|
|
| (111 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| {{DISPLAYTITLE:find}}
| | '''find''' - Dateien nach Eigenschaften suchen |
| | |
| '''find''' sucht Dateien nach Eigenschaften | |
|
| |
|
| == Beschreibung == | | == Beschreibung == |
| * find ist ein äußerst mächtiges Instrument zum Suchen von Dateien.
| | ; Werkzeug für die Suche nach Dateien |
| * Dabei kann man auf vielfältige Weise die Suche filtern, zum Beispiel nach Dateiname, -alter, -größe und die Suchergebnisse weiterverarbeiten und/oder formatiert ausgeben.
| | Auf vielfältige Weise die Suche filtern |
| | * Etwa Dateiname, -alter oder -größe |
| | * Formatierung der Ergebnisliste |
| | * Suchergebnisse können weiterverarbeitet werden |
|
| |
|
| === Implementierungen === | | === Implementierungen === |
| * Nicht alle Implementierungen von ''find'' sind gleich.
| | Nicht alle Implementierungen sind identisch |
| * Der Befehl ''find'' ist unter Linux etwas anders als auf BSDs, Solaris oder Mac OS X.
| |
| * Ein Großteil der Syntax von ''find'' ist gleich und kann auf allen Systemen verwendet werden, aber nicht vollständig.
| |
|
| |
|
| Bei Schwierigkeiten prüfen Sie die [[man]]-Page des Systems. | | * Der Befehl ''find'' ist unter Linux etwas anders als auf BSDs, Solaris oder Mac OS X |
| | * Ein Großteil der Syntax von ''find'' ist gleich und kann auf allen Systemen verwendet werden, aber nicht vollständig |
| | * Bei Schwierigkeiten prüfen Sie die [[man]]-Page des Systems |
|
| |
|
| $ '''find --version'''
| | <syntaxhighlight lang="bash" highlight="1" line copy> |
| find (GNU findutils) 4.4.2
| | find --version |
| | find (GNU findutils) 4.10.0 |
| | Aktivierte Eigenschaften:D_TYPE O_NOFOLLOW(enabled) LEAF_OPTIMISATION FTS(FTS_CWDFD) CBO(level=1) |
| | </syntaxhighlight> |
|
| |
|
| === Abgrenzung === | | === Abgrenzung === |
| {| class="wikitable sortable options" | | {| class="wikitable sortable options" |
| |- | | |- |
| ! Option !! Beschreibung | | ! Programm !! Beschreibung |
| | |- |
| | | [https://wiki.ubuntuusers.de/Terminal#Vervollstaendigen-lassen-nicht-tippen automatischer Vervollständigung] || |
| | |- |
| | | [[ls]] || Dateien auflisten |
| |- | | |- |
| | locate || | | | [[Jokerzeichen]] (''*'',''?'', ...) || |
| * Wenn man den Dateinamen genau kennt, kann [http://wiki.ubuntuusers.de/locate locate] eine bessere Wahl sein.
| |
| * locate arbeitet allerdings mit einem Index, der 1x täglich aktualisiert wird, und findet daher ganz frische Dateien nicht. | |
| |- | | |- |
| | whereis || Suche nach Programmen | | | [[locate]] || Suche nach Dateinamen |
| | * Schnell, da indexbasiert (täglich aktualisiert) |
| | * Findet nur Dateien, die im Index enthalten sind |
| |- | | |- |
| | Aktuelles Verzeichnis || | | | [[whereis]] || Suche nach Programmen |
| * [http://wiki.ubuntuusers.de/Terminal#Vervollstaendigen-lassen-nicht-tippen automatischer Vervollständigung]
| |
| * Jokerzeichen zum Beispiel ''*'' und ''?''
| |
| |- | | |- |
| | Weitere || Manche Programme bieten auch von sich aus an, Unterverzeichnisse zu berücksichtigen | | | [[grep]]|| Dateiinhalte durchsuchen |
| * [[ls]]
| |
| * [[grep]]
| |
| |} | | |} |
|
| |
|
| == Installation == | | == Installation == |
| # '''apt install findutils'''
| | ''find'' ist Teil des Pakets [[findutils]] |
|
| |
|
| == Anwendungen == | | == Aufruf == |
| === Fehlerbehebung === | | <syntaxhighlight lang="bash" highlight="1" line copy> |
| == Syntax ==
| | find [-H] [-L] [-P] [-D Fehlersuchoptionen] [-OStufe] [Startpunkt …] [Ausdruck] |
| $ '''find [-H] [-L] [-P] [-D Fehlersuchoptionen] [-OStufe] [Startpunkt …] [Ausdruck]'''
| | </syntaxhighlight> |
|
| |
|
| === Optionen === | | === Optionen === |
| | {| class="wikitable sortable options" |
| | |- |
| | ! Option !! Parameter !! Beschreibung |
| | |- |
| | | -H || || |
| | |- |
| | | -L || || |
| | |- |
| | | -P || || |
| | |- |
| | | -D || Fehlersuchoptionen || |
| | |- |
| | | -O || Stufe || |
| | |} |
| | |
| {| class="wikitable sortable options" | | {| class="wikitable sortable options" |
| |- | | |- |
| ! Option !! Beschreibung | | ! Option !! Beschreibung |
| |- | | |- |
| | -name dateiname||Sucht Dateien des Namens dateiname | | | -name || Sucht Dateien nach Dateinamen |
| |- | | |- |
| | -iname dateiname||Sucht nach dateiname und ignoriert Groß- und Kleinschreibung | | | -iname || Sucht nach Dateinamen und ignoriert Groß- und Kleinschreibung |
| |- | | |- |
| | -size [+-]groesse[ck]||Sucht Dateien, die größer oder kleiner als groesse sind. c steht für Byte- und k für KByte-Werte. Ohne Einheitsangabe wird nach der Anzahl der belegten Blöcke (512 Byte) gesucht | | | -size || Sucht Dateien, die größer oder kleiner als größer sind |
| |- | | |- |
| | -type [fdl]||Sucht Dateien eines bestimmten Typs: f für einfache Dateien, d für Verzeichnisse und l für symbolische Links | | | -type || Sucht Dateien eines bestimmten Typs |
| |- | | |- |
| | -atime [+-]zeit||Sucht Dateien, auf die seit mehr oder weniger als zeit Tagen nicht mehr zugegriffen wurde | | | -atime || Sucht Dateien, auf die seit mehr oder weniger als X Tagen nicht mehr zugegriffen wurde |
| |- | | |- |
| | -amin [+-]zeit||Sucht Dateien, auf die seit mehr oder weniger als zeit Minuten nicht mehr zugegriffen wurde | | | -amin || Sucht Dateien, auf die seit mehr oder weniger als X Minuten nicht mehr zugegriffen wurde |
| |- | | |- |
| | -mtime [+-]zeit||Sucht Dateien, die seit mehr oder weniger als zeit Tagen nicht mehr verändert wurden | | | -mtime || Sucht Dateien, die seit mehr oder weniger als X Tagen nicht mehr verändert wurden |
| |- | | |- |
| | -mmin [+-]zeit||Sucht Dateien, die seit mehr oder weniger als zeit Minuten nicht mehr verändert wurden | | | -mmin || Sucht Dateien, die seit mehr oder weniger als X Minuten nicht mehr verändert wurden |
| |- | | |- |
| | -perm 0000||Sucht Dateien mit den den Zugriffsrechten 0000 (Oktalzahl) | | | -perm || Sucht Dateien nach Zugriffsrechten |
| |- | | |- |
| | -user benutzername||Sucht Dateien des Benutzers benutzername | | | -user || Sucht Dateien des Benutzers Benutzername |
| |- | | |- |
| | -exec befehl „{}“ „;“||Führt befehl mit den gefunden Dateien als Parameter aus. Die geschweiften Klammern stehen für den aktuell gefunden Dateinamen | | | -inode || Sucht Dateien nach [[Inode]] |
| | |} |
| | |
| | {| class="wikitable sortable options" |
| |- | | |- |
| | -ok befehl „{}“ „;“||Führt befehl nach Rückfrage aus | | ! Option !! Beschreibung |
| | |- |
| | | -exec || Führt Befehl mit den gefundenen Dateien als Parameter aus |
| |- | | |- |
| | | -ok || Führt Befehl nach Rückfrage aus |
| |} | | |} |
|
| |
|
| === Parameter === | | === Argumente === |
| === Umgebungsvariablen === | | === Umgebungsvariablen === |
| === Exit-Status === | | === Exit-Status === |
|
| |
|
| == Konfiguration ==
| | <noinclude> |
| === Dateien ===
| |
| == Sicherheit ==
| |
| == Dokumentation ==
| |
| === RFC ===
| |
| === Man-Pages ===
| |
| === Info-Pages ===
| |
| == Siehe auch ==
| |
| # [[xargs]]
| |
|
| |
|
| == Links == | | == Anhang == |
| === Projekt-Homepage === | | === Siehe auch === |
| === Weblinks ===
| | {{Special:PrefixIndex/find}} |
| === Einzelnachweise ===
| | ---- |
| <references />
| | {{Special:PrefixIndex/xargs}} |
| == Testfragen ==
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 1''
| |
| <div class="mw-collapsible-content">'''Antwort1'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 2''
| |
| <div class="mw-collapsible-content">'''Antwort2'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 3''
| |
| <div class="mw-collapsible-content">'''Antwort3'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 4''
| |
| <div class="mw-collapsible-content">'''Antwort4'''</div>
| |
| </div>
| |
| <div class="toccolours mw-collapsible mw-collapsed">
| |
| ''Testfrage 5''
| |
| <div class="mw-collapsible-content">'''Antwort5'''</div>
| |
| </div>
| |
|
| |
|
| [[Kategorie:Entwurf]]
| | === Dokumentation === |
|
| |
|
| | ; Man-Page |
| | # [[chmod]](1) |
| | # [[locate]](1) |
| | # [[ls]](1) |
| | # [[xargs]](1) |
| | # [[lstat]](2) |
| | # [[stat]](2) |
| | # [[ctime]](3) |
| | # [[fnmatch]](3) |
| | # [[printf]](3) |
| | # [[strftime]](3) |
| | # [[regex]](7) |
| | # [[find]] (1) |
|
| |
|
| == Erweiterte Anwendungen == | | ;Info-Page |
| The “''‑print''” action lists the names of files separated by a newline.
| | === Links === |
| * But it is common to ''pipe'' the output of ''find'' into ''xargs'', which uses a space to separate file names.
| | ==== Projekt ==== |
| * This can lead to problems if any found files contain spaces in their names, as the output doesn't use any quoting.
| | ==== Weblinks ==== |
| * In such cases, when the output of ''find'' contains a file name such as “''foo bar''” and is piped into another command, that command “sees” two file names, not one file name containing a space.
| |
| * Even without using ''xargs'', you could have a problem if the file name contains a newline character, as most utilities expect one file name per line.
| |
| * In such cases, you can specify the action “''‑print0''” instead.
| |
| * This lists the found files separated not with a newline but with a ''null'' (or “”) character, which is not a legal character in Unix or Linux file names.
| |
| * Of course the command that reads the output of ''find'' must be able to handle such a list of file names.
| |
| * Many commands commonly used with ''find'' (such as ''tar'' or ''cpio'') have special options to read in file names separated with NULs instead of spaces.
| |
| * Instead of having ''find'' list the files, it can run some command for each file found, using the “''‑exec''” action.
| |
| * The ''‑exec'' is followed by some shell command line, ended with a semicolon (“'';</nowiki>''”).
| |
|
| |
|
| (The semicolon must be quoted from the shell, so ''find'' can see it!) Within that command line, the word “''{}''” will expand out to the name of the found file.
| | [[Kategorie:Linux/Befehl]] |
| * See below for some examples.
| | [[Kategorie:findutils]] |
| * You can use shell-style wildcards in the ''‑name'' search argument: find . -name foo\*bar
| |
| * This will search from the current directory down for ''foo*bar'' (that is, any filename that begins with ''foo'' and ends with ''bar'').
| |
| * Note that wildcards in the name argument must be quoted so the shell doesn't expand them before passing them to ''find''.
| |
| * Also, unlike regular shell wildcards, these will match leading periods in filenames. (For example “''find ‑name \*.txt''” would match “''.foo.txt''”.)
| |
| * You can search for other criteria beside the name.
| |
| * Also you can list multiple search criteria.
| |
| * When you have multiple criteria, any found files must match all listed criteria.
| |
| * That is, there is an implied Boolean ''AND'' operator between the listed search criteria. ''find'' also allows ''OR'' and ''NOT'' Boolean operators, as well as grouping, to combine search criteria in powerful ways (not shown here.)
| |
| * Here's an example using two search criteria: find / '''-type f -mtime -7''' | xargs tar -rf weekly_incremental.tar gzip weekly_incremental.tar
| |
| * will find any regular files (i.e., not directories or other special files) with the criterion “''‑type f''”, and only those modified seven or fewer days ago (“''‑mtime ‑7''”).
| |
| * Note the use of ''xargs'', a handy utility that coverts a stream of input (in this case the output of ''find'') into command line arguments for the supplied command (in this case ''tar'', used to create a backup archive).
| |
| * Using the ''tar'' option “''‑c''” is dangerous here; ''xargs'' may invoke ''tar'' several times if there are many files found, and each “''‑c''” will cause ''tar'' to over-write the previous invocation.
| |
| * The “''‑r''” option ''appends'' files to an archive.
| |
| * Other options such as those that would permit filenames containing spaces would be useful in a “production quality” backup script.
| |
| * Another use of ''xargs'' is illustrated below.
| |
| * This command will efficiently remove all files named ''core'' from your system (provided you run the command as root of course): find / -name core | xargs /bin/rm -f find / -name core -exec /bin/rm -f '{}' \; # same thing find / -name core -delete # same if using Gnu find</nowiki>
| |
| * The last two forms run the ''rm'' command once per file, and are not as efficient as the first form; but they are safer if file names contain spaces or newlines.
| |
| * The first form can be made safer if rewritten to use “''‑print0''” instead of (the default) “''‑print''”. “''‑exec''” can be used more efficiently (see [http://content.hccfl.edu/pollock/Unix/FindCmd.htm#exec Using ][http://content.hccfl.edu/pollock/Unix/FindCmd.htm#exec ‑exec][http://content.hccfl.edu/pollock/Unix/FindCmd.htm#exec Efficiently] below), but doing so means running the command once with many file names passed as arguments, and so has the same safety issues as with ''xargs''.
| |
| * One of my favorite of the ''find'' criteria is used to locate files modified less than 10 minutes ago.
| |
| * I use this right after using some system administration tool, to learn which files got changed by that tool: find / -mmin -10
| |
| * This search is also useful when I've downloaded some file but can't locate it, only in that case “''‑cmin''” may work better.
| |
| * Keep in mind neither of these criteria is standard; “''‑mtime''” and “''‑ctime''” are standard, but use days and not minutes.
| |
| * Another common use is to locate all files owned by a given user (“''‑user ''''username''”).
| |
| * This is useful when deleting user accounts.
| |
| * You can also find files with various permissions set. “''‑perm /''''permissions''” means to find files with '''any''' of the specified ''permissions'' on, “''‑perm -''''permissions''” means to find files with '''all''' of the specified ''permissions'' on, and “''‑perm ''''permissions''” means to find files with '''exactly''' ''permissions''. ''Permissions'' can be specified either symbolically (preferred) or with an octal number.
| |
| * The following will locate files that are writable by “others” (including symlinks, which should be writable by all): find . -perm -o=w
| |
|
| |
|
| (Using ''‑perm'' is more complex than this example shows.
| | {{DEFAULTSORT:find}} |
| * You should check both the [http://www.opengroup.org/onlinepubs/9699919799/utilities/find.html#tag_20_47_04 POSIX documentation for ][http://www.opengroup.org/onlinepubs/9699919799/utilities/find.html#tag_20_47_04 find] (which explains how the symbolic modes work) and the [http://www.gnu.org/software/findutils/manual/html_mono/find.html#Overview Gnu ][http://www.gnu.org/software/findutils/manual/html_mono/find.html#Overview find][http://www.gnu.org/software/findutils/manual/html_mono/find.html#Overview man page] (which describes the Gnu extensions).
| | {{DISPLAYTITLE:find}} |
| * When using ''find'' to locate files for backups, it often pays to use the “''‑depth''” option (really a criterion that is always true), which forces the output to be ''depth-first''—that is, files first and then the directories containing them.
| |
| * This helps when the directories have restrictive permissions, and restoring the directory first could prevent the files from restoring at all (and would change the time stamp on the directory in any case).
| |
| * Normally, ''find'' returns the directory first, before any of the files in that directory.
| |
| * This default behavior is useful when using the “''‑prune''” action to prevent ''find'' from examining any files you want to ignore:
| |
| * find / -name /dev -prune ...''other criteria'' | xargs tar ...
| |
| * Using just “''find / ‑name /dev ‑prune | xargs tar ...''” won't work as most people might expect.
| |
| * This says to only find files named “''/dev''”, and then (if a directory) don't descend into it. So you only get the single directory name “''/dev''”! A better plan is to use the following: find / ! -path /dev\* |xargs ...
| |
| * which says find everything except pathnames that start with “''/dev''”. The “''!''” means Boolean ''NOT''.
| |
| * When specifying time with ''find'' options such as ''‑mmin'' (minutes) or ''‑mtime'' (24 hour periods, starting from now), you can specify a number “''n''” to mean exactly ''n'', “''‑n''” to mean less than ''n'', and “''+n''” to mean more than ''n''.
| |
| * Fractional 24-hour periods are truncated! That means that “''find ‑mtime +1''” says to match files modified '''two or more days ago.'''
| |
| * For example: find . -mtime 0 # find files modified between now and 1 day ago</nowiki> # (i.e., within the past 24 hours)</nowiki> find . -mtime -1 # find files modified less than 1 day ago</nowiki> # (i.e., within the past 24 hours, as before)</nowiki> find . -mtime 1 # find files modified between 24 and 48 hours ago</nowiki> find . -mtime +1 # find files modified more than 48 hours ago</nowiki> find . -mmin +5 -mmin -10 # find files modified between # 6 and 9 minutes ago</nowiki>
| |
| | |
| === Find und Sort ===
| |
| $ '''find -type f -print0 | xargs -0 stat -c "%y %n" | sort -r | head -20'''
| |
| | |
| ===== Sort by size=====
| |
| $ '''find -type f -exec ls -ltu {} \; | sort -k 5 -n'''
| |
| | |
| ===== Sort by access time=====
| |
| $ '''find -type f -exec ls -ltu {} \; | sort -k 6 -M'''
| |
| | |
| ===== Search recursively by date=====
| |
| $ '''find -printf "%TY-%Tm-%Td %TT %p\n" | tail -20 | sort -n'''
| |
| * Have you ever wanted to view a list of all files or subdirectories within a directory in Linux and order them by when they were last changed or modified? Then you have come to the right place! Here we are going to provide and explain some useful commands that when piped together will give us this result, allowing us to recursively list files and directories by date.
| |
| * This is one of my favourite commands to use when trying to build a timeline of events, for instance if a server or website has been compromised and you want to see when files have been modified with malicious content. By seeing other files that were modified around the same time you can get a better idea of what took place and when, allowing you to correlate these events with your logs.
| |
| | |
| ====== The Commands ======
| |
| * So here are the simple commands piped together, run this within a directory and you will be provided with a list of all files and subdirectories along with the date they were last modified.
| |
| * The most recently changed contents will be at the bottom of the list, so after running it you’ll see the most recent changes with the older changes as you scroll up.
| |
| * If you have a lot of output piping the whole lot into ‘less’ may be a good idea so that you can easily scroll through.
| |
| $ '''find . -printf '%T@ %t %p\n' | sort -k 1 -n | cut -d' ' -f2-'''
| |
| * Below is an example output from running this full command. '''
| |
| | |
| $ '''find . -printf '%T@ %t %p\n' | sort -k 1 -n | cut -d' ' -f2-'''
| |
| Wed Aug 26 09:25:04.0000000000 2015 ./images/1.jpg
| |
| Tue Sep 1 06:27:43.0000000000 2015 ./1.JPG
| |
| Sat Sep 12 12:36:51.0000000000 2015 ./directory/6.jpg
| |
| Sat Sep 12 12:43:48.0166880221 2015 ./directory
| |
| Mon Oct 12 05:18:21.0000000000 2015 ./images/7.jpg
| |
| Sun Oct 18 08:29:46.0000000000 2015 ./8.jpg
| |
| Wed Oct 21 10:50:16.0672628610 2015 ./index.html
| |
| * As shown we can see the files sorted from oldest date and time modified to newest. Now let’s break down what each part is actually doing for us.
| |
| | |
| ======= [http://linux.die.net/man/1/find Find] =======
| |
| First off the find command is run which finds us the list of all files and subdirectories recursively within the current working directory, as specified by the “.” after the find command. To confirm your current working directory you can run the “pwd” command. You can change the “.” to a full directory path instead to list all files and subdirectories in there instead if required, this way you don’t have to be in the directory.
| |
| * The “-printf” flag is used to print the output in the format specified, in this case this is ‘%T@ %t %p\n’. The %T@ displays the epoch time, that is the amount of seconds since the 1st of January 1970, the %t shows the files last modification time, the %p displays the files name while \n is simply a new line so that each result in our output shows up on a new line which makes it easier to read and work with.
| |
| * It is worth noting that you could also replace %t with %c, which will instead use the files last status change time rather than the modification time. This should show things such as permission changes which don’t actually modify the contents file but change the metadata.
| |
| * The output of this find command alone looks like this. 1445424616.6726286100 Wed Oct 21 10:50:16.0672628610 2015 ./index.html
| |
| * At this stage the output does not display in any sort of chronological order. We can see the output displayed as expected, the files epoch time followed by the last modification date and time, followed by the file name.
| |
| | |
| ======= [http://linux.die.net/man/1/sort Sort] =======
| |
| Now with this output you may have noticed that there is no order applied, this is taken care of with the sort command. The -k flag specifies a start position which in this case is 1, the first column being the epoch time.
| |
| * The output with the sort is shown below, now we have the files in the same order as the output of the full command string shown previously after sorting by column 1, the epoch time. As the epoch time is all numbers, we also use -n to perform a numerical based sort. 1440581104.0000000000 Wed Aug 26 09:25:04.0000000000 2015 ./images/1.jpg 1441088863.0000000000 Tue Sep 1 06:27:43.0000000000 2015 ./1.JPG 1442061411.0000000000 Sat Sep 12 12:36:51.0000000000 2015 ./directory/6.jpg 1442061828.1668802210 Sat Sep 12 12:43:48.0166880221 2015 ./directory 1444627101.0000000000 Mon Oct 12 05:18:21.0000000000 2015 ./images/7.jpg 1445156986.0000000000 Sun Oct 18 08:29:46.0000000000 2015 ./8.jpg 1445424616.6726286100 Wed Oct 21 10:50:16.0672628610 2015 ./index.html
| |
| * We can change -n to -nr which will reverse the output, resulting in the oldest modified files showing at the bottom of the output, rather than the newest.
| |
| | |
| ======= [http://linux.die.net/man/1/cut Cut] =======
| |
| Now that we have our sorted output we use the cut command to tidy up and print out a more specific selection. By specifying a delimiter with -d of ‘ ‘ we find the first white space which comes after the epoch time and cut everything afterwards.
| |
| * At this point we now have the complete output which lists all files by date recursively from the specified directory. The epoch time provided an easy way to perform the sort, but we don’t really need to see that in the final output as it isn’t particularly human readable so it’s been removed after the sort.
| |
| | |
| ====== Other Options ======
| |
| Of course you can always use the much simpler “ls -lrt” within a directory to view all files within the current working directory from oldest to newest, however this does not take into consideration subfolder contents. Even if we use the recursive option and use “ls -lRrt” we only see the files ordered based on the dates within each directory and not a combination of all subdirectories.
| |
| * If you aren’t interested in the subdirectories themselves you could also add a “-type f” to the find command which will only list files, as shown below. find . '''-type f''' -printf '%T@ %t %p\n' | sort -k 1 -n | cut -d ' ' -f2-
| |
| * This still lists files within subdirectories, it simply no longer also shows the subdirectory names themselves in the output.
| |
| * The opposite can also be done, by using “-type d” which will display only directories and no files. find . '''-type d''' -printf '%T@ %t %p\n' | sort -k 1 -n | cut -d ' ' -f2-
| |
| | |
| ====== Summary ======
| |
| By combining a few relatively simple bash commands in Linux we have been able to successfully list all files and subdirectories within a specified directory recursively by their modification or change date, in either ascending or descending order. We can also optionally specify to only view files or directories in the output.
| |
| * This command is a great way of building a timeline of events as the chronological output allows us to see the order of file modifications, regardless of where the file is actually located.
| |
| | |
| ====== Quelle ======
| |
| * https://www.rootusers.com/how-to-search-all-files-by-date-recursively-in-linux/
| |
| | |
| ===== Weitere Lösungen=====
| |
| $ '''find -type f -printf '%T@ %p\0' | sort -zk 1nr | sed -z 's/^[^ ]* //' | tr '\0' '\n' | head -n 10 find -type f -printf '%T@ %p\n' | sort -k1 -n find -type f -print0 | xargs -0 stat -c "%y %n" | sort find -type f -print0 | xargs -0 stat -f "%m %Sm %N" | sort -rn'''
| |
| If you have not GNU utilities, you could use newlines as separators instead of nulls, but you'll lose support for filenames containing newlines.
| |
| | |
| $ '''find -type f -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' '''
| |
| | |
| ==== Compare Filetree====
| |
| $ '''find directory1 -type d -printf "%P\n" | sort > file1 find directory2 -type d -printf "%P\n" | sort | diff – file1'''
| |
| | |
| === Typische Probleme ===
| |
| ''' Find ohne Ende '''
| |
| | |
| Wenn die Suche mit find läuft und viel zu viele Ergebnisse ausspuckt und nicht aufhören will, so bricht man find mit Strg + C ab.
| |
| | |
| ''' Pfad muss vor Suchkriterium stehen '''
| |
| | |
| Wenn man den Stern ''*</nowiki>'' nicht maskiert kommt es oft zu folgender Meldung: find /tmp -name *sh find: Der Pfad muß vor dem Suchkriterium stehen: adhoc.sh Aufruf: find [-H] [-L] [-P] [-Olevel] [-D help|tree|search|stat|rates|opt|exec] [Pfad...] [Suchkriterium]
| |
| * Mit find /tmp -name "*sh"
| |
| * ist das leicht geheilt.
| |
| | |
| ''' Seltsame Größen '''
| |
| | |
| Bei der Suche nach Dateigrößen kann man leicht verzweifeln, wenn man nicht dahinter kommt, dass die Vorgabemaßeinheit Blöcke zu 512 Bytes sind. find -size 200c
| |
| * sucht nach Größen, die man vom Dezimalsystem her erwartet.
| |
| | |
| ==== Seltsames Nichtfinden bei Größen wie k, M, G ====
| |
| | |
| Sucht man nach Dateien, die kleiner sind als 1000k, so werden Dateien bis maximal 999k gefunden: find -size -1000k
| |
| * Das klingt zunächst plausibel, aber es wird keine Datei gefunden, die 999001 Bytes groß ist, denn es wird erst aufgerundet (auf 1000k) und dann verglichen (nicht kleiner als 1000k).
| |
| * Krasser noch, wenn man Dateien bis 1M suchen wollte - selbst 1 Byte ist größer als die nächstkleinere Ganzzahl in dieser Maßeinheit, also größer als 0M, und wird daher nicht gefunden.
| |
| | |
| ''' Kombination von UND und ODER '''
| |
| | |
| Bei der Kombination von mehreren Optionen mit UND und ODER helfen Klammern Fehler zu vermeiden.
| |
| | |
| ''' Positionssensitiv '''
| |
|
| |
|
| Bei mehreren Optionen und Ausdrücken (options und expressions) unterscheiden sich erstere von zweiteren dadurch, dass Optionen nicht mit 'ODER' gruppiert werden können - die Optionen werden immer für die ganze Suche verwendet.
| | </noinclude> |
| * Stehen die Optionen hinter Ausdrücken, so sieht das aus, als habe der User eine andere Absicht gehabt, und man bekommt eine Warnung:
| |
| * Folgende Meldung erhält man, wenn man Optionen nach Argumenten benutzt. find tmp -name "a" -maxdepth 3 -mindepth 3 find: Warnung: Sie haben die Option `-maxdepth` nach dem Argument -name angegeben, aber Optionen sind nicht positionssensitiv (`-maxdepth` beeinträchtigt sowohl Tests, die vor ihr als auch nach ihr definiert sind). Diese Optionen ist vor den anderen Argumenten anzugeben.
| |
| * Provozieren kann man die Warnung etwa so: find ./suchverzeichnis -maxdepth 4 -name foo -or -maxdepth 2
| |
| | |
| ''' Xargs und Schleifen '''
| |
| | |
| Oft findet man Konstruktionen mit ''find ... xargs'' oder Shellschleifen die find bemühen.
| |
| * Fast immer lässt sich das Problem durch eine der [http://wiki.ubuntuusers.de/find#Aktionen Aktionen] (-okdir, -execdir, ...) eleganter lösen.
| |
| | |
| ''' Aktion -delete an falscher Stelle '''
| |
| | |
| So löscht zum Beispiel der folgende Aufruf den kompletten Inhalt des Ordners '''/home/otto/''': find /home/otto/ -delete -name Cache
| |
| | |
| ''' Common “Gotcha” '''
| |
| | |
| If the given expression to ''find'' does not contain any of the “action” primaries ''‑exec'', ''‑ok'', or ''‑print'', the given expression is effectively replaced by: find \( ''expression'' \) -print
| |
| * The implied parenthesis can cause unexpected results. For example, consider these two similar commands: '''find -name tmp -prune -o -name \*.txt''' ./bin/data/secret.txt ./tmp ./missingEOL.txt ./public_html/graphics/README.txt ./datafile.txt '''find -name tmp -prune -o -name \*.txt -print''' ./bin/data/secret.txt ./missingEOL.txt ./public_html/graphics/README.txt ./datafile.txt
| |
| * The lack of an action in the first command means it is equivalent to: find . \( -name tmp -prune -o -name \*.txt \) -print
| |
| * This causes ''tmp'' to be included in the output. However for the second ''find'' command the normal rules of Boolean operator precedence apply, so the pruned directory does not appear in the output.
| |
| * A related issue is the precedence of the Boolean operators. OR has lower precedence than AND, and NOT has the highest precedence. When in any doubt, add parenthesis to your expressions.
| |
| * The ''find'' command can be amazingly useful. See the man page to learn all the criteria and actions you can use.
| |
| | |
| ''' -regex '''
| |
| | |
| I'm having trouble using the regex of the ''find'' command. Probably something I don't understand about escaping on the command line.
| |
| * Why are these not the same?
| |
| find -regex '.*[1234567890]'
| |
| find -regex '.*[[:digit:]]'
| |
| | |
| * Regular expressions with character classes (e.g. ''[[:digit:]]</nowiki>'') are not supported in the default regular expression syntax used by ''find''.
| |
| * You need to specify a different regex type such as ''posix-extended'' in order to use them.
| |
| * Take a look at GNU Find's Regular Expression [http://www.gnu.org/software/findutils/manual/html_mono/find.html#Regular-Expressions documentation] which shows you all the regex types and what they support.
| |
| * I have some images named with generated uuid1 string.
| |
| * For example 81397018-b84a-11e0-9d2a-001b77dc0bed.jpg.
| |
| * I want to find out all these images using "find" command: find . -regex "[a-f0-9\-]\{36\}\.jpg".
| |
| * But it doesn't work. Something wrong with the regex? Could someone help me with this? find . -regextype sed -regex ".*/[a-f0-9\-]\{36\}\.jpg"
| |
| * Note that you need to specify ''.*/'' in the beginning because ''find'' matches the whole path.
| |
| | |
| ''' Beispiel '''
| |
| | |
| '''$ find . -name "*.jpg"'''
| |
| ./foo-111.jpg ./test/81397018-b84a-11e0-9d2a-001b77dc0bed.jpg ./81397018-b84a-11e0-9d2a-001b77dc0bed.jpg
| |
| | |
| '''$ find . -regextype sed -regex ".*/[a-f0-9\-]\{36\}\.jpg"'''
| |
| ./test/81397018-b84a-11e0-9d2a-001b77dc0bed.jpg ./81397018-b84a-11e0-9d2a-001b77dc0bed.jpg
| |
| | |
| '''$ find . -regextype foo -regex ".*/[a-f0-9\-]\{36\}\.jpg"'''
| |
| find: Unknown regular expression type `foo'; valid types are `findutils-default', `awk', `egrep', `ed', `emacs', `gnu-awk', `grep', `posix-awk', `posix-basic', `posix-egrep', `posix-extended', `posix-minimal-basic', `sed'.
| |
| | |
| [[Kategorie:Linux:Befehl]]
| |
| [[Kategorie:Linux:Suchen]]
| |
| [[Kategorie:Linux:Dateisystem]]
| |
| [[Kategorie:Regex]]
| |
| | |
| {{DEFAULTSORT:find}}
| |