Bash find syntax

 Find syntax

[icon]
   

This section requires expansion.(August 2008)

find [-H] [-L] [-P] path... [expression]

The three options control how the find command should treat symbolic links. The default behaviour is never to follow symbolic links. This can be explicitly specified using the -P flag. The -L flag will cause the find command to follow symbolic links. The -H flag will only follow symbolic links while processing the command line arguments. These flags are not available with some older versions of find.

At least one path must precede the expression. find is capable of interpreting wildcards internally and commands must be constructed carefully in order to control shell globbing.

Expression elements are whitespace-separated and evaluated from left to right. They can contain logical elements such as AND (-a) and OR (-o) as well as more complex predicates.

The GNU find has a large number of additional features not specified by POSIX.
[edit]POSIX protection from infinite output

Real-world filesystems often contain looped structures created through the use of hard or soft links. The POSIX standard requires that

The find utility shall detect infinite loops; that is, entering a previously visited
directory that is an ancestor of the last file encountered. When it detects an infinite
loop, find shall write a diagnostic message to standard error and shall either recover
its position in the hierarchy or terminate.

[edit]Examples
[edit]From current directory

find . -name 'my*'

This searches in the current directory (represented by the dot character) and below it, for files and directories with names starting with my. The quotes avoid the shellexpansion — without them the shell would replace my* with the list of files whose names begin with my in the current directory. In newer versions of the program, the directory may be omitted, and it will imply the current directory.

Note that for RedHat Linux Version 9: find . -name my* returns this error find: paths must precede expression. Double quotes find . -name "my*" works fine.
[edit]Files only

find . -name "my*" -type f

This limits the results of the above search to only regular files, therefore excluding directories, special files, pipes, symbolic links, etc. my* is enclosed in quotes as otherwise the shell would replace it with the list of files in the current directory starting with my...
[edit]Commands

The previous examples created listings of results because, by default, find executes the '-print' action. (Note that early versions of the find command had no default action at all; therefore the resulting list of files would be discarded, to the bewilderment of users.)

find . -name "my*" -type f -ls

This prints extended file information.
[edit]Search all directories

find / -name "myfile" -type f -print

This searches every file on the computer for a file with the name myfile and prints it to the screen. It is generally not a good idea to look for data files this way. This can take a considerable amount of time, so it is best to specify the directory more precisely. Some operating systems may mount dynamic filesystems that are not congenial to find.
[edit]Search all but one directory subtree

find / -path excluded_path -prune -o -type f -name myfile -print

This searches every folder on the computer except the subtree excluded_path (pull path including the leading /), for a file with the name myfile. It will not detect directories, devices, links, doors, or other "special" filetypes.
[edit]Specify a directory

find /home/weedly -name "myfile" -type f -print

This searches for files named myfile in the /home/weedly directory, the home directory for userid weedly. You should always specify the directory to the deepest level you can remember.
[edit]Search several directories

find local /tmp -name mydir -type d -print

This searches for directories named mydir in the local subdirectory of the current working directory and the /tmp directory.
[edit]Ignore errors

If you're doing this as a user other than root, you might want to ignore permission denied (and any other) errors. Since errors are printed to stderr, they can be suppressed by redirecting the output to /dev/null. The following example shows how to do this in the bash shell:

find / -name "myfile" -type f -print 2>/dev/null

If you are a csh or tcsh user, you cannot redirect stderr without redirecting stdout as well. You can use sh to run the find command to get around this:

sh -c find / -name "myfile" -type f -print 2>/dev/null

An alternate method when using csh or tcsh is to pipe the output from stdout and stderr into a grep command. This example shows how to suppress lines that contain permission denied errors.

find . -name "myfile" |& grep -v "Permission denied"

[edit]Find any one of differently named files

find . \( -name "*jsp" -o -name "*java" \) -type f -ls

The -ls option prints extended information, and the example finds any file whose name ends with either 'jsp' or 'java'. Note that the parentheses are required. Also note that the operator "or" can be abbreviated as "o". The "and" operator is assumed where no operator is given. In many shells the parentheses must be escaped with a backslash, "\(" and "\)", to prevent them from being interpreted as special shell characters. The -ls option and the -or operator are not available on all versions offind.
[edit]Execute an action

find /var/ftp/mp3 -name "*.mp3" -type f -exec chmod 644 {} \;

This command changes the permissions of all files with a name ending in .mp3 in the directory /var/ftp/mp3. The action is carried out by specifying the option -execchmod 644 {} \; in the command. For every file whose name ends in .mp3, the command chmod 644 {} is executed replacing {} with the name of the file. The semicolon (backslashed to avoid the shell interpreting it as a command separator) indicates the end of the command. Permission 644, usually shown as rw-r--r--, gives the file owner full permission to read and write the file, while other users have read-only access. In some shells, the {} must be quoted.

Note that the command itself should *not* be quoted; otherwise you get error messages like

find: echo "mv ./3bfn rel071204": No such file or directory

which means that find is trying to run a file called 'echo "mv ./3bfn rel071204"' and failing.

If running under Windows, don't include the backslash before the semicolon:

find . -exec grep blah {} ;

If you will be executing over many results, it is more efficient to pipe the results to the xargs command instead. xargs is a more modern implementation, and handles long lists in a more intelligent way. The print0 option can be used with this.

The following command will ensure that filenames with whitespaces are passed to the executed COMMAND without being split up by the shell. It looks complicated at first glance, but is widely used.

find . -print0 | xargs -0 COMMAND

The list of files generated by find (whilst it is being generated) is simultaneously piped to xargs, which then executes COMMAND with the files as arguments. Seexargs for more examples and options.
[edit]Delete files and directories

Delete empty files and directories and print the names

find /foo -empty -delete -print

Delete empty files

find /foo -type f -empty -delete

Delete empty directories

find /foo -type d -empty -delete

Delete files and directories (if empty) named bad

find /foo -name bad -delete

Warning: -delete should be use with other operators such as -empty or -name.

find /foo -delete  (this deletes all in foo)

[edit]Search for a string

This command will search for a string in all files from the /tmp directory and below:

find /tmp -exec grep "search string" '{}' /dev/null \; -print

The /dev/null argument is used to show the name of the file before the text that is found. Without it, only the text found is printed. An equivalent mechanism is to use the "-H" or "--with-filename" option to grep:

find /tmp -exec grep -H "search string" '{}' \; -print

GNU grep can be used on its own to perform this task:

grep -r "search string" /tmp

Example of search for "LOG" in jsmith's home directory

find ~jsmith -exec grep "LOG" '{}' /dev/null \; -print
/home/jsmith/scripts/errpt.sh:cp $LOG $FIXEDLOGNAME
/home/jsmith/scripts/errpt.sh:cat $LOG
/home/jsmith/scripts/title:USER=$LOGNAME

Example of search for the string "ERROR" in all XML files in the current directory and all sub-directories

find . -name "*.xml" -exec grep "ERROR" '{}' \; -print

The double quotes (" ") surrounding the search string and single quotes (' ') surrounding the braces are optional in this example, but needed to allow spaces and other special characters in the string.
[edit]Search for all files owned by a user

find . -user <userid>

[edit]Search in case insensitive mode

find . -iname "MyFile*"

If the -iname switch is not supported on your system then workaround techniques may be possible such as:

find . -name "[mM][yY][fF][iI][lL][eE]*"

This uses Perl to build the above command for you:

echo "'MyFile*'" |perl -pe 's/([a-zA-Z])/[\L\1\U\1]/g;s/(.*)/find . -name \1/'|sh

[edit]Search files by size

Example of searching files with size between 100 kilobytes and 500 kilobytes.

find . -size +100k -a -size -500k

Example of searching empty files.

find . -size 0k

Example of searching non-empty files.

find . -not -size 0k

[edit]Search files by name and size

find /usr/src -not \( -name "*,v" -o -name ".*,v" \) '{}' \; -print

This command will search in the /usr/src directory and all sub directories. All files that are of the form '*,v' and '.*,v' are excluded. Important arguments to note are:

   -not means the negation of the expression that follows
   \( means the start of a complex expression.
   \) means the end of a complex expression.
   -o means a logical or of a complex expression.
      In this case the complex expression is all files like '*,v' or '.*,v'

for file in `find /opt \( -name error_log -o -name 'access_log' -o -name 'ssl_engine_log' -o -name 'rewrite_log' -o
-name 'catalina.out' \) -size +300000k -a -size -5000000k`; do cat /dev/null > $file; done

The units should be one of [bckw], 'b' means 512-byte blocks, 'c' means byte, 'k' means kilobytes and 'w' means 2-byte words. The size does not count indirect blocks, but it does count blocks in sparse files that are not actually allocated.
[edit]Operators

Operators can be used to enhance the expressions of the find command. Operators are listed in order of decreasing precedence:

    ( expr ) Force precedence.
    ! expr True if expr is false.
    -not expr Same as ! expr.
    expr1 expr2 And (implied); expr2 is not evaluated if expr1 is false.
    expr1 -a expr2 Same as expr1 expr2.
    expr1 -and expr2 Same as expr1 expr2.
    expr1 -o expr2 Or; expr2 is not evaluated if expr1 is true.
    expr1 -or expr2 Same as expr1 -o expr2.
    expr1 , expr2 List; both expr1 and expr2 are always evaluated. The value of expr1 is discarded; the value of the list is the value of expr2.

find . -name 'fileA_*' -or -name 'fileB_*'

This command searches files whose name has a prefix of "fileA_" or "fileB_" in the current directory.

find . -name 'foo.cpp' -not -path '.svn'

This command searches for files with the name "foo.cpp" in all subdirectories of the current directory (current directory itself included) other than ".svn".