Find by file name
To perform a find command in terminal use
find / -name php.ini -type f
find / -name {filename} {type parameters}
Note there are many parameters in the commands, so I'll cover a couple regular expressions here. Such as,
-name | matches the string being searched and is case sensitive |
-iname | matches the string being searched and is case insensitive |
-type f | means to find a file with the name being searched. In this instance php.ini |
-type d | find a directory |
-type l | find a symbolic link |
-type c | find a character devices |
-type b | find a block devices |
-type p | find a named pipe |
-type s | find a socket |
If you want to perform a file all files that end in .php
find / -name '*.php'
Find files with the word "laravel" in the name.
find / -name '*laravel*'
Regex match, more flexible. Find both .php files and files with the word "laravel" in the name.
find / -regex '.*laravel.*\|.*\.php'
Note, with regex you can also make the search insensitive through using -iregex
find / -iregex '.*laravel.*\|.*\.php'
A great resource list is on ss64
Find text in a file
grep -iRl "text-to-find" ./
grep {switches} "text" {directory}
What do the switches do...
-i | ignore text case |
-R | recursively search files in subdirectories |
-l | show file names instead of file contents portions |
-n | show the line number |
-w | match the whole word |
./ - the last parameter is the path to the folder containing files you need to search for your text. Working from root directory, you will scan your entire server. If that is a little too heavy, you can change it to the full path of the folder such as /var/www/vhosts/
Expressions
There are, however, other expressions you can use:
-amin n | The file was last accessed n minutes ago |
-anewer | The file was last accessed more recently than it was modified |
-atime n | The file was last accessed more n days ago |
-cmin n | The file was last changed n minutes ago |
-cnewer | The file was last changed more recently than the file was modified |
-ctime n | The file was last changed more than n days ago |
-empty | The file is empty |
-executable | The file is executable |
-false | Always false |
-fstype type | The file is on the specified file system |
-gid n | The file belongs to group with the ID n |
-group groupname | The file belongs to the named group |
-ilname pattern | Search for a symbolic line but ignore the case |
-iname pattern | Search for a file but ignore the case |
-inum n | Search for a file with the specified node |
-ipath path | Search for a path but ignore the case |
-iregex expression | Search for an expression but ignore the case |
-links n | Search for a file with the specified number of links |
-lname name | Search for a symbolic link |
-mmin n | The file data was last modified n minutes ago |
-mtime n | The file data was last modified n days ago |
-name name | Search for a file with the specified name |
-newer name | Search for a file edited more recently than the file given |
-nogroup | Search for a file with no group id |
-nouser | Search for a file with no user attached to it |
-path path | Search for a path |
-readable | Find files that are readable |
-regex pattern | Search for files matching a regular expression |
-type type | Search for a particular type |
-uid uid | The file numeric user id is the same as the uid |
-user name | The file is owned by the user that is specified |
-writable | Search for files that can be written to |
Examples of the find command in action
To find all the files within your home folder accessed more than 80 days ago:
find ~ -atime 80
To find all the empty files and folders in your system:
find / -empty
To find all the executable files on your computer:
find / -executable
To find all the files that are readable:
find / -readable
Find by date
find . -maxdepth 1 -newermt "2021-06-09"
Find by time - recent period
To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:
find / -mtime -1 -ls
Alter the slash '/' to restrict the query to the directories you want to target
To query the last three hours use
find / -mmin -180 -ls
Combining with an earlier query you can use
find / -name php.ini -type f -mmin -180 -ls