Finds files with a matching expression.
The find command recursively searches the directory tree for each specified Path parameter, seeking files that match a Boolean expression. The Boolean expression is written using the terms given in the following text. When the find command is recursively descending directory structures, it does not descend into directories that are symbolically linked into the current hierarchy. The output from the find command depends on the terms specified by the Expression parameter.
The find command does not support the 4.3 BSD fast find syntax.
Item | Description |
---|---|
-H | Causes the file information and file type evaluated for each symbolic link encountered on the command line to be those of the file referenced by the link, and not the link itself. If the referenced file does not exist, the file information and type is for the link itself. File information for all symbolic links not on the command line is that of the link itself. |
-L | Causes the file information and file type evaluated for each symbolic link to be those of the file referenced by the link, and not the link itself. |
Item | Description |
---|---|
\( Expression \) | Evaluates to the value True if the expression in parentheses is true. |
-amin n | The value of n can be one of the following:
For example, -amin 2 is true if the file has been accessed within 1 to 2 minutes. Note: Files accessed after the find command start time will
not be taken into account. However, when the find command is
used within the unary NOT operator for non-UNIX03 behavior, the
files modified after the command start time will be displayed until
the value of n.
|
-atime n | The value of n can be one of the following:
Note: The definition of -atime has changed
to comply with the Single UNIX Specification, Version 3. The previous behavior of -atime evaluated as True if the file had been accessed in n-1 to n multiples of 24 hours. By default, find -atime works
like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to ON and XPG_UNIX98 to OFF.
The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to ON. Files accessed after the find command start time will not be taken into account. However, when the find command is used within the unary NOT operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n. |
-cmin n | The value of n can be one of the following:
Note: Files with i-nodes modified after the find command start time will not be taken into account. However, when
the find command is used within the unary NOT operator for non-UNIX03 behavior, files with i-nodes modified after the command start
time will be displayed until the value of n.
|
-cpio Device | Writes the current file to the specified device in the cpio command format. |
-ctime n | The value of n can be one of the following:
Note: The definition of -ctime has changed
to comply with the Single UNIX Specification, Version 3. The previous behavior of -ctime evaluated as True if the file had been accessed in n-1 to n multiples of 24 hours. By default, find -ctime works
like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to ON and XPG_UNIX98 to OFF.
The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to ON. Files with i-nodes modified after the find command start time will not be taken into account. However, when the find command is used within the unary NOT operator for non-UNIX03 behavior, files with i-nodes modified after the command start time will be displayed until the value of n. |
-depth | Always evaluates to the value True. Causes the descent of the directory hierarchy to be done so that all entries in a directory are affected before the directory itself is affected. This can be useful when the find command is used with the cpio command to transfer files that are contained in directories without write permission. |
-ea | Evaluates to the value True if file has either access control information (ACL) or Extended attributes (EA) set. |
-exec Command | Evaluates to the value True if the specified command runs and returns a 0 value as exit status. The end of the specified command must be punctuated by a semicolon in quotation marks, an escaped semicolon, or a plus sign. An argument containing the two characters {} (braces) must be followed by a plus sign that punctuates the end of the specified command. A command parameter {} (braces) is replaced by the current path name. |
-follow | Causes symbolic and hard links to be followed. |
-fstype Type | Evaluates to the value True if the file system to which the file belongs is of the specified type. The Type variable has a value of jfs (journaled file system) or nfs (network file system). |
-group Group | Evaluates to the value True if the file belongs to the specified group. If the value of the Group variable is numeric and does not appear in the /etc/group file, it is interpreted as a group ID. |
-inum n | Evaluates to the value True if file has an i-node matching the value of the n variable. |
-links n | Evaluates to the value True if the file has the specified number of links. See the ln command for a description of links. |
-long | Prints all available characters of each user/group name instead of truncating to the first 8 when used in combination with -ls. |
-ls | Always evaluates to the value True. Causes the current path
name to be printed together with its associated statistics. These
statistics include the following:
If the file is a special file, the size field contains the major and minor device numbers. If the file is a symbolic link, the path name of the linked-to file is printed preceded by the -> (hyphen, greater than) symbols. Formatting is similar to that of the ls -filds command, however formatting is done internally without executing the ls command. Therefore, differences in output with the ls command may exist, such as with the protection mode. |
-mmin n | The value of n can be one of the following:
Note: Files modified after the find command
start time will not be taken into account. However, when the find command is used within the unary NOT operator for
non-UNIX03 behavior,
the files modified after the command start time will be displayed
until the value of n.
|
-mtime n | The value of n can be one of the following:
Note: The definition of -mtime has changed
to comply with the Single UNIX Specification, Version 3. The previous behavior of -mtime evaluated as True if
the file had been modified in n-1 to n multiples of
24 hours. By default, find -mtime works
like it did before UNIX03. The UNIX03 behavior can be obtained by setting the environment variables XPG_SUS_ENV to ON and XPG_UNIX98 to OFF.
The previous behavior for this option can be obtained by setting the XPG_UNIX98 variable to ON. Files modified after the find command start time will not be taken into account. However, when the find command is used within the unary NOT operator for non-UNIX03 behavior, the files modified after the command start time will be displayed until the value of n. |
-name File | Evaluates to the value True if the value of the File variable matches the file name. The typical shell filename generation characters (see the sh command) can be used. The pattern must either be enclosed in quotation marks or the escape character used when the find command is used from the shell. A backslash (\) is used as an escape character within the pattern. You can use wildcard (pattern-matching) characters, provided they are in quotation marks. For more information about using wildcard characters, see "Pattern matching with wildcards and metacharacters" in AIX® Version 7.1 Operating system and device management. In an expression such as [a-z], the hyphen means through according to the current collating sequence. A collating sequence may define equivalence classes for use in character ranges. For more information about collating sequences and equivalence classes, see "National Language Support Overview" in the AIX Version 7.1 National Language Support Guide and Reference. |
-newer File | Evaluates to the value True if the current file has been modified more recently than the file indicated by the File variable. |
-nogroup | Evaluates to the value True if the file belongs to a group not in the /etc/group database. |
-nouser | Evaluates to the value True if the file belongs to a user not in the /etc/passwd database. |
-ok Command | The same as the -exec expression, except that the find command asks you whether it should start the specified command. An affirmative response starts the command. The end of the specified command must be punctuated by a semicolon enclosed in quotation marks or the \; (backslash-escape semicolon). |
-perm [ - ] OctalNumber | Evaluates to the value True if the permission code of the file
exactly matches the OctalNumber parameter. For details about
file permissions, refer to the chmod command. If the optional - (hyphen) is present, this expression evaluates to the value
true if at least these permissions are set. The OctalNumber parameter can be up to nine octal digits. Note: For files that
are a part of TCB environment, additional security bits are added
to the permission of the files. These files have the S_ITCB bit set
and the security bit set is defined as 0x010000000. Therefore, the
octal permissions value of a TCB enabled file needs to include the
bit setting of 100000000 along with its other permission bits.
Example: To list a file which is a part of the TCB environment find -perm 100000600 -print. This lists the names of the files that have only owner-read and owner-write permission and are a part of the TCB environment. See the chmod command for an explanation of permission codes. |
-perm [ - ] Mode | The mode argument is used to represent file mode bits. It is identical in format to the <symbolicmode> operand described in chmod, and is interpreted as follows: Initially, a template is assumed with all file mode bits cleared. Op symbols have the following function:
The op symbol - cannot be the first character of mode. This avoids ambiguity with the optional leading hyphen. Because the initial mode is all bits off, there are no symbolic modes that need to use - as the first character. If the hyphen is omitted, the primary evaluates as True when the file permission bits exactly match the value of the resulting template. Otherwise, if mode is prefixed by a hyphen, the primary evaluates as True if at least all bits in the resulting template are set in the file permission bits. The Mode parameter is identical to the chmod command syntax. This expression evaluates to the value True if the file has exactly these permissions. If the optional - (hyphen) is present, this expression evaluates to the value True if at least these permissions are set. |
Always evaluates to the value True. Displays the current path name. The find command assumes a -print expression, unless the -exec, - ls, or -ok expressions are present. | |
-prune | Always evaluates to the value True. Stops the descent of the current path name if it is a directory. If the -depth flag is specified, the -prune flag is ignored. |
-size n | Evaluates to the value True if the file is the specified n of blocks long (512 bytes per block). The file size is rounded up to the nearest block for comparison. |
-size nc | Evaluates to the value True if the file is exactly the specified n of bytes long. Adding c to the end of the n variable indicates that the size of the file is measured in individual bytes not blocks. |
-type Type | Evaluates to the value True if the Type variable specifies
one of the following values:
|
-user User | Evaluates to the value True if the file belongs to the specified user. If the value of the User variable is numeric and does not appear as a login name in the /etc/passwd file, it is interpreted as a user ID. |
-xdev | Always evaluates to the value True. Prevents the find command from traversing a file system different from the one specified by the Path parameter. |
These expressions can be combined using the following operators in the order of decreasing precedence:
This command returns the following exit values:
Item | Description |
---|---|
0 | All Path parameters were traversed successfully. |
>0 | An error occurred. |
find / -name .profile -print
This command searches the entire file system and writes the complete path names of all files named .profile. The / (slash) instructs the find command to search the root directory and all of its subdirectories. In order not to waste time, it is best to limit the search by specifying the directories where you think the files might be.find . -perm 0600 -print
This command lists the names of the files that have only owner-read and owner-write permission. The . (dot) instructs the find command to search the current directory and its subdirectories. See the chmod command for an explanation of permission codes.find manual clients proposals -perm -0600 -print
This command lists the names of the files that have owner-read and owner-write permission and possibly other permissions. The manual, clients, and proposals directories and their subdirectories are searched. In the previous example, -perm 0600 selects only files with permission codes that match 0600 exactly. In this example, -perm -0600 selects files with permission codes that allow the accesses indicated by 0600 and other accesses above the 0600 level. It also matches the permission codes 0622 and 0744.find . -ctime 1 -print
find . -type f -links +1 -print
This command lists the names of the ordinary files (-type f) that have more than one link (-links +1).find . -name '*find*' -print
find / \( -name a.out -o -name '*.o' \) -atime +7 ! -fstype nfs -exec rm {} \;
find . -name SCCS -prune -o -print
To print the path names of all files in or below the current directory, including the names of SCCS directories, type:find . -print -name SCCS -prune
find . -size 414c -print
find /u/arnold -name "*.c" -exec rm {} \;
Every time
the find command identifies a file with the .c suffix,
the rm command deletes that file. The rm command is
the only parameter specified for the -exec expression. The
{} (braces) represent the current path name. find -H dirlink -print
find -L dirlink -print
find -H dirlink -newer dir2
find . -ls -long
find . -ea
find . -mmin -60
Item | Description |
---|---|
/usr/bin/find | Contains the find command. |
/bin/find | Symbolic link to the find command. |
/etc/group | Contains a list of all known groups. |
/etc/passwd | Contains a list of all known users. |