Christopher Negus - Linux Bible

Here are a few things that you should know about searching for files using the locatecommand:

There are advantages and disadvantages to using locate to find filenames instead of the find command. A locate command finds files faster because it searches a database instead of having to search the whole filesystem live. A disadvantage is that the locate command cannot find any files added to the system since the previous time the database was updated.

Not every file in your filesystem is stored in the database. The contents of the /etc/updatedb.conf file limit which filenames are collected by pruning out select mount types, filesystem types, file types, and mount points. For example, filenames are not gathered from remotely mounted filesystems (cifs, nfs, and so on) or locally mounted CDs or DVDs (iso9660). Paths containing temporary files (/tmp) and spool files (/var/spool/cups) are also pruned. You can add items to prune (or remove some items that you don't want pruned) the locate database to your needs. In RHEL 8, the updatedb.conf file contains the following:PRUNE_BIND_MOUNTS = "yes" PRUNEFS = "9p afs anon_inodefs auto autofs bdev binfmt_misc cgroup cifs coda configfs cpuset debugfs devpts ecryptfs exofs fuse fuse.sshfs fusectl gfs gfs2 gpfs hugetlbfs inotifyfs iso9660 jffs2 lustre mqueue ncpfs nfs nfs4 nfsd pipefs proc ramfs rootfs rpc_pipefs securityfs selinuxfs sfs sockfs sysfs tmpfs ubifs udf usbfs ceph fuse.ceph" PRUNENAMES = ".git .hg .svn .bzr .arch-ids {arch} CVS" PRUNEPATHS = "/afs /media /mnt /net /sfs /tmp /udev /var/cache/ccache /var/lib/yum/yumdb /var/lib/dnf/yumdb /var/spool/cups /var/spool/squid /var/tmp /var/lib/ceph" As a regular user, you can't see any files from the locate database that you can't see in the filesystem normally. For example, if you can't type ls to view files in the /root directory, you can't locate files stored in that directory.

When you search for a string, the string can appear anywhere in a file's path. For example, if you search for passwd, you could turn up /etc/passwd, /usr/bin/passwd, /home/chris/passwd/pwdfiles.txt, and many other files with passwd in the path.

If you add files to your system after updatedb runs, you can't locate those files until updatedb runs again (probably that night). To get the database to contain all files up to the current moment, you can simply run updatedb from the shell as root.

Here are some examples of using the locatecommand to search for files:

$ locate .bashrc /etc/skel/.bashrc /home/cnegus/.bashrc # locate .bashrc /etc/skel/.bashrc /home/bill/.bashrc /home/joe/.bashrc /root/.bashrc

When run as a regular user, locateonly finds .bashrcin /etc/skeland the user's own home directory. Run as root, the same command locates .bashrcfiles in everyone's home directory.

$ locate dir_color /usr/share/man/man5/dir_colors.5.gz … $ locate -i dir_color /etc/DIR_COLORS /etc/DIR_COLORS.256color /etc/DIR_COLORS.lightbgcolor /usr/share/man/man5/dir_colors.5.gz

Using locate -i, filenames are found regardless of case. So in the previous example, DIR_COLORSwas found with -iwhereas it wasn't found without the -ioption.

$ locate services /etc/services /usr/share/services/bmp.kmgio /usr/share/services/data.kmgio

Unlike the findcommand, which uses the -nameoption to find filenames, the locatecommand locates the string you enter if it exists in any part of the file's path. In this example, searching for servicesusing the locatecommand finds files and directories containing the servicestext string.

The findcommand is the best one for searching your filesystem for files based on a variety of attributes. After files are found, you can act on those files as well (using the -execor -okayoption) by running any commands you want on them.

When you run find, it searches your filesystem live, which causes it to run slower than locate, but it gives you an up-to-the-moment view of the files on your Linux system. However, you can also tell findto start at a particular point in the filesystem so that the search can go faster by limiting the area of the filesystem being searched.

Nearly any file attribute that you can think of can be used as a search option. You can search for filenames, ownership, permission, size, modification times, and other attributes. You can even use combinations of attributes. Here are some basic examples of using the findcommand:

$ find $ find /etc # find /etc $ find $HOME -ls

Run on a line by itself, the findcommand finds all files and directories below the current directory. If you want to search from a particular point in the directory tree, just add the name of the directory you want to search (such as /etc). As a regular user, finddoes not give you special permission to find files that have permissions that make them readable only by the root user. So, findproduces a bunch of error messages. Run as the root user, find /etcfinds all files under /etc.

A special option to the findcommand is -ls. A long listing (ownership, permission, size, and so on) is printed with each file when you add -lsto the findcommand (similar to output of the ls -lcommand). This option helps you in later examples when you want to verify that you have found files that contain the ownership, size, modification times, or other attributes that you are trying to find.

If, as a regular user, you are searching an area of the filesystem where you don't have full permission to access all of the files it contains (such as the /etcdirectory), you might receive lots of error messages when you search with find. To get rid of those messages, direct standard errors to /dev/null. To do that, add the following to the end of the command line: 2> /dev/null. The 2>redirects standard error to the next option (in this case /dev/null, where the output is discarded).

To find files by name, you can use the -nameand -inameoptions. The search is done by base name of the file; the directory names are not searched by default. To make the search more flexible, you can use file-matching characters, such as asterisks ( *) and question marks ( ?), as in the following examples:

# find /etc -name passwd /etc/pam.d/passwd /etc/passwd # find /etc -iname '*passwd*' /etc/pam.d/passwd /etc/passwd- /etc/passwd.OLD /etc/passwd /etc/MYPASSWD /etc/security/opasswd

Using the -nameoption and no asterisks, the first example above lists any files in the /etcdirectory that are named passwdexactly. By using -inameinstead, you can match any combination of upper- and lowercase. Using asterisks, you can match any filename that includes the word passwd.

If your disk is filling up and you want to find out where your biggest files are located, you can search your system by file size. The -sizeoption enables you to search for files that are exactly, smaller than, or larger than a selected size, as you can see in the following examples:

$ find /usr/share/ -size +10M $ find /mostlybig -size -1M $ find /bigdata -size +500M -size -5G -exec du -sh {} \; 4.1G /bigdata/images/rhel6.img 606M /bigdata/Fedora-16-i686-Live-Desktop.iso 560M /bigdata/dance2.avi