Linux File Finding Commands: which, whereis, locate, and find Explained

Finding Command Absolute Path with which

The which command locates and displays the absolute path of a given command by searching the directories listed in the PATH environment variable.

[root@localhost ~]# which bash
/usr/bin/bash

[root@localhost ~]# which ls
alias ls='ls --color=auto'
/usr/bin/ls

The output shows that ls is an alias, while the actual binary resides at /usr/bin/ls.

Locating Specific Files with whereis

whereis

finds the binary, source, and manual page files for a command. It only searches by program name.

Syntax: whereis [options] filename
Options:
  -b   # only find binary files
  -m   # only find man pages
  -s   # only find source files

Examples:

[root@localhost ~]# whereis -b ifconfig
ifconfig: /usr/sbin/ifconfig

[root@localhost ~]# whereis -m ifconfig
ifconfig: /usr/share/man/man8/ifconfig.8.gz

Cached File Search with locate

locate

queries a pre-built database ( /var/lib/mlocatedb) containing all local file information. The database is updated daily automatically; for recent changes, run updatedb manually (which reads /etc/updatedb.conf).

Install: yum install -y mlocate
Syntax: locate [options] filename
Options:
  -d directory   # specify database directory
  -i             # ignore case
  -r             # use regular expression

Example:

[root@localhost ~]# updatedb
[root@localhost ~]# locate /etc/passwd
/etc/passwd
/etc/passwd-

Traversing File Search with find

find

is the most powerful search command, traversing the filesystem hierarchy with many options.

Syntax: find [directory] [criteria] [filename]
Common options:
  -name   # by filename
  -size   # by size
  -user   # by owner
  -perm   # by permissions
  -type   # by file type
  -time   # by time (ctime, atime, mtime in days; cmin, amin, mmin in minutes)
  -inum   # by inode number
  -exec   # execute command on results
  -ok     # like -exec but prompts before each execution

-name — Search by Filename

Supports wildcards: * (any characters), ? (single character), [] (character range, quote the pattern).

Find .log files under /var/:

[root@localhost ~]# find /var/ -name "*.log"
/var/log/tuned/tuned.log
/var/log/audit/audit.log
/var/log/anaconda/X.log
/var/log/anaconda/program.log
....

Find files in /root/ ending with a digit 1-3 and .txt:

[root@localhost ~]# ls
1.txt  2.txt  3.txt  Catalog  File
[root@localhost ~]# find /root/ -name "[1-3].txt"
/root/1.txt
/root/2.txt
/root/3.txt

Find files in /etc/ with exactly six characters:

[root@localhost ~]# find /etc/ -name "??????"
/etc/grub.d
/etc/grub.d/README
/etc/shells
/etc/init.d
....

-size — Search by File Size

Size units are 512-byte blocks. 1M = 2048 blocks, 100M = 204800 blocks. Use + for greater than, - for less than, no sign for exact match.

Files under /etc/ smaller than 10KB:

[root@localhost ~]# find /etc/ -size -10k
/etc/crypttab
/etc/.pwd.lock
/etc/environment
....

Files under /etc/ larger than 1MB:

[root@localhost ~]# find /etc/ -size +1M
/etc/udev/hwdb.bin
/etc/selinux/targeted/active/policy.kern
/etc/selinux/targeted/contexts/files/file_contexts.bin
/etc/selinux/targeted/policy/policy.31
....

-user and -perm — Search by Owner and Permissions

Find files owned by user wang in /root/:

[root@localhost ~]# find /root/ -user wang
/root/1.txt
/root/2.txt
/root/3.txt
# Note: user must exist, otherwise error.

Find files with permission 644 in /boot/:

[root@localhost ~]# find /boot/ -perm 0644
/boot/grub2/device.map
/boot/grub2/i386-pc/gcry_rmd160.mod
/boot/grub2/i386-pc/acpi.mod
/boot/grub2/i386-pc/gcry_rsa.mod
....

-type — Search by File Type

-type f

— regular file (binary) -type l — symbolic link -type d — directory

Find regular files in /usr/bin/:

[root@localhost ~]# find /usr/bin/ -type f
/usr/bin/cp
/usr/bin/gzip
/usr/bin/alias
/usr/bin/csplit
/usr/bin/bash
....

-time — Search by Time

Three timestamps: c (change) — metadata changed (owner, group, permissions) a (access) — file was read/accessed m (modify) — file content changed

Each has day ( ctime, atime, mtime) and minute ( cmin, amin, mmin) variants. Use - for "within", + for "older than".

Files in /etc/ modified within the last 120 minutes:

[root@localhost ~]# find /etc/ -mmin -120
/etc/
/etc/resolv.conf
/etc/group-
/etc/gshadow-
/etc/group
/etc/gshadow
....

Files in /etc/ with metadata changed more than 7 days ago:

[root@localhost ~]# find /etc/ -ctime +7
/etc/resolv.conf
/etc/group-
/etc/gshadow-
....

-inum — Search by Inode Number

Useful for finding all hard links to the same inode. Example: delete all files sharing inode 1024.

[root@localhost ~]# find ./ -inum 1024 -exec rm {} \;

Logical Operators: -a (AND) and -o (OR)

Combine criteria. Example: files in /etc/ larger than 1KB AND smaller than 10KB.

[root@localhost ~]# find /etc/ -size +1k -a -size -10k
/etc/grub.d/00_header
/etc/grub.d/20_ppc_terminfo
/etc/grub.d/00_tuned
/etc/rc.d/init.d/README
/etc/rc.d/init.d/netconsole
/etc/rc.d/init.d/network
/etc/pam.d
....

-exec — Execute Command on Results

Syntax: find ... -exec command {} \;. {} is replaced by each found file. The backslash escapes the semicolon terminator. The escape also bypasses shell aliases (e.g., rm aliased to rm -i).

Find .log files in /var/log/ and run ls -l on each:

[root@localhost ~]# find /var/log/ -name "*.log" -exec ls -l {} \;
total 1176
drwxr-xr-x. 2 root root 204 Sep 18 09:12 anaconda
drwx------. 2 root root 23 Sep 18 09:12 audit
-rw-------. 1 root root 53001 Sep 19 00:57 boot.log
-rw-------. 1 root utmp 384 Sep 18 09:22 btmp
....

Find files named init* in /etc/, restrict to regular files, then ls -l:

[root@localhost ~]# find /etc/ -name "init*" -a -type f -exec ls -l {} \;
-rw-r--r--. 1 root root 511 Apr 11 01:09 /etc/inittab
-rw-r--r--. 1 root root 798 Apr 11 01:09 /etc/sysconfig/init
-rwxr-xr-x. 1 root root 5419 Jan 2 2018 /etc/sysconfig/network-scripts/init.ipv6-global
-rw-r--r--. 1 root root 30 Apr 11 14:12 /etc/selinux/targeted/contexts/initrc_context

Delete yum.log in /tmp/:

[root@localhost tmp]# find /tmp/ -name yum.log -exec rm {} \;

Delete all files owned by lyshark from root (shows errors for virtual filesystems like /proc):

[root@localhost ~]# find / -user lyshark -exec rm -r {} \;
find: '/proc/1465/task/1465/fd/6': No such file or directory
find: '/proc/1465/task/1465/fdinfo/6': No such file or directory
....
# Note: -exec is slow for large result sets.

-ok — Interactive Execution

Same as -exec but prompts for confirmation before each command.

[root@localhost ~]# find / -user lyshark -ok rm -r {} \;
find: '/proc/1777/task/1777/fd/6': No such file or directory
....
< rm ... /root/LyShark > ? y
# -ok prompts before each action.

Source: https://www.cnblogs.com/LyShark/p/15750017.html