Editing Find (Unix) (section)

==Examples==

===From the current working directory===
<syntaxhighlight lang="console">
$ find . -name 'my*'
</syntaxhighlight>
This searches the current working directory tree for files whose names start with ''my''. The single quotes avoid the [[shell (computing)|shell]] expansion—without them the shell would replace ''my*'' with the list of files whose names begin with ''my'' in the current working directory. In newer versions of the program, the directory may be omitted, and it will imply the current working directory.

===Regular files only===
<syntaxhighlight lang="console">
$ find . -name 'my*' -type f
</syntaxhighlight>
This limits the results of the above search to only regular files, therefore excluding directories, special files, symbolic links, etc. ''my*'' is enclosed in single quotes (apostrophes) as otherwise the shell would replace it with the list of files in the current working directory starting with ''my''...

===Commands===
The previous examples created listings of results because, by default, <code>find</code> executes the <code>-print</code> action. (Note that early versions of the <code>find</code> command had no default action at all; therefore the resulting list of files would be discarded, to the bewilderment of users.)

<syntaxhighlight lang="console">
$ find . -name 'my*' -type f -ls
</syntaxhighlight>
This prints extended file information.

===Search all directories===
<syntaxhighlight lang="console">
$ find / -name myfile -type f -print
</syntaxhighlight>
This searches every directory for a regular file whose name is ''myfile'' and prints it to the screen. It is generally not a good idea to look for files this way. This can take a considerable amount of time, so it is best to specify the directory more precisely. Some operating systems may mount dynamic file systems that are not congenial to <code>find</code>. More complex filenames including characters special to the shell may need to be enclosed in single quotes.

===Search all but one subdirectory tree===
<syntaxhighlight lang="console">
$ find / -path excluded_path -prune -o -type f -name myfile -print
</syntaxhighlight>
This searches every directory except the subdirectory tree ''excluded_path'' (full path including the leading /) that is pruned by the <code>-prune</code> action, for a regular file whose name is ''myfile''.

===Specify a directory===
<syntaxhighlight lang="console">
$ find /home/weedly -name myfile -type f -print
</syntaxhighlight>
This searches the ''/home/weedly'' directory tree for regular files named ''myfile''. You should always specify the directory to the deepest level you can remember.

===Search several directories===
<syntaxhighlight lang="console">
$ find local /tmp -name mydir -type d -print
</syntaxhighlight>
This searches the ''local'' subdirectory tree of the current working directory and the ''/tmp'' directory tree for directories named ''mydir''.

===Ignore errors===
If you're doing this as a user other than root, you might want to ignore permission denied (and any other) errors. Since errors are printed to [[stderr]], they can be suppressed by redirecting the output to /dev/null. The following example shows how to do this in the bash shell:
<syntaxhighlight lang="console">
$ find / -name myfile -type f -print 2> /dev/null
</syntaxhighlight>

If you are a [[C shell|csh]] or [[tcsh]] user, you cannot redirect [[stderr]] without redirecting [[stdout]] as well. You can use sh to run the <code>find</code> command to get around this:
<syntaxhighlight lang="console">
$ sh -c "find / -name myfile -type f -print 2> /dev/null"
</syntaxhighlight>
An alternate method when using [[C shell|csh]] or [[tcsh]] is to pipe the output from [[stdout]] and [[stderr]] into a [[grep]] command. This example shows how to suppress lines that contain permission denied errors.
<syntaxhighlight lang="console">
$ find . -name myfile |& grep -v 'Permission denied'
</syntaxhighlight>

===Find any one of differently named files===
<syntaxhighlight lang="console">
$ find . \( -name '*jsp' -o -name '*java' \) -type f -ls
</syntaxhighlight>
The <code>-ls</code> operator prints extended information, and the example finds any regular file whose name ends with either 'jsp' or 'java'. Note that the parentheses are required. In many shells the parentheses must be escaped with a backslash (<code>\(</code> and <code>\)</code>) to prevent them from being interpreted as special shell characters. The <code>-ls</code> operator is not available on all versions of <code>find</code>.

===Execute an action===
<syntaxhighlight lang="console">
$ find /var/ftp/mp3 -name '*.mp3' -type f -exec chmod 644 {} \;
</syntaxhighlight>
This command changes the [[File system permissions|permissions]] of all regular files whose names end with ''.mp3'' in the directory tree ''/var/ftp/mp3''. The action is carried out by specifying the statement <code>-exec [[chmod]] 644 {} \;</code> in the command. For every regular file whose name ends in <code>.mp3</code>, the command <code>chmod 644 {}</code> is executed replacing <code>{}</code> with the name of the file. The semicolon (backslashed to avoid the shell interpreting it as a command separator) indicates the end of the command. Permission <code>644</code>, usually shown as <code>rw-r--r--</code>, gives the file owner full permission to read and write the file, while other users have read-only access. In some shells, the <code>{}</code> must be quoted. The trailing "{{code|;}}" is customarily quoted with a leading "{{code|\}}", but could just as effectively be enclosed in single quotes.

Note that the command itself should '''not''' be quoted; otherwise you get error messages like
<syntaxhighlight lang="output">
find: echo "mv ./3bfn rel071204": No such file or directory
</syntaxhighlight>
which means that <code>find</code> is trying to run a file called '{{code|2=sh|echo "mv ./3bfn rel071204"}}' and failing.

If you will be executing over many results, it is more efficient to use a variant of the exec primary that collects filenames up to {{mono|ARG_MAX}} and then executes COMMAND with a list of filenames.

<syntaxhighlight lang="console">
$ find . -exec COMMAND {} +
</syntaxhighlight>
This will ensure that filenames with whitespaces are passed to the executed {{code|COMMAND}} without being split up by the shell.

===Delete files and directories===
The <code>-delete</code> action is a GNU extension, and using it turns on <code>-depth</code>. So, if you are testing a find command with <code>-print</code> instead of <code>-delete</code> in order to figure out what will happen before going for it, you need to use <code>-depth -print</code>.

Delete empty files and print the names (note that <code>-empty</code> is a vendor unique extension from GNU <code>find</code> that may not be available in all <code>find</code> implementations):
<syntaxhighlight lang="console">
$ find . -empty -delete -print
</syntaxhighlight>

Delete empty regular files:
<syntaxhighlight lang="console">
$ find . -type f -empty -delete
</syntaxhighlight>

Delete empty directories:
<syntaxhighlight lang="console">
$ find . -type d -empty -delete
</syntaxhighlight>

Delete empty files named 'bad':
<syntaxhighlight lang="console">
$ find . -name bad -empty -delete
</syntaxhighlight>

Warning. — The <code>-delete</code> action should be used with conditions such as <code>-empty</code> or <code>-name</code>:
<syntaxhighlight lang="console">
$ find . -delete # this deletes all in .
</syntaxhighlight>

===Search for a string===
This command will search all files from the /tmp directory tree for a string:
<syntaxhighlight lang="console">
$ find /tmp -type f -exec grep 'search string' /dev/null '{}' \+
</syntaxhighlight>
The <code>[[/dev/null]]</code> argument is used to show the name of the file before the text that is found. Without it, only the text found is printed.  (Alternatively, some versions of grep support a {{mono|-H}} flag that forces the file name to be printed.)
GNU <code>grep</code> can be used on its own to perform this task:
<syntaxhighlight lang="console">
$ grep -r 'search string' /tmp
</syntaxhighlight>

Example of search for "LOG" in jsmith's home directory tree:
<syntaxhighlight lang="console">
$ find ~jsmith -exec grep LOG '{}' /dev/null \; -print
/home/jsmith/scripts/errpt.sh:cp $LOG $FIXEDLOGNAME
/home/jsmith/scripts/errpt.sh:cat $LOG
/home/jsmith/scripts/title:USER=$LOGNAME
</syntaxhighlight>

Example of search for the string "ERROR" in all XML files in the current working directory tree:
<syntaxhighlight lang="console">
$ find . -name "*.xml" -exec grep "ERROR" /dev/null '{}' \+ 
</syntaxhighlight>
The double quotes (" ") surrounding the search string and single quotes (<nowiki>' '</nowiki>) surrounding the braces are optional in this example, but needed to allow spaces and some other special characters in the string. Note with more complex text (notably in most popular shells descended from `sh` and `csh`) single quotes are often the easier choice, since ''double quotes do not prevent all special interpretation''. Quoting filenames which have English contractions demonstrates how this can get rather complicated, since a string with an apostrophe in it is easier to protect with double quotes:
<syntaxhighlight lang="console">
$ find . -name "file-containing-can't" -exec grep "can't" '{}' \; -print
</syntaxhighlight>

===Search for all files owned by a user===
<syntaxhighlight lang="console">
$ find . -user <userid>
</syntaxhighlight>

===Search in case insensitive mode===
Note that <code>-iname</code> is not in the standard and may not be supported by all implementations.
<syntaxhighlight lang="console">
$ find . -iname 'MyFile*'
</syntaxhighlight>

If the <code>-iname</code> switch is not supported on your system then workaround techniques may be possible such as:
<syntaxhighlight lang="console">
$ find . -name '[mM][yY][fF][iI][lL][eE]*'
</syntaxhighlight>

===Search files by size===
Searching files whose size is between 100 kilobytes and 500 kilobytes:
<syntaxhighlight lang="console">
$ find . -size +100k -a -size -500k
</syntaxhighlight>

Searching empty files:
<syntaxhighlight lang="console">
$ find . -size 0k
</syntaxhighlight>

Searching non-empty files:
<syntaxhighlight lang="console">
$ find . ! -size 0k
</syntaxhighlight>

===Search files by name and size ===
<syntaxhighlight lang="console">
$ find /usr/src ! \( -name '*,v' -o -name '.*,v' \) '{}' \; -print
</syntaxhighlight>
This command will search the /usr/src directory tree. All files that are of the form {{mono|'*,v'}} and {{mono|'.*,v'}} are excluded. Important arguments to note are in the [[tooltip]] that is displayed on mouse-over.

<syntaxhighlight lang="bash">
for file in $(find /opt \( -name error_log -o -name 'access_log' -o -name 'ssl_engine_log' -o -name 'rewrite_log' -o -name 'catalina.out' \) -size +300000k -a -size -5000000k); do 
    cat /dev/null > $file
done
</syntaxhighlight>
The units should be one of {{mono|[bckw]}}, 'b' means 512-byte blocks, 'c' means byte, 'k' means kilobytes and 'w' means 2-byte words. The size does not count indirect blocks, but it does count blocks in sparse files that are not actually allocated.

=== Searching files by time ===
Date ranges can be used to, for example, list files changed since a backup.

* {{code|-mtime}} : modification time
* {{code|-ctime}} : inode change time
* {{code|-atime}} : access time

Files modified a relative number of days ago:
* +[number] = At least this many days ago.
* -[number] = Less than so many days ago.
*  [number] = Exactly this many days ago.
* Optionally add <code>-daystart</code> to measure time from the beginning of a day (0 o'clock) rather than the last 24 hours.

Example to find all text files in the document folder modified since a week (meaning 7 days): 
<syntaxhighlight lang="console">
$ find ~/Documents/ -iname "*.txt" -mtime -7
</syntaxhighlight>

Files modified before or after an absolute date and time:
* <code>     -newermt YYYY-MM-DD</code>: Last modified after date
* <code>-not -newermt YYYY-MM-DD</code>: Last modified before date

Example to find all text files last edited in February 2017:
<syntaxhighlight lang="console">
$ find ~/Documents/ -iname "*.txt"  -newermt 2017-02-01 -not -newermt 2017-03-01
</syntaxhighlight>

*<code>-newer [file]</code>: More recently modified than specified file.
** <code>-cnewer</code>: Same with inode change time.
** <code>-anewer</code>: Same with access time.
** Also prependable with <code>-not</code> for inverse results or range.

List all text files edited more recently than "document.txt":
<syntaxhighlight lang="console">
$ find ~/Documents/ -iname "*.txt"  -newer document.txt
</syntaxhighlight>