Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
HP-UX Reference > F

find(1)

HP-UX 11i Version 3: February 2007
» 

Technical documentation

» Feedback
Content starts here

 » Table of Contents

 » Index

NAME

find — find files

SYNOPSIS

find [-H|-L] pathname_list [expression]

DESCRIPTION

The find command recursively descends the directory hierarchy for each path name in pathname_list (that is, one or more path names) seeking files that match a Boolean expression written in the primaries given below. By default, find does not follow symbolic links; see Options.

The Boolean expression is evaluated using short-circuit evaluation. This means that whenever the result of a Boolean operation (AND or OR) is known from evaluating the left-hand argument, the right-hand argument is not evaluated.

In the descriptions of the primaries, the argument n represents a decimal integer; +n means more than n, -n means less than n, and n means exactly n.

Options

The find command recognizes the following options:

-H

For each symbolic link specified in pathname_list on the command line, the find command evaluates the file information and file type of the file referenced by the symbolic link, and not the link itself. If the file referenced by symbolic link does not exist, the find command evaluates the file information and file type for the link itself. For all symbolic links not on command line, the find command evaluates the file information and file type for the link itself.

-L

For each symbolic link specified on the command line in pathname_list or encountered in the file hierarchy, the find command evaluates the file information and file type of the file referenced by symbolic link, and not the link itself.

Primaries

The find command recognizes the following primaries which are used in the Boolean expression:

-atime n

True if the file access time subtracted from the initialized time is n-1 to n multiples of 24 h. The initialization time shall be a time between the invocation of the find utility and the first access by that invocation of the find utility to any file specified by its path operands. The access time of directories in pathname_list is changed by find itself.

-cpio device

Write the current file on device in cpio(4) format (5120-byte records). The use of -cpio implies -depth. Always true.

-ctime n

True if the time of last change of file status information subtracted from the initialization time is n-1 to n multiples of 24 h. The initialization time shall be a time between the invocation of the find utility and the first access by that invocation of the find utility to any file specified by its path operands.

-depth

A position-independent term which causes descent of the directory hierarchy to be done so that all entries in a directory are acted on before the directory itself. This can be useful when find is used with cpio (see cpio(1)) to transfer files that are contained in directories without write permission. It is also useful when using cpio and the modification dates of directories must be preserved. Always true.

-exec cmd

True if the executed cmd returns a zero value as exit status. The end of cmd must be punctuated by a semicolon (;) or a plus sign (+). The semicolon and plus are special to the shell and must be escaped with a backslash (\). When + is used, cmd aggregates a set of path names and executes on the set. Any command arguments between the first occurrence of curly braces {} and plus sign + are ignored. In the UNIX 2003 environment, + indicates end of cmd, only if + immediately follows {}. The reason for preferring + to a ; is improved performance. With the ;, the command in -exec cmd executes for each match that the command finds. However, with {} +, the command executes only once.

Any command argument {} is replaced by the current path name. cmd may contain supplementary code set characters.

This example shows the difference between using ; and +. Two directories each have a file called, hello. Directory one has one file:

$ls /one hello

Directory /my/project/directory has three files:

$ ls /my/project/directory hello hi hummm

The following find commands search for the file named hello in the directories:

$ find /one /my/project/directory -name hello -exec echo hi {} \+ hi /one/hello /my/project/directory/hello $ find /one /my/project/directory -name hello -exec echo hi \; hi hi

When {} + is in the find command, echo hi executes only once. When ; is in the find command, echo hi executes for each match.

-follow

A position-independent term which causes find to follow symbolic links. When following symbolic links, find keeps track of the directories visited so that it can detect infinite loops; for example, such a loop would occur if a symbolic link pointed to an ancestor. This expression should not be used with the -type l Expression. Always true.

-fsonly FStype

A position-independent term which causes find to stop descending any directory whose file system is not of the type specified by FStype, where FStype is one of cdfs, hfs, vxfs, or nfs, representing the CDFS, HFS, JFS (VXFS), or NFS file system type, respectively.

In this context, mount points inherit the FStype of their parent directory. This means that when -fsonly hfs has been specified and find encounters an NFS mount point that is mounted on an HFS file system, the mount point will be visited but entries below that mount point will not. It is important to note that when -fsonly nfs has been specified, any HFS file systems that are beneath the mount point of an NFS file system are not traversed. Always true.

-fstype FStype

True if the file system to which the file belongs is of type FStype, where FStype is one of cdfs, hfs, nfs, or vxfs corresponding to the CDFS, HFS, NFS, or JFS (VXFS) file system type, respectively.

-group gname

True if the file belongs to the group gname. If gname is numeric and does not appear in the /etc/group file, it is taken as a group ID. The gname operand can be preceded by a + or - to modify the comparison of the primaries. If the argument n represents a decimal integer; +n means more than n, -n means less than n, and n means exactly n.

-inum n

True if the file serial number (inode number) is n. Note that file serial numbers are unique only within a given file system. Therefore, matching file serial numbers does not guarantee that the referenced files are the same unless you restrict the search to a single file system.

-linkedto path

True if the file is the same physical file as the file specified by path (i.e., linked to path). This primary is similar to -inum, but correctly detects when a file is hard-linked to path, even when multiple file systems are searched.

-links n

True if the file has n links.

-local

True if the file physically resides on the local system. This does not restrict the search to only files which physically reside on the local system, it merely matches such files. See EXAMPLES.

-mountstop

Identical to -xdev. This primary is provided for backward compatibility only. -xdev is preferred over -mountstop.

-mtime n

True if the file modification time subtracted from the initialization time is n-1 to n multiples of 24 h. The initialization time shall be a time between the invocation of the find utility and the first access by that invocation of the find utility to any file specified in its path operands.

-name file

True if pattern file matches the last component of the current file name. Pattern is matched according to Pattern Matching Notation for file name expansion. Pattern should be escaped (using backslash) or quoted when find is invoked from the shell, to prevent the shell from expanding any metacharacters. Pattern may contain supplementary code set characters.

-ncpio

Same as -cpio but adds the -c option to cpio. The use of -ncpio implies -depth. Always true.

-newer file

True if the current file has been modified more recently than the argument file.

-newer[tv1[tv2]] file

True if the indicated time value (tv1) of the current file is newer than the indicated time value (tv2) of file. The time values tv1 and tv2 are each selected from the set of characters:

a

The time the file was last accessed

c

The time the inode of the file was last modified

m

The time the file was last modified

If the tv2 character is omitted, it defaults to m. Note that the -newer option is equivalent to -newermm.

Syntax examples;

-newera file -newermc file

-nogroup

True if the file belongs to a group ID that is not listed in the group database. See group(4).

-nouser

True if the file belongs to a user ID that is not listed in the password database. See passwd(4).

-ok cmd

Same as -exec except that the generated command line is printed with a question mark first, and is executed only if the user responds by typing y. The form of the affirmative response is locale dependent: y in the C locale, see LANG on environ(5). The end of cmd must be punctuated by a semicolon (;) (semicolon is special to the shell and must be escaped). cmd may contain supplementary code set characters.

-only

This is a positive-logic version of -prune. A -prune is performed after every directory, unless -only is successfully evaluated for that directory. As an example, the following three commands are equivalent:

find . -fsonly hfs -print find . -print -fstype hfs -only find . -print ! -fstype hfs -prune

Note, however, that -only is useless if the -depth option has also been given. Always true.

-path file

Same as -name except the full path (as would be output by -print) is used instead of just the base name. Note that / characters are not treated as a special case. For example, */.profile matches ./home/fred/.profile.

-print

Causes the current path name to be printed followed by a newline character. Always true.

-print0

Causes the current path name to be printed followed by a null character. Always true.

-perm [-]mode

In this primary, the argument mode is used to represent file mode bits. The argument is identical in format to the mode operand as described in chmod(1), with the exception that the first character must not be the - operator. When using the symbolic form of mode, the starting template is assumed to have all file mode bits cleared.

If the leading minus is omitted, this primary is true when the file permission bits exactly match the value of mode. Bits associated with the symbolic attributes s (set-user-ID, set-group-ID) and t (sticky bit) are ignored when the minus is omitted.

If mode is preceded by a minus, this primary is true if all of the bits that are set in mode are also set in the file permission bits. In this case, the bits associated with the symbolic attributes s and t are significant.

-prune

If the current entry is a directory, cause find to skip that directory. This can be useful to avoid walking certain directories, or to avoid recursive loops when using cpio -p. Note, however, that -prune is useless if the -depth option has also been given. See the description of -only and the EXAMPLES section, below, for more information. Always true.

-size n[c]

True if the file is n blocks long (512 bytes per block). If n is followed by a c, the size is in bytes.

-type c

True if the type of the file is c, where c is one of the following:

b

Block special file

c

Character special file

d

Directory

f

Regular file

l

Symbolic link

M

Mount point

n

Network special file

p

FIFO (named pipe)

s

Socket

-user uname

True if the file belongs to the user uname. If uname is numeric and does not appear as a login name in the /etc/passwd file, it is taken as a user ID. The uname operand can be preceded by a + or - to modify the comparison of the primaries. If the argument n represents a decimal integer; +n means more than n, -n means less than n, and n means exactly n.

-xdev

A position-independent term that causes find to avoid crossing any file system mount points that exist below starting points enumerated in pathname_list. The mount point itself is visited, but entries below the mount point are not. Always true.

( expression )

True if the parenthesized expression is true. The spaces are required. Parentheses are special to the shell and must be escaped, as in \( and \).

Primaries can be combined by using the following operators (in order of decreasing precedence):

expression [-a] expression

Logical AND operator. True if both of the expressions are true.

expression -o expression

Logical OR operator. True if either or both of the expressions are true.

! expression

Logical NOT operator. True if expression is not true.

If expression is omitted, or if none of -print, -print0, -ok, -exec, -cpio, or -ncpio is specified, -print is assumed. The -user, -group, and -newer primaries each evaluate their respective arguments once.

HFS Access Control Lists

The -acl primary enables the user to search for HFS access control list entries. It is true if the file's access control list matches an access control list pattern or contains optional access control list entries (see acl(5)). It has three forms:

-acl aclpatt

Match all files whose access control list includes all (zero or more) pattern entries specified by the aclpatt pattern.

-acl =aclpatt

Match a file only if its access control list includes all (zero or more) pattern entries specified by the aclpatt pattern, and every entry in its access control list is matched by at least one pattern entry specified in the aclpatt pattern.

-acl opt

Match all files containing optional access control list entries.

The aclpatt string can be given as an operator or short form pattern; see acl(5).

By default, -acl is true for files whose access control lists include all the (zero or more) access control list patterns in aclpatt. A file's access control list can also contain unmatched entries.

If aclpatt begins with =, the remainder of the string must match all entries in a file's access control list.

The aclpatt string (by default, or the part following =) can be either an access control list or an access control list pattern. However, if it is an access control list, aclpatt must include at least the three base entries ((user.%, mode), (%.group, mode), and (%.%, mode)).

As a special case, if aclpatt is the word opt, the primary is true for files with access control list entries.

JFS Access Control Lists

The -aclv primary enables the user to search for JFS access control list entries. It is true if the file's access control list matches an access control list pattern or contains optional access control list entries (see aclv(5)). It has three forms:

-aclv aclpatt

Match all files whose access control list includes all (zero or more) pattern entries specified by the aclpatt pattern.

-aclv =aclpatt

Match a file only if its access control list includes all (zero or more) pattern entries specified by the aclpatt pattern, and every entry in its access control list is matched by at least one pattern entry specified in the aclpatt pattern.

-aclv opt

Match all files containing optional access control list entries.

By default, -aclv is true for files whose access control lists include all the (zero or more) access control list patterns in aclpatt. A file's access control list can also contain unmatched entries.

If aclpatt begins with =, the remainder of the string must match all entries in a file's access control list.

An aclpatt consists of a type field, an ID field, and a mode field, separated by colons. Multiple comma-separated aclpatts may be specified.

The type field is one of user, group, class, other or *, optionally preceded by default:. user, group, class, other and default can be abbreviated to u, g, c, o and d, respectively. A type field of * matches any of the above types.

The ID field is either a numeric user or group ID, a user or group ID string from /etc/passwd or /etc/group respectively, or *, which matches any ID. The ID field can be mentioned only if the type field matches any of u, g, user, or group.

The mode field consists of a string of three characters. The first character is either r, indicating that read permission is granted; -, indicating that read permission is denied; or ?, which matches either state of read permission. The second character is either w, -, or ?, similarly indicating the state of write permission; and the third character is either x, -, or ?, indicating the state of execute permission.

As a special case, if aclpatt is the word opt, the primary is true for files with optional access control list entries.

EXTERNAL INFLUENCES

Environment Variables

If an internationalization variable is not specified or is null, it defaults to the value of LANG.

If LANG is not specified or is null, it defaults to C (see lang(5)).

If LC_ALL is set to a nonempty string value, it overrides the values of all the other internationalization variables.

If any internationalization variable contains an invalid setting, all internationalization variables default to C (see environ(5)).

LC_CTYPE determines the interpretation of text as single and/or multibyte characters, the classification of characters as printable, and the characters matched by character class expressions in regular expressions.

LC_MESSAGES determines the locale that should be used to affect the format and contents of diagnostic messages written to standard error and informative messages written to standard output.

NLSPATH determines the location of message catalogues for the processing of LC_MESSAGES.

International Code Set Support

Single- and multibyte character code sets are supported.

EXAMPLES

Here are several find examples.

  • The following examples show using -H and -L options. hey is a symbolic link which points to a directory hmm.

    $ ll /maint/proj/sums total 0 -rw-rw-rw- 1 dog animal 0 Dec 22 10:55 hello lrwxrwxrwx 1 dog animal 3 Dec 22 11:15 hey -> hmm -rw-rw-rw- 1 dog animal 0 Dec 22 10:55 hi drwxrwxrwx 2 dog animal 96 Dec 22 11:24 hmm

    The following command lists the filenames which are type directories. hey is not printed by default.

    $ /usr/bin/find /maint/proj/sums/ -type d /maint/proj/sums /maint/proj/sums/hmm

    The following command uses the -H option. Because /maint/proj/sums/hey is not found on the command line, it is not followed and not treated as a directory.

    $ /usr/bin/find -H /maint/proj/sums/ -type d /maint/proj/sums /maint/proj/sums/hmm

    The following command uses the -L option. Although /maint/proj/sums/hey is not found on the command line, the -L option causes all the symbolic links encountered anywhere in the file hierarchy to be followed.

    $ /usr/bin/find -L /maint/proj/sums/ -type d /maint/proj/sums /maint/proj/sums/hmm /maint/proj/sums/hey

    In the following -H example, the symbolic link, hey, is on the command line, so it is followed and recognized as a type directory.

    $ /usr/bin/find -H /maint/proj/sums/hey -type d /maint/proj/sums/hey

  • Search two directories, /example and /new/example, for files containing the string Where are you and print the names of the files:

    find /example /new/example -exec grep -l 'Where are you' {} \;

  • Remove all files named a.out or *.o that have not been accessed for a week:

    find / \( -name a.out -o -name '*.o' \) -atime +7 -exec rm {} \;

    • Note that the spaces delimiting the escaped parentheses are required.

  • Print a single long listing of all files named *.o in the current directory:

    find . -name '*.o' -exec ls -l {} \+ find . -name '*.o' -exec ls -l \+

    • Note that the curly braces, before plus sign, are optional.

  • Print the names of all files on this machine. Avoid walking nfs directories while still printing the nfs mount points:

    find / -fsonly hfs -print

  • Match only local files, and do not examine the contents of any directory found to be remotely mounted:

    find / ! -local -prune -o -size +50 -print

    This only works correctly if there are no local file systems mounted on top of remote directories. This example will print all local files on the system larger than 50 blocks, without wasting time accessing remote files.

  • To get the same effect, but to check for files in local file systems mounted on remote directories, use:

    find / -local -size +50 -print

  • Copy the entire file system to a disk mounted on /Disk, avoiding the recursive copy problem. Both commands are equivalent (note the use of -path instead of -name):

    cd /; find . ! -path ./Disk -only -print | cpio -pdxm /Disk cd /; find . -path ./Disk -prune -o -print | cpio -pdxm /Disk

  • Copy the root disk to a disk mounted on /Disk, skipping all mounted file systems below /. Note that -xdev does not cause / to be skipped, even though it is a mount point. This is because / is the starting point and -xdev only affects entries below starting points.

    cd /; find . -xdev -print | cpio -pdm /Disk

  • Change permissions on all regular files in a directory subtree to mode 444, and permissions on all directories to 555:

    find pathname -type f -print | xargs chmod 444 find pathname -type d -print | xargs chmod 555

    • Note that output from find was piped to xargs(1) instead of using the -exec primary. This is because when a large number of files or directories is to be processed by a single command, the -exec primary spawns a separate process for each file or directory, whereas xargs collects file names or directory names into multiple arguments to a single chmod command, resulting in fewer processes and greater system efficiency. The + delimiter for the -exec primary can be used to achieve the same efficiency.

Access Control List Examples

The following examples are for Access Control Lists.

  • Find all files not owned by user karl that have access control lists with at least one entry associated with karl, and one entry for no specific user in group bin with the read bit on and the write bit off:

    find / ! -user karl -acl 'karl.*, %.bin+r-w' -print

  • Find all files that have a read bit set in any access control list entry:

    find / -acl '*.*+r' -print

  • Find all files that have the write bit unset and execute bit set in every access control list entry:

    find / -acl '=*.*-w+x' -print

  • Find all files that have optional access control list entries:

    find / -acl opt -print

DEPENDENCIES

NFS

The -acl primary is always false for NFS files.

WARNINGS

Because of interoperability goals, cpio does not support archiving files larger than 2GB or files that have user/group IDs larger than 60,000 (60K). Files with user/group IDs greater than 60K are archived and restored under the user/group ID of the current process.

AUTHOR

find was developed by AT&T and HP.

FILES

/etc/group

Group names

/etc/mnttab

Mount points

/etc/passwd

User names

STANDARDS CONFORMANCE

find: SVID2, SVID3, XPG2, XPG3, XPG4, POSIX.2

Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© 1983-2007 Hewlett-Packard Development Company, L.P.