find Command

Purpose

Finds files with a matching expression.

Syntax

find [ -H | -L] Path ... [ Expression ]

Description

The find command recursively searches the directory tree for each specified Path parameter, seeking files that match a Boolean expression. The Boolean expression is written using the terms given in the following text. When the find command is recursively descending directory structures, it does not descend into directories that are symbolically linked into the current hierarchy. The output from the find command depends on the terms specified by the Expression parameter.

The find command does not support the 4.3 BSD fast find syntax.

Flags

Item	Description
-H	Causes the file information and file type evaluated for each symbolic link encountered on the command line to be those of the file referenced by the link, and not the link itself. If the referenced file does not exist, the file information and type is for the link itself. File information for all symbolic links not on the command line is that of the link itself.
-L	Causes the file information and file type evaluated for each symbolic link to be those of the file referenced by the link, and not the link itself.

Expression Terms

These Boolean expressions and variables describe the search boundaries of the find command as defined in the Path and Expression parameters.

Note: In the following definitions, the n variable specifies a decimal integer that can be expressed as +n (more than n), -n (less than n), or n (exactly n) and the Number variable specifies a decimal integer that can be expressed as +Number (more than Number), -Number (less than Number), or Number (Number-1 to Number).

Item	Description
\( Expression \)	Evaluates to the value True if the expression in parentheses is true.
-amin n	The value of n can be one of the following: n Evaluates as True if the file access time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is n. -n Evaluates as True if the file access time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file access time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). For example, -amin 2 is true if the file has been accessed within 1 to 2 minutes. Note: Files accessed after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n.
-atime n	The value of n can be one of the following: n Evaluates as True if the file access time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is n. -n Evaluates as True if the file access time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file access time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). Note: The definition of -atime has changed to comply with the Single UNIX Specification, Version 3. The previous behavior of -atime evaluated as True if the file had been accessed in n-1 to n multiples of 24 hours. By default, find -atime works like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to `ON` and XPG_UNIX98 to `OFF`. The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to `ON`. Files accessed after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n.
-cmin n	The value of n can be one of the following: n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is n. -n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). Note: Files with i-nodes modified after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, files with i-nodes modified after the command start time will be displayed until the value of n.
-cpio Device	Writes the current file to the specified device in the cpio command format.
-ctime n	The value of n can be one of the following: n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is n. -n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file i-node modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). Note: The definition of -ctime has changed to comply with the Single UNIX Specification, Version 3. The previous behavior of -ctime evaluated as True if the file had been accessed in n-1 to n multiples of 24 hours. By default, find -ctime works like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to `ON` and XPG_UNIX98 to `OFF`. The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to `ON`. Files with i-nodes modified after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, files with i-nodes modified after the command start time will be displayed until the value of n.
-depth	Always evaluates to the value True. Causes the descent of the directory hierarchy to be done so that all entries in a directory are affected before the directory itself is affected. This can be useful when the find command is used with the cpio command to transfer files that are contained in directories without write permission.
-ea	Evaluates to the value True if file has either access control information (ACL) or Extended attributes (EA) set.
-exec Command	Evaluates to the value True if the specified command runs and returns a 0 value as exit status. The end of the specified command must be punctuated by a semicolon in quotation marks, an escaped semicolon, or a plus sign. An argument containing the two characters `{}` (braces) must be followed by a plus sign that punctuates the end of the specified command. A command parameter `{}` (braces) is replaced by the current path name.
-follow	Causes symbolic and hard links to be followed.
-fstype Type	Evaluates to the value True if the file system to which the file belongs is of the specified type. The Type variable has a value of jfs (journaled file system) or nfs (network file system).
-group Group	Evaluates to the value True if the file belongs to the specified group. If the value of the Group variable is numeric and does not appear in the /etc/group file, it is interpreted as a group ID.
-inum n	Evaluates to the value True if file has an i-node matching the value of the n variable.
-links n	Evaluates to the value True if the file has the specified number of links. See the ln command for a description of links.
-long	Prints all available characters of each user/group name instead of truncating to the first 8 when used in combination with -ls.
-ls	Always evaluates to the value True. Causes the current path name to be printed together with its associated statistics. These statistics include the following: I-node number Size in kilobytes (1024 bytes) Protection mode Number of hard links User Group Size in bytes Modification time If the file is a special file, the size field contains the major and minor device numbers. If the file is a symbolic link, the path name of the linked-to file is printed preceded by the -> (hyphen, greater than) symbols. Formatting is similar to that of the ls -filds command, however formatting is done internally without executing the ls command. Therefore, differences in output with the ls command may exist, such as with the protection mode.
-mmin n	The value of n can be one of the following: n Evaluates as True if the file modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is n. -n Evaluates as True if the file modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file modification time subtracted from the initialization time, divided by 60 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). Note: Files modified after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n.
-mtime n	The value of n can be one of the following: n Evaluates as True if the file modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is n. 86400 seconds is 24 hours. -n Evaluates as True if the file modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is less than n. +n Evaluates as True if the file modification time subtracted from the initialization time, divided by 86400 seconds (with any remainder discarded), is greater than n (in case of UNIX03, greater than n+1). Note: The definition of -mtime has changed to comply with the Single UNIX Specification, Version 3. The previous behavior of -mtime evaluated as True if the file had been modified in n-1 to n multiples of 24 hours. By default, find -mtime works like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to `ON` and XPG_UNIX98 to `OFF`. The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to `ON`. Files modified after the find command start time will not be taken into account. However, when the find command is used within the unary `NOT` operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n.
-name File	Evaluates to the value True if the value of the File variable matches the file name. The typical shell filename generation characters (see the sh command) can be used. The pattern must either be enclosed in quotation marks or the escape character used when the find command is used from the shell. A backslash (\) is used as an escape character within the pattern. You can use wildcard (pattern-matching) characters, provided they are in quotation marks. For more information about using wildcard characters, see "Pattern matching with wildcards and metacharacters" in AIX® Version 7.1 Operating system and device management. In an expression such as [a-z], the hyphen means through according to the current collating sequence. A collating sequence may define equivalence classes for use in character ranges. For more information about collating sequences and equivalence classes, see "National Language Support Overview" in the AIX Version 7.1 National Language Support Guide and Reference.
-newer File	Evaluates to the value True if the current file has been modified more recently than the file indicated by the File variable.
-nogroup	Evaluates to the value True if the file belongs to a group not in the /etc/group database.
-nouser	Evaluates to the value True if the file belongs to a user not in the /etc/passwd database.
-ok Command	The same as the -exec expression, except that the find command asks you whether it should start the specified command. An affirmative response starts the command. The end of the specified command must be punctuated by a semicolon enclosed in quotation marks or the \; (backslash-escape semicolon).
-perm [ - ] OctalNumber	Evaluates to the value True if the permission code of the file exactly matches the OctalNumber parameter. For details about file permissions, refer to the chmod command. If the optional - (hyphen) is present, this expression evaluates to the value true if at least these permissions are set. The OctalNumber parameter can be up to nine octal digits. Note: For files that are a part of TCB environment, additional security bits are added to the permission of the files. These files have the S_ITCB bit set and the security bit set is defined as 0x010000000. Therefore, the octal permissions value of a TCB enabled file needs to include the bit setting of 100000000 along with its other permission bits. Example: To list a file which is a part of the TCB environment find -perm 100000600 -print. This lists the names of the files that have only owner-read and owner-write permission and are a part of the TCB environment. See the chmod command for an explanation of permission codes.
-perm [ - ] Mode	The mode argument is used to represent file mode bits. It is identical in format to the <symbolicmode> operand described in chmod, and is interpreted as follows: Initially, a template is assumed with all file mode bits cleared. Op symbols have the following function: + sets the appropriate mode bits in the template - clears the appropriate bits = sets the appropriate mode bits, without regard to the contents of the process' file mode creation mask The op symbol `-` cannot be the first character of mode. This avoids ambiguity with the optional leading hyphen. Because the initial mode is all bits off, there are no symbolic modes that need to use `-` as the first character. If the hyphen is omitted, the primary evaluates as True when the file permission bits exactly match the value of the resulting template. Otherwise, if mode is prefixed by a hyphen, the primary evaluates as True if at least all bits in the resulting template are set in the file permission bits. The Mode parameter is identical to the chmod command syntax. This expression evaluates to the value True if the file has exactly these permissions. If the optional - (hyphen) is present, this expression evaluates to the value True if at least these permissions are set.
-print	Always evaluates to the value True. Displays the current path name. The find command assumes a -print expression, unless the -exec, - ls, or -ok expressions are present.
-prune	Always evaluates to the value True. Stops the descent of the current path name if it is a directory. If the -depth flag is specified, the -prune flag is ignored.
-size n	Evaluates to the value True if the file is the specified n of blocks long (512 bytes per block). The file size is rounded up to the nearest block for comparison.
-size nc	Evaluates to the value True if the file is exactly the specified n of bytes long. Adding c to the end of the n variable indicates that the size of the file is measured in individual bytes not blocks.
-type Type	Evaluates to the value True if the Type variable specifies one of the following values: b Block special file c Character special file d Directory f Plain file l Symbolic link p FIFO (a named pipe) s Socket
-user User	Evaluates to the value True if the file belongs to the specified user. If the value of the User variable is numeric and does not appear as a login name in the /etc/passwd file, it is interpreted as a user ID.
-xdev	Always evaluates to the value True. Prevents the find command from traversing a file system different from the one specified by the Path parameter.

These expressions can be combined using the following operators in the order of decreasing precedence:

( Expression ) - A parenthetic group of expressions and operators (parentheses are special to the shell and require the backslash-escape sequence).
! Expression - The negation of an expression ('!' is the unary NOT operator).
Expression [ -a ] Expression - Concatenation of expressions (the AND operation is implied by the juxtaposition of two primaries or may be explicitly stated as -a).
Expression -o Expression - Alternation of primaries; -o is the OR operator. The second expression will not be evaluated if the first expression is true.

Note: When using the find and cpio commands together, you must use the -follow option and the -L option with the cpio command,. Not using these two options together produces undesirable results. If expression is not present, -print as used in the default expression. For example, if the given expression does not contain any of the primaries -exec, -ok, or -print, the given expression is replaced by (given_expression) -print. The -user, -group, and -newer primaries each evaluate their respective arguments only once. Using a command specified by -exec or -ok does not affect subsequent primaries on the same file.

Exit Status

This command returns the following exit values:

Item	Description
0	All Path parameters were traversed successfully.
>0	An error occurred.

Examples

To list all files in the file system with a given base file name, type:
find / -name .profile -print
This command searches the entire file system and writes the complete path names of all files named .profile. The / (slash) instructs the find command to search the root directory and all of its subdirectories. In order not to waste time, it is best to limit the search by specifying the directories where you think the files might be.
To list files having a specific permission code in the current directory tree, type:
find . -perm 0600 -print
This command lists the names of the files that have only owner-read and owner-write permission. The . (dot) instructs the find command to search the current directory and its subdirectories. See the chmod command for an explanation of permission codes.
To search several directories for files with certain permission codes, type:
find manual clients proposals -perm -0600 -print
This command lists the names of the files that have owner-read and owner-write permission and possibly other permissions. The manual, clients, and proposals directories and their subdirectories are searched. In the previous example, -perm 0600 selects only files with permission codes that match 0600 exactly. In this example, -perm -0600 selects files with permission codes that allow the accesses indicated by 0600 and other accesses above the 0600 level. It also matches the permission codes 0622 and 0744.
To list all files in the current directory that have been changed during the current 24-hour period, type:
find . -ctime 1 -print
To search for regular files with multiple links, type:
find . -type f -links +1 -print
This command lists the names of the ordinary files (-type f) that have more than one link (-links +1).
Note: Every directory has at least two links: the entry in its parent directory and its own . (dot) entry. The ln command explains multiple file links.
To find all accessible files whose path name contains find, type:
find . -name '*find*' -print
To remove all files named a.out or *.o that have not been accessed for a week and that are not mounted using nfs, type:
find / \( -name a.out -o -name '*.o' \) -atime +7 ! -fstype nfs -exec rm {} \;

Note: The number used within the -atime expression is +7. This is the correct entry if you want the command to act on files not accessed for more than a week (seven 24-hour periods).
To print the path names of all files in or below the current directory, except the directories named SCCS or files in the SCCS directories, type:
find . -name SCCS -prune -o -print
To print the path names of all files in or below the current directory, including the names of SCCS directories, type:
```
find . -print -name SCCS -prune
```
To search for all files that are exactly 414 bytes long, type:
```
find . -size 414c -print
```
To find and remove every file in your home directory with the .c suffix, type:
```
find /u/arnold -name "*.c" -exec rm {} \;
```
Every time the find command identifies a file with the .c suffix, the rm command deletes that file. The rm command is the only parameter specified for the -exec expression. The {} (braces) represent the current path name.
In this example, dirlink is a symbolic link to the directory dir. To list the files in dir by referring to the symbolic link dirlink on the command line, type:
```
find -H dirlink -print
```
In this example, dirlink is a symbolic link to the directory dir. To list the files in dirlink, traversing the file hierarchy under dir including any symbolic links, type:
```
find -L dirlink -print
```
To determine whether the file dir1 referred by the symbolic link dirlink is newer than dir2, type:
```
find -H dirlink -newer dir2
```
Note: Because the -H flag is used, time data is collected not from dirlink but instead from dir1, which is found by traversing the symbolic link.
To produce a listing of files in the current directory in ls format with expanded user and group name, type:
```
find . -ls -long
```
To list the files with ACL/EA set in current directory, type:
```
find . -ea
```
To list the files modified within 60 minutes, type:
```
find . -mmin -60
```

Files

Item	Description
/usr/bin/find	Contains the find command.
/bin/find	Symbolic link to the find command.
/etc/group	Contains a list of all known groups.
/etc/passwd	Contains a list of all known users.