Comprehensive Guide to Linux File Search Commands

Finding a command’s absolute path

The which command prints the absolute path of a given command and can also reveal the PATH environment variable.

# which bash
/usr/bin/bash
# which ls
alias ls='ls --color=auto'
/usr/bin/ls

Searching specific files with whereis

whereis

locates the binary, source, and manual pages of a program name. It accepts options to limit the search: -b – binary only -m – manual pages only -s – source files only

# whereis -b ifconfig
ifconfig: /usr/sbin/ifconfig
# whereis -m ifconfig
ifconfig: /usr/share/man/man8/ifconfig.gz

Using locate with a file database

locate

queries the /var/lib/mlocatedb database, which is automatically updated daily. To include recent changes, run updatedb manually (it follows /etc/updatedb.conf).

# yum install -y mlocate
# locate --help
# updatedb
# locate /etc/passwd
/etc/passwd
/etc/passwd-

File traversal with find

The find command is the most versatile file‑search tool. Syntax: find [directory] [expression] [action]. Common predicates: -name – match file name (wildcards *, ?, []) -size – match file size (blocks of 512 bytes; -10k means less than 10 KB, +1M means greater than 1 MB) -user – match file owner -perm – match permission bits (e.g., 0644) -type – f (regular file), d (directory), l (symlink) -time – c (change), a (access), m (modify) with optional -mtime +7 etc. -inum – match inode number -exec – execute a command on each matched file (must end with \;) -ok – like -exec but prompts for confirmation

Logical operators: -a (and), -o (or)

Examples:

# find /var/ -name "*.log"
/var/log/... (list of .log files)

# find /etc/ -size -10k
/etc/crypttab
/etc/.pwd.lock
/etc/environment

# find /etc/ -size +1M
/etc/udev/hwdb.bin
/etc/selinux/targeted/active/policy.kern
...

# find /root/ -user wang
/root/1.txt
/root/2.txt
/root/3.txt

# find /boot/ -perm 0644
/boot/grub2/device.map
/boot/grub2/i386-pc/gcry_rmd160.mod
...

# find /usr/bin/ -type f
/usr/bin/cp
/usr/bin/gzip
/usr/bin/csplit
/usr/bin/bash
...

# find /etc/ -mmin -120
/etc/resolv.conf
/etc/group-
/etc/gshadow
...

# find /etc/ -ctime +7
/etc/resolv.conf
/etc/group
/etc/gshadow-
...

# find ./ -inum 1024 -exec rm {} \;

# find /etc/ -size +1k -a -size -10k
/etc/grub.d/00_header
/etc/grub.d/20_ppc_terminfo
...

# find /var/ -name "*.log" -exec ls -l {} \;
(total listing omitted)

# find /etc/ -name "init*" -a -type f -exec ls -l {} \;
/etc/inittab
/etc/sysconfig/init
/etc/sysconfig/network-scripts/init.ipv6-global
...

# find /tmp/ -name yum.log -exec rm {} \;

# find / -user lyshark -ok rm -r {} \;
(prompt shown for each match)

Important notes

File size units are blocks of 512 bytes; 1M equals 1024 KB = 2048 blocks.

The + or - prefix must be used to indicate a range; without it the size is matched exactly.

When using -exec, the placeholder {} represents the current file, and \; terminates the command. Spaces are required exactly as shown.

Escaping (e.g., \rm) bypasses shell aliases such as rm -i, allowing the original command to run without interactive prompts.

Source: https://www.cnblogs.com/LyShark/p/15750017.html