Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Unix find tutorial

Prev | Contents | Next

Part 2: Find logical expressions

Unix find uses its special "search expressions" language to define complex conditions to  locate or ignore particular files and directories.

Expressions consist of multiple predicates (atomic expressions that evaluate to true or false connected by classic Boolean logic operations AND or OR or NOR.

• a  -- to have multiple conditions connected using logical AND.  It is the default connector of individual search terms and explicit AND predicate is rarely used.

  You can also specify as many conditions as you want to be connected with AND. For example, if you want to find the list of files that have been modified in the last 24 hours and have  permission set to 777 (world-writable files), you would execute the following command:

  find . -perm 777  -mtime 0 -print

  Which is the same as:

  find . -perm 777 -a -mtime 0 -a -print

• o  -- to have multiple conditions connected using logical OR. Usually in used in brackets to ensure proper order of evaluation. For example \(-perm -4000 -o -perm -2000 \)
  
• !  -- to negate a condition (logical NOT) . NOT should be specified with a backslash before exclamation point ( \! ). For example

  find . \! -name "*.gz" -exec gzip {} \;

The simplest "find search expression" is just one predicate. for example here is how to list all sub-trees of the current directory:

find . -print

As you can see in this case 'search expression consist of just one predicate (-print). Predicate -print always returns value TRUE, so each file will be printed.  For example, if the system administrator want a list of .profile used by all users, the following command should be executed:

find / -name .profile -print

Here two predicates are connected by implicit AND operation. Another example of expression with two predicate expression is the expression the finds a list of all files (but not directories) modified in the last 24 hours:

find . -mtime 0 -type f

More complex search expression can contain sub-expressions in parentheses which makes "find search language" somewhat similar to regular algebraic expressions.  As parentheses have a special meaning in Unix shell, they should be prefixed with the escape symbol "\"  or used inside single quotes as '(' and ')'. You cannot use single quotes around the entire expression as the find command interpret it as a single element of search expression.  Typically \( expression \)  --  "escaped parentheses" are used to define any composite condition. For example

find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} \;

This example shows that the same predicate can be used in find multiple times.  Any predicate.

For example name can be used this way. In case of -name predicate such usage can simplify regular expressions. For example:

 find / -type f \( -name "*.xls" -o -name "*.csv" \) -exec ls -l {} \;

is simpler then:

find / -regex ".*\.\(xls\|csv\)"

The find command checks the specified predicates and sub-expressions, going from left to right, once for each file or directory encountered.  Here sub-expression \( -perm -4000 -o -perm -2000 \) is evaluated after the predicate "-type f" but before the predicate "-exec ls -l {} \;"

Prev | Contents | Next