command solves this problem by 
enabling users to run a single command on many files at one time. In general, it 
is much faster to run one command on many files, because this cuts down on the number 
of commands that need to be started.</p>
<p>For example often one needs to find files containing a specific pattern in multiple 
directories one can use an exec option in find (please note that you should use 
the -l flag for grep so that grep specifies the matched filenames):</p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -type f -exec grep -l -i &#39;/bin/ksh&#39; {} \;</b></font></pre>
</blockquote>
<p>But there is more elegant and more Unix-like way of accomplishing the same task 
using xarg and pipes. You can use the xargs to read the output of find and build 
a pipelines that envokes grep. This way, grep is called only four or five times 
even though it might check through 200 or 300 files. By default, xargs always appends 
the list of filenames to the end of the specified command, so using it is as easy 
as can be: </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -type f -print | xargs grep -l -i &#39;bin/ksh&#39;</b></font>
</pre>
</blockquote>
<p>This gave the same output, but it was a lot faster.&nbsp;&nbsp; Also when grep 
is getting multiple filenames, it will automatically include the filename of any 
file that contains a match when grep shows the matching line. Removing the -l flag 
results in more meaningful (and potentially more useful output):&nbsp; </p>
<blockquote>
	<pre><font color="#0000FF"><b>find . -type f -print | xargs grep -i &#39;bin/ksh&#39;</b></font>
</pre>
</blockquote>
<p>When used in combination, find, grep, and xargs are a potent team to help find 
files lost or misplaced anywhere in the UNIX file system. I encourage you to experiment 
further with these important commands to find ways they can help you work with UNIX. 
You can use time to find the fifference in sleed with -exec option: </p>
<font size="-1">
<blockquote>
	<pre><font color="#0000FF"><b>time find /usr/src -name &quot;*.html&quot; -exec grep -l foo &#39;{}&#39; &#39;;&#39; | wc -l</b></tt>

<b>time find /usr/src -name &quot;*.html&quot; | xargs grep -l foo | wc -l</b></tt></font>
</pre>
</blockquote>
</font>
<p>xargs works considerably faster. The difference becomes even greater when more 
complex commands are run and the list of files is longer.</p>
<font size="-1">
<blockquote>
	<pre><font color="#0000FF"><b>find /mnt/zip -name &quot;*prefs copy&quot; -print | xargs rm</b></tt></font>
</pre>
</blockquote>
</font>
<p>This won&#39;t work because I have a filename with spaces. If I add -print0, I can 
do it with no problems:</p>
<font size="-1">
<blockquote>
	<pre><font color="#0000FF"><b>find /mnt/zip -name &quot;*prefs copy&quot; -print0 | xargs rm</tt></b></font>
</pre>
</blockquote>
</font>
<p>Two other useful options for xargs are the -p option, which makes xargs interactive, 
and the -n args option, which makes xargs run the specified command with only args 
number of arguments.</p>
<p>Some people wonder why there is a -p option. xargs runs the specified command 
on the filenames from its standard input, so interactive commands such as cp -i, 
mv -i, and rm -i don&#39;t work right. The -p option solves that problem. In the preceding 
example, the -p option would have made the command safe because I could answer yes 
or no to each file. Thus, the command I typed was the following:</p>
<font size="-1">
<blockquote>
	<pre><b>find /mnt/zip -name &quot;*prefs copy&quot; -print0 | xargs -p rm</b></tt>
</pre>
</blockquote>
<p>Many users frequently ask why <tt>xargs</tt> should be used when shell command 
substitution archives the same results. Take a look at this example: </p>
<blockquote>
	<pre><b>grep -l foo ´find /usr/src/linux -name &quot;*.html&quot;´</b></tt>
</pre>
</blockquote>
<p>The drawback with commands such as this is that if the set of files returned 
by <tt>find</tt> is longer than the system&#39;s command-line length limit, the command 
will fail. The <tt>xargs</tt> approach gets around this problem because <tt>xargs</tt> 
runs the command as many times as is required, instead of just once.</p>
</font>
<h2 align="center"><a name="suid_sguid_games">SUID/SGUID games, finding abandoned 
and other abnormal files</a></h2>
<p>Suid root refers to a special attribute called set user id. This allows the program 
to do functions not normally allowed for users to do themselves.&nbsp; Low level 
networking routines,&nbsp; controlling graphical display functions, changing passwords, 
and logging in are all examples of programs that rely on executing their functions 
as a user that is not restricted by standard file permissions.&nbsp; While many 
programs need this functionality,&nbsp; the program must be bug free in only allowing 
the user to do the function the program was designed for. Every suid root program 
represents a potential security problem. </p>
<p>The first step in controlling suid root programs is to have a baseline, the list 
of all suid program in the system.&nbsp; This can be achieved quite easily by using 
find:&nbsp;&nbsp; </p>
<blockquote>
	<b><font color="#0000FF"><tt>find / -type f -perm +6000 -exec ls -l {} \; &gt; suid.list (note: this will 
find both set user id and set group id programs)</tt> </font></b>
</blockquote>

<p>Above command is using GNU find. Solaris find command is slightly different:
</p>
<blockquote>
 <font color="#0000FF">
 <tt>find / -type f \( -perm -4000 -o -perm -2000 \) 
-exec ls -l {} \; </tt>
	</font>
</blockquote>
<p>This command will find all the suid programs on a system and pipes the commands 
to a file called suid.list.&nbsp; The next step in controlling suid root programs 
is to analyze which programs should not be suid root or can be removed without impeding 
system functionality.&nbsp;&nbsp; An obvious example of something that should not 
be suid root is <tt>/usr/X11R6/bin/SuperProbe.</tt>&nbsp; This is a program merely 
used for testing purposes. </p>
<blockquote>
	<p><font color="#0000FF"><b><tt>&#39;chmod -s /usr/X11R6/bin/SuperProbe&#39;</tt> 
	</b></font> </p>
</blockquote>
<p>Other programs that are unneeded to be suid root include anything in the svgalib 
hierarchy.&nbsp; This library itself is buggy and nothing that depends on it should 
be suid root in a secure system. </p>
<p>Here is a <a target="_blank" href="http://www.dpo.uab.edu/~grapeape/suid.list.good">suid.list</a> 
from a much cleaner system, though perhaps a little too overzealous.&nbsp; The functionality 
that does not exist with this setup is ping and traceroute.&nbsp; Everything else 
is possible and keeping up with changes in utilities is easy with such a small list 
to look at. </p>
<p>The main theory that is common with suid root programs is only letting what needs 
to be available to users be suid root.&nbsp; Know what each program does and the 
reason it needs to be suid root.&nbsp; Also know the versions of suid root programs 
and upgrade them as new versions come out, making sure to keep track of your vendor&#39;s 
OS fixes. 

</p>
<h2 align="center"><a name="Summary">Summary</a></h2>
<p>The find command has a lot of esoteric options, and to get the full power out 
of find, xargs, and grep, you need to experiment.&nbsp; You can specify: </p>
<ul>
	<li>where to search (pathname) </li>
	<li>what type of file to search for (-type: directories, data files, links)
	</li>
	<li>how to process the files (-exec: run a process against a selected file)
	</li>
	<li>the name of the file(s) (-name) </li>
	<li>perform logical operations on selections (-o and -a)</li>
	<li>Matching criteria
	<ul>
		<li>-atime n file was accessed n days ago<br>
		</li>
		<li>-mtime n file was modified n days ago<br>
		</li>
		<li>-size n file is exactly n 512-byte blocks<br>
		</li>
		<li>-type c file type (e.g., f=plain, d=dir)<br>
		</li>
		<li>-name nam file name (e.g., `*.c&#39;)<br>
		</li>
		<li>-user usr file&#39;s owner is usr<br>
		</li>
		<li>-perm p file&#39;s access mode is p</li>
	</ul>
	</li>
	<li>Actions
	<ul>
		<li>-print display pathname<br>
		</li>
		<li>-exec cmd execute command ({} expands to file)</li>
	</ul>
	</li>
</ul>
<p>There are several options for matching criteria:</p>
<pre>  <font color="#0000FF">-atime n</font>        File was accessed &quot;n&quot; days ago
  <font color="#0000FF">-mtime n </font>       File was modified &quot;n&quot; days ago
  <font color="#0000FF">-size n </font>        File is &quot;n&quot; 512-byte blocks big
  <font color="#0000FF">-type c </font>        Specifies file type: f=plain text, d=directory
  <font color="#0000FF">-fstype typ</font>     Specifies filesystem type: 4.2 or nfs
  -<font color="#0000FF">name nam  </font>     The filename is &quot;nam&quot;
  <font color="#0000FF">-user usr  </font>     The file&#39;s owner is &quot;usr&quot;
  <font color="#0000FF">-group grp </font>     The file&#39;s group owner is &quot;grp&quot;
  <font color="#0000FF">-perm p   </font>      The file&#39;s access mode is &quot;p&quot; (integer)</pre>
<p>You can use plus + and minus - modifiers with the &quot;atime&quot;, &quot;mtime&quot;, and &quot;size&quot; 
criteria to increase their usefulness. Some examples:</p>
<pre>  <font color="#0000FF">-mtime +7  </font>     Matches files modified more than 7 days ago
  <font color="#0000FF">-atime -2  </font>     Matches files accessed less than 2 days ago
  <font color="#0000FF">-size +100</font>      Matches files larger than 100 blocks (50K)</pre>
<p>Multiple options are joined by AND by default. OR may be specified with the -o 
flag and the use of grouped parentheses. To match all files modified more than 7 
days ago and accessed more than 30 days ago, use:</p>
<pre>  <font color="#0000FF">\( -mtime +7 -o -atime +30 \)</font></pre>
<p>NOT may be specified with an exclamation point. To match all files ending in 
.txt except the file &quot;notme.txt&quot;, use:</p>
<pre>  <font color="#0000FF">\! -name notme.txt -name \*.txt</font></pre>
<p>You can specify the following actions for the list of files that the &quot;find&quot; command 
locates:</p>
<pre>  <font color="#0000FF">-print</font>          Display pathnames of matching files
  <font color="#0000FF">-exec cmd</font>       Execute command &quot;cmd&quot; on a file
  <font color="#0000FF">-ok cmd    </font>     Prompt before executing command &quot;cmd&quot; on a file
 <font color="#0000FF"> -mount </font>         (System V) Restrict to filesystem of starting dir.
  <font color="#0000FF">-xdev </font>          (BSD) Restrict to filesystem of starting dir.
  <font color="#0000FF">-prune</font>          (BSD) Don&#39;t descend into subdirectories</pre>
<p>Executed commands must end with \;&nbsp; or ';' and may use {} as a placeholder for each file 
found by &quot;find&quot;. For example, for a long listing of each file found, use:</p>
<pre>  <font color="#0000FF">-exec ls -l {} \;</font></pre>
<p>Matching criteria and actions may be placed in any order, and are evaluated from 
left to right.</p>
<div align="center">
	<script type="text/javascript"><!--
google_ad_client = "pub-4031247137266443";
google_alternate_ad_url = "http://www.softpanorama.org/support.htm";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_channel ="";
google_color_border = "FF4500";
google_color_bg = "FFEBCD";
google_color_link = "DE7008";
google_color_url = "E0AD12";
google_color_text = "8B4513";
//--></script>
	<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
	
	
</script>
	<hr size="5" noshade color="#FF0000"></div>
<font face="Verdana" size="1">
<p align="left">Copyright © 1996-2007 by Dr. Nikolai Bezroukov.
<a target="_blank" href="http://www.softpanorama.org">www.softpanorama.org</a> was 
created as a service to the UN Sustainable Development Networking Programme (<a target="_blank" href="http://www.un.org/Depts/dhl/sflib/">SDNP</a>) 
in the author free time.
<b>
<a target="_blank" href="http://www.softpanorama.org/Links/comments.shtml">Submit 
comments</a></b>
This document is an industrial compilation designed and <b>created exclusively 
for educational use</b> and is placed under the copyright of the
<a target="_blank" href="http://www.opencontent.org/opl.shtml">Open Content License(OPL)</a>. 
Original materials copyright belong to respective owners. <i><b>Quotes are made<font color="#FF0000"> 
for educational purposes only</font> in compliance with the fair use doctrine.
</b></i></p>
<p><b>Standard disclaimer:</b> <i>The statements, views and opinions presented on 
this web page are those of the author and are not endorsed by, nor do they necessarily 
reflect, the opinions of the author present and former employers, SDNP or any other 
organization the author may be associated with. </i>We do not warrant the correctness 
of the information provided or its fitness for any purpose.</i></p>
</font>
<p><em>Created: May 16, 1997; Last modified: 
<!--webbot bot="Timestamp" 
s-type="EDITED" s-format="%B %d, %Y" startspan -->February 14, 2007<!--webbot bot="Timestamp" i-checksum="41409" endspan --></em></p>
</body>

</html>