find with examples

 - find

	For troubleshooting a system that seems to have
	suddenly stopped working, find has a few tricks
	up its sleeve. 

	When a system stops working suddenly, the first
	question to ask is "what changed?". 

		find / -mtime -1 

	That command will recursively list all the
	file from / that have changed in the last
	day. 

		find /usr/lib -mmin -30

	Will list all the files in /usr/lib that
	changed in the last 30 minutes. 

	Similar options exist for ctime and atime.

		find /tmp -amin -30

	Will show all the files in /tmp that have
	been accessed in the last 30 minutes.

	The -atime/-amin options are useful when trying
	to determine if an app is actually reading
	the files it is supposed. If you run the app,
	then run that command where the files are, and
	nothing has been accessed, something is wrong.

	If no "+" or "-" is given for the time value,
	find will match only exactly that time. This
	is handy in several cases. You can determine
	what files were modified/created at the
	same time. 

	A good example of this is cleaning up
	from a tar package that was unpacked into
	the wrong directory. Since all the files
	will have the same access time, you can
	use find and -exec to delete them all. 	

	- executables

	`find` can also find files with particular
	permisions set. 

		find / -perm -0777

	will find all world writeable files from
	/ down. 

		find /tmp -user "alikins"

	will find all files in /tmp owned
	by "alikins"

	- used in combo with grep to find
	  markers (errors, filename, etc)

	When troubleshooting, there are plenty of
	cases where you want to find all instances of
	a filename, or a hostname, etc. 

	To recursievely grep a large number of files,
	you can use find and it's exec options

		find . -exec grep foo {} \;

	This will grep for "foo" on all files from
	the current working directory and down.

	Note that in many cases, you can also
	use `grep -r` to do this as well. 

Advertisement