Linux Bible. Christopher Negus
every file in your filesystem is stored in the database. The contents of the /etc/updatedb.conf file limit which filenames are collected by pruning out select mount types, filesystem types, file types, and mount points. For example, filenames are not gathered from remotely mounted filesystems (cifs, nfs, and so on) or locally mounted CDs or DVDs (iso9660). Paths containing temporary files (/tmp) and spool files (/var/spool/cups) are also pruned. You can add items to prune (or remove some items that you don't want pruned) the locate database to your needs. In RHEL 8, the updatedb.conf file contains the following:PRUNE_BIND_MOUNTS = "yes" PRUNEFS = "9p afs anon_inodefs auto autofs bdev binfmt_misc cgroup cifs coda configfs cpuset debugfs devpts ecryptfs exofs fuse fuse.sshfs fusectl gfs gfs2 gpfs hugetlbfs inotifyfs iso9660 jffs2 lustre mqueue ncpfs nfs nfs4 nfsd pipefs proc ramfs rootfs rpc_pipefs securityfs selinuxfs sfs sockfs sysfs tmpfs ubifs udf usbfs ceph fuse.ceph" PRUNENAMES = ".git .hg .svn .bzr .arch-ids {arch} CVS" PRUNEPATHS = "/afs /media /mnt /net /sfs /tmp /udev /var/cache/ccache /var/lib/yum/yumdb /var/lib/dnf/yumdb /var/spool/cups /var/spool/squid /var/tmp /var/lib/ceph" As a regular user, you can't see any files from the locate database that you can't see in the filesystem normally. For example, if you can't type ls to view files in the /root directory, you can't locate files stored in that directory.
When you search for a string, the string can appear anywhere in a file's path. For example, if you search for passwd, you could turn up /etc/passwd, /usr/bin/passwd, /home/chris/passwd/pwdfiles.txt, and many other files with passwd in the path.
If you add files to your system after updatedb runs, you can't locate those files until updatedb runs again (probably that night). To get the database to contain all files up to the current moment, you can simply run updatedb from the shell as root.
Here are some examples of using the locate command to search for files:
$ locate .bashrc /etc/skel/.bashrc /home/cnegus/.bashrc # locate .bashrc /etc/skel/.bashrc /home/bill/.bashrc /home/joe/.bashrc /root/.bashrc
When run as a regular user, locate only finds .bashrc in /etc/skel and the user's own home directory. Run as root, the same command locates .bashrc files in everyone's home directory.
$ locate dir_color /usr/share/man/man5/dir_colors.5.gz … $ locate -i dir_color /etc/DIR_COLORS /etc/DIR_COLORS.256color /etc/DIR_COLORS.lightbgcolor /usr/share/man/man5/dir_colors.5.gz
Using locate -i, filenames are found regardless of case. So in the previous example, DIR_COLORS was found with -i whereas it wasn't found without the -i option.
$ locate services /etc/services /usr/share/services/bmp.kmgio /usr/share/services/data.kmgio
Unlike the find command, which uses the -name option to find filenames, the locate command locates the string you enter if it exists in any part of the file's path. In this example, searching for services using the locate command finds files and directories containing the services text string.
Searching for files with find
The find command is the best one for searching your filesystem for files based on a variety of attributes. After files are found, you can act on those files as well (using the -exec or -okay option) by running any commands you want on them.
When you run find, it searches your filesystem live, which causes it to run slower than locate, but it gives you an up-to-the-moment view of the files on your Linux system. However, you can also tell find to start at a particular point in the filesystem so that the search can go faster by limiting the area of the filesystem being searched.
Nearly any file attribute that you can think of can be used as a search option. You can search for filenames, ownership, permission, size, modification times, and other attributes. You can even use combinations of attributes. Here are some basic examples of using the find command:
$ find $ find /etc # find /etc $ find $HOME -ls
Run on a line by itself, the find command finds all files and directories below the current directory. If you want to search from a particular point in the directory tree, just add the name of the directory you want to search (such as /etc). As a regular user, find does not give you special permission to find files that have permissions that make them readable only by the root user. So, find produces a bunch of error messages. Run as the root user, find /etc finds all files under /etc.
A special option to the find command is -ls. A long listing (ownership, permission, size, and so on) is printed with each file when you add -ls to the find command (similar to output of the ls -l command). This option helps you in later examples when you want to verify that you have found files that contain the ownership, size, modification times, or other attributes that you are trying to find.
NOTE
If, as a regular user, you are searching an area of the filesystem where you don't have full permission to access all of the files it contains (such as the /etc directory), you might receive lots of error messages when you search with find. To get rid of those messages, direct standard errors to /dev/null. To do that, add the following to the end of the command line: 2> /dev/null. The 2> redirects standard error to the next option (in this case /dev/null, where the output is discarded).
Finding files by name
To find files by name, you can use the -name and -iname options. The search is done by base name of the file; the directory names are not searched by default. To make the search more flexible, you can use file-matching characters, such as asterisks (*) and question marks (?), as in the following examples:
# find /etc -name passwd /etc/pam.d/passwd /etc/passwd # find /etc -iname '*passwd*' /etc/pam.d/passwd /etc/passwd- /etc/passwd.OLD /etc/passwd /etc/MYPASSWD /etc/security/opasswd
Using the -name option and no asterisks, the first example above lists any files in the /etc directory that are named passwd exactly. By using -iname instead, you can match any combination of upper- and lowercase. Using asterisks, you can match any filename that includes the word passwd.
Finding files by size
If your disk is filling up and you want to find out where your biggest files are located, you can search your system by file size. The -size option enables you to search for files that are exactly, smaller than, or larger than a selected size, as you can see in the following examples:
$ find /usr/share/ -size +10M $ find /mostlybig -size -1M $ find /bigdata -size +500M -size -5G -exec du -sh {} \; 4.1G /bigdata/images/rhel6.img 606M /bigdata/Fedora-16-i686-Live-Desktop.iso 560M /bigdata/dance2.avi
The first example in the preceding code finds files larger than 10MB. The second finds files less than 1MB. In the third example, I'm searching for files that are between 500MB and 5GB. This includes an example of the -exec option (which I describe later) to run the du command on each file to see its size.
Finding files by user
You can search for a particular owner (-user) or group (-group) when you try to find files. By using -not and -or, you can refine your search for files associated with specific users and groups, as you can see in the following examples:
$ find /home -user chris -ls 131077 4 -rw-r--r--