Linux common command find record

The tribe recorded some usage of the find command once in 2013. The reason for doing it again after so many years is that we sadly discovered that a certain website was hacked and many files were changed. At this time, the find command was used to find files that had been modified in a certain period of time, so I brought it out again for easy reference next time.

Find files by file name

For example, we want to find a file in the system and know that the file name is a.php

 find / -name a.php

As above, / indicates which directory it is in. If you know which directory it is in, you can also write to the directory to make the scope smaller.

Find files by incomplete file name

We can also search for files by incomplete names, for example, we want to find all PHP files in the system, or know two letters in the name of a PHP file.

 find / -name *.php #Find all PHP files find / -name wp*.php #Find PHP files with names starting with wp

Search by file characteristics

Here we take searching by file size as an example, which is especially applicable when we need to find large files.

 find / -size 1500c #Find files of size 1500 bytesfind / -size +1500c #Find files larger than 1500 bytesfind / -size -500c -size +50c #Find files larger than 50 bytes and smaller than 500 bytes

Other ways to search

For example, by time, by modifying time, etc.

 find / -amin -10 # Find files accessed in the last 10 minutes in the systemfind / -atime -2 # Find files accessed in the last 48 hours in the systemfind / -empty # Find empty files or folders in the systemfind / -group cat # Find files belonging to group cat in the systemfind / -mmin -5 # Find files modified in the last 5 minutes in the systemfind / -mtime -1 # Find files modified in the last 24 hours in the systemfind / -nouser # Find files belonging to invalid users in the systemfind / -user fred # Find files belonging to user FRED in the systemfind / -mtime +3 # Find files modified 3 days agofind / -name '*.php' -mtime -3 # Find php files modified within 3 daysfind / -name 'wp*' -mtime 0 # Find files starting with wp that have been modified within 24 hours