一文件查找介绍
文件的查找就是在文件系统上查找符合条件的文件。
文件查找的方式：locate, find
非实时查找也就是基于数据库查找的locate，效率特别高。
实时查找：find
二locate
（一）locate的介绍
查询系统上预建的文件索引数据库：/var/lib/mlocate/mlocate.db，此文件存放了文件的索引。
没有此文件
[root@centos72 ~]# cat /var/lib/mlocate/mlocate.db
cat: /var/lib/mlocate/mlocate.db: No such file or directory
[root@centos72 ~]# ll /var/lib/mlocate/mlocate.db
ls: cannot access /var/lib/mlocate/mlocate.db: No such file or directory
解决办法
[root@centos72 ~]# updatedb
-bash: updatedb: command not found
[root@centos72 ~]# yum whatprovides updatedb
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
aliyun/filelists_db | 7.1 MB 00:00:01
base/filelists_db | 3.1 MB 00:00:00
mlocate-0.26-8.el7.x86_64 : An utility for finding files by name
Repo : aliyun
Matched from:
Filename : /usr/bin/updatedb mlocate-0.26-8.el7.x86_64 : An utility for finding files by name
Repo : base
Matched from:
Filename : /usr/bin/updatedb [root@centos72 ~]# yum install mlocate-0.26-8.el7.x86_64 -y
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package mlocate.x86_64 0:0.26-8.el7 will be installed
--> Finished Dependency Resolution Dependencies Resolved ========================================================================================================
Package Arch Version Repository Size
========================================================================================================
Installing:
mlocate x86_64 0.26-8.el7 aliyun 113 k Transaction Summary
========================================================================================================
Install 1 Package Total download size: 113 k
Installed size: 379 k
Downloading packages:
mlocate-0.26-8.el7.x86_64.rpm | 113 kB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : mlocate-0.26-8.el7.x86_64 1/1
Verifying : mlocate-0.26-8.el7.x86_64 1/1 Installed:
mlocate.x86_64 0:0.26-8.el7 Complete!
/var/lib/mlocate/mlocate.db文件生成了
locate依赖此文件进行文件查找
[root@centos72 ~]# updatedb
[root@centos72 ~]# ll /var/lib/mlocate/mlocate.db
-rw-r----- 1 root slocate 584255 Apr 30 23:12 /var/lib/mlocate/mlocate.db
[root@centos72 ~]# ll /var/lib/mlocate/mlocate.db -h
-rw-r----- 1 root slocate 571K Apr 30 23:12 /var/lib/mlocate/mlocate.db
寻找文件
对于刚刚创建的文件可能查找不到的，而存在了很久的文件瞬间就找到了
[root@centos72 ~]# ls
anaconda-ks.cfg oCam.exe reset1.sh reset.sh tree-1.6.0-10.el7.x86_64.rpm
[root@centos72 ~]# touch aa.txt
[root@centos72 ~]# ls aa.txt -l
-rw-r--r-- 1 root root 0 Apr 30 23:19 aa.txt
[root@centos72 ~]# locate aa.txt
[root@centos72 ~]# locate anaconda-ks.cfg
/root/anaconda-ks.cfg
[root@centos72 ~]# ll anaconda-ks.cfg
-rw-------. 1 root root 1592 Jan 13 00:22 anaconda-ks.cfg
查找文件是模糊查找，贪婪匹配
只要带有关键字就可以马上查找出来
[root@centos72 ~]# locate /etc/profile
/etc/profile
/etc/profile.d
/etc/profile.d/256term.csh
/etc/profile.d/256term.sh
/etc/profile.d/bash_completion.sh
/etc/profile.d/colorgrep.csh
/etc/profile.d/colorgrep.sh
/etc/profile.d/colorls.csh
/etc/profile.d/colorls.sh
/etc/profile.d/csh.local
/etc/profile.d/lang.csh
/etc/profile.d/lang.sh
/etc/profile.d/less.csh
/etc/profile.d/less.sh
/etc/profile.d/sh.local
/etc/profile.d/vim.csh
/etc/profile.d/vim.sh
/etc/profile.d/which2.csh
/etc/profile.d/which2.sh
刚刚创建的文件无法找到是因为locate是依赖于事先构建的数据库索引。
数据库在刚刚创建的文件之后没有进行更新。
索引的构建是在系统较为空闲时自动进行(周期性任务)，管理员手动更新数据库。
索引构建过程需要遍历整个根文件系统，极消耗资源。
数据库一般是一天更新一次，要实现立即查找到此数据库就要更新数据库(updatedb)
对服务器的I/O负载不大。因为在磁盘上查找文件时，是依赖于数据库，不会搜索整个硬盘。所以对服务器的性能影响小。
在windows上搜索需要等待一些时间
[root@centos72 ~]# updatedb
[root@centos72 ~]# ll /var/lib/mlocate/mlocate.db
-rw-r----- 1 root slocate 584275 Apr 30 23:37 /var/lib/mlocate/mlocate.db
[root@centos72 ~]# locate aa.txt
/root/aa.txt
（二）locate的工作特点
查找速度快
模糊查找
非实时查找
搜索的是文件的全路径，不仅仅是文件名。可能只搜索用户具备读取和执行权限的目录
注意普通用户不一定可以可以查找到所有的文件，因为涉及到了权限
下面文件存在于root的家目录里面，普通用户是不能查找的
[root@centos72 ~]# id wang
uid=1000(wang) gid=1000(wang) groups=1000(wang)
[root@centos72 ~]# su - wang
Last login: Tue Apr 23 00:15:36 CST 2019 from gateway on pts/0
[wang@centos72 ~]$ locate aa.txt
（三）locate命令常用的选项
locate命令的使用就是locate KEYWORD
-i 不区分大小写的搜索
-n N 只列举前N个匹配项目
-r 使用正则表达式
[root@centos72 ~]# locate aa.txt
/root/aa.txt
[root@centos72 ~]# locate AA.txt
不区分大小写，选项只要不写在最前面就有效
[root@centos72 ~]# locate AA.txt -i
/root/aa.txt
[root@centos72 ~]# locate -i AA.txt
/root/aa.txt
只列举前几个匹配的项目
[root@centos72 ~]# locate -n 3 /etc/profile
/etc/profile
/etc/profile.d
/etc/profile.d/256term.csh
使用Regex来搜索以“.conf”结尾的文件
[root@centos72 ~]# locate -n 3 -r '\.conf$'
/etc/GeoIP.conf
/etc/asound.conf
/etc/chrony.conf
[root@centos72 ~]# locate -n 3 -r "\.conf$"
/etc/GeoIP.conf
/etc/asound.conf
/etc/chrony.conf
最好加上反斜线进行转义
[root@centos65 ~]# locate -n 3 -r '\.conf$'
/boot/grub/grub.conf
/etc/asound.conf
/etc/cgconfig.conf
[root@centos65 ~]# locate -n 3 -r '.conf$'
/boot/grub/grub.conf
/etc/asound.conf
/etc/cgconfig.conf
[root@centos65 ~]# locate -n 3 -r '.conf$'
/boot/grub/grub.conf
/etc/asound.conf
/etc/cgconfig.conf
三find的介绍
（一）find的介绍
注意这章的重点是find命令
实时查找工具，通过遍历指定路径完成文件查找，定义了各种搜索条件
工作特点：
查找速度略慢
精确查找
实时查找
可能只搜索用户具备读取和执行权限的目录
（二）find的语法
find [OPTION]... [查找路径] [查找条件] [处理动作]
查找路径：指定具体目标路径；默认为当前目录，而且是递归的，也就是会遍历目录里面的子目录，子子目录。
查找条件：指定的查找标准，可以文件名、大小、类型、权限等标准进行；默认为找出指定路径下的所有文件。
处理动作：对符合条件的文件做操作，默认输出至屏幕。
四find工具的使用（查找条件）
find的查找条件，指搜索层级
-maxdepth level 最大搜索目录深度,指定目录为第1级
-mindepth level 最小搜索目录深度
根据文件名和inode查找：
-name "文件名称"：支持使用glob通配符，比如*, ?, [], [^]
-iname "文件名称"：不区分字母大小写
-inum n 按inode号查找
-samefile name 相同inode号的文件
-links n 链接数为n的文件
-regex "PATTERN"：以PATTERN匹配整个文件路径字符串，而不仅仅是文件名称
（一） find的查找条件——指定搜索层级
设置最大2层，那么就包括1层目录
注意文件是存放在第2层目录下的
[root@centos72 ~]# find /etc -maxdepth 2 -name "network"
/etc/sysconfig/network
[root@centos72 ~]# touch /etc/network
[root@centos72 ~]# find /etc -maxdepth 2 -name "network"
/etc/sysconfig/network
/etc/network
搜索最大3层，最小2层和搜索最小2层，最大3层是一样的
其位置不讲究
[root@centos72 ~]# find /etc -mindepth 2 -maxdepth 3 -name "network"
/etc/rc.d/init.d/network
/etc/sysconfig/network
[root@centos72 ~]# find /etc -maxdepth 3 -mindepth 2 -name "network"
/etc/rc.d/init.d/network
/etc/sysconfig/network
只在第1层查找
[root@centos72 ~]# find /etc -maxdepth 1 -name "network"
/etc/network
查找第2层
只在第2层查找，那么最大和最小都是2层
[root@centos72 ~]# find /etc -mindepth 2 -maxdepth 2 -name "network"
/etc/sysconfig/network
（二）根据文件名查找
查找/etc目录下的文件名为fstab的文件，默认是递归
[root@centos72 ~]# find /etc -name "fstab"
/etc/fstab
注意有时候会遇到文件名和目录同名的情况，所以最好指定文件类型
[root@centos71 ~]# find /etc -name "fstab" -type f
/etc/fstab
注意加不加引号都可以的，但是为了严谨还是添加双引号
[root@centos72 ~]# find /etc -name "network"
/etc/rc.d/init.d/network
/etc/sysconfig/network
/etc/vmware-tools/scripts/vmware/network
[root@centos72 ~]# find /etc -name network
/etc/rc.d/init.d/network
/etc/sysconfig/network
/etc/vmware-tools/scripts/vmware/network
[root@centos72 ~]# find /etc -name 'network'
/etc/rc.d/init.d/network
/etc/sysconfig/network
/etc/vmware-tools/scripts/vmware/network
（三）根据文件名查找：-name "文件名称"，并且使用glob*, ?, [ ], [ ^ ]
模糊匹配
下面表示以network开头，后面是字符串，*表示通配符，不是正则表达式
[root@centos72 ~]# find /etc -name "network*"
/etc/rc.d/init.d/network
/etc/systemd/system/network-online.target.wants
/etc/networks
/etc/sysconfig/network-scripts
/etc/sysconfig/network-scripts/network-functions
/etc/sysconfig/network-scripts/network-functions-ipv6
/etc/sysconfig/network
/etc/selinux/targeted/active/modules/100/networkmanager
/etc/vmware-tools/scripts/vmware/network
/etc/network
引号可以不添加，但是为了严谨还是添加双引号，也更好区分
[root@centos72 ~]# find /etc -name network*
/etc/rc.d/init.d/network
/etc/systemd/system/network-online.target.wants
/etc/networks
/etc/sysconfig/network-scripts
/etc/sysconfig/network-scripts/network-functions
/etc/sysconfig/network-scripts/network-functions-ipv6
/etc/sysconfig/network
/etc/selinux/targeted/active/modules/100/networkmanager
/etc/vmware-tools/scripts/vmware/network
/etc/network
注意出现*的时候最好加上引号，以免出错
[root@centos72 ~]# find -name *.txt
./aa.txt
[root@centos72 ~]# find -name "*.txt"
./aa.txt
（四）-inum n 按inode号查找
ls表示动作
find: ‘/proc/sys/fs/binfmt_misc’: No such device
因为此文件是内存里面的，所以就报错了
[root@centos72 ~]# find / -inum 100
find: ‘/proc/sys/fs/binfmt_misc’: No such device
/sys/devices/system/memory/memory0/power/runtime_suspended_time
/sys/kernel/debug/tracing/trace_stat/function56
/usr/share/locale/eo/LC_MESSAGES
[root@centos72 ~]# find / -inum 100 -ls
find: ‘/proc/sys/fs/binfmt_misc’: No such device
100 0 -r--r--r-- 1 root root 4096 May 1 10:24 /sys/devices/system/memory/memory0/power/runtime_suspended_time
100 0 -rw-r--r-- 1 root root 0 May 1 10:09 /sys/kernel/debug/tracing/trace_stat/function56
100 4 drwxr-xr-x 2 root root 4096 Apr 30 09:44 /usr/share/locale/eo/LC_MESSAGES
[root@centos72 ~]# ls /
app bin dev home lib64 mnt proc run srv tmp var
app1 boot etc lib media opt root sbin sys usr
[root@centos72 ~]# ls / -l
total 24
drwxr-xr-x. 2 root root 37 Apr 28 15:29 app
drwxr-xr-x 2 root root 6 Apr 30 11:54 app1
lrwxrwxrwx. 1 root root 7 Jan 13 00:14 bin -> usr/bin
dr-xr-xr-x. 5 root root 162 Apr 30 18:15 boot
drwxr-xr-x 17 root root 3000 May 1 10:10 dev
drwxr-xr-x. 79 root root 8192 May 1 10:10 etc
drwxr-xr-x. 3 root root 18 Jan 13 00:21 home
lrwxrwxrwx. 1 root root 7 Jan 13 00:14 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Jan 13 00:14 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Apr 11 2018 media
drwxr-xr-x. 2 root root 6 Apr 11 2018 mnt
drwxr-xr-x. 2 root root 6 Apr 11 2018 opt
dr-xr-xr-x 107 root root 0 May 1 10:09 proc
dr-xr-x---. 4 root root 4096 May 1 10:26 root
drwxr-xr-x 23 root root 600 May 1 10:10 run
lrwxrwxrwx. 1 root root 8 Jan 13 00:14 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Apr 11 2018 srv
dr-xr-xr-x 13 root root 0 May 1 10:09 sys
drwxrwxrwt. 9 root root 240 May 1 10:26 tmp
drwxr-xr-x. 13 root root 155 Jan 13 00:14 usr
drwxr-xr-x. 21 root root 4096 Apr 30 21:06 var
（五）-samefile name 相同inode号的文件
创建硬链接，搜索节点号相同的文件
如果文件之间是硬链接关系，那么节点号是一样的
[root@centos72 ~]# cd /app
[root@centos72 app]# ls
alias.txt as.txt
[root@centos72 app]# touch bb
[root@centos72 app]# mkdir dd
[root@centos72 app]# ls
alias.txt as.txt bb dd
[root@centos72 app]# ln bb dd/bbbb
[root@centos72 app]# find /app -samefile bb
/app/bb
/app/dd/bbbb
（六）-links n 链接数为n的文件
[root@centos72 app]# ll *
-rw-r--r-- 1 root root 102 Apr 28 15:29 alias.txt
-rw-r--r-- 1 root root 102 Apr 28 15:29 as.txt
-rw-r--r-- 2 root root 0 May 1 10:32 bb dd:
total 0
-rw-r--r-- 2 root root 0 May 1 10:32 bbbb
[root@centos72 app]# ll
total 8
-rw-r--r-- 1 root root 102 Apr 28 15:29 alias.txt
-rw-r--r-- 1 root root 102 Apr 28 15:29 as.txt
-rw-r--r-- 2 root root 0 May 1 10:32 bb
drwxr-xr-x 2 root root 18 May 1 10:33 dd
[root@centos72 app]# find /app -links 1
/app/alias.txt
/app/as.txt
[root@centos72 app]# find /app -links 2
/app/bb
/app/dd
/app/dd/bbbb
（七）-regex "PATTERN"：以PATTERN匹配整个文件路径字符串，而不仅仅是文件名称
搜索以.txt结尾的任意字符串
[root@centos72 ~]# find /root -regex ".*\.txt$"
/root/aa.txt
[root@centos72 ~]# find /root/ -regex ".*\.txt$"
/root/aa.txt
下面是精确匹配，文件名为\.txt
[root@centos72 ~]# find /root/ -regex "\.txt$"
查找以txt和sh后缀的文件
使用基本正则表达式，对（），|都要进行转义
[root@centos72 ~]# find /root -regex ".*\(\.txt\|\.sh\)$"
/root/reset1.sh
/root/aa.txt
/root/reset.sh
可以把点提取出来
[root@centos72 ~]# find /root -regex ".*\.\(txt\|sh\)$"
/root/reset1.sh
/root/aa.txt
/root/reset.sh
（八）根据属主、属组查找
-user USERNAME：查找属主为指定用户(UID)的文件
-group GRPNAME: 查找属组为指定组(GID)的文件
-uid UserID：查找属主为指定的UID号的文件
-gid GroupID：查找属组为指定的GID号的文件
-nouser：查找没有属主的文件
-nogroup：查找没有属组的文件
1）-user USERNAME：查找属主为指定用户(UID)的文件
[root@centos72 ~]# find /home/ -user wang
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
[root@centos72 ~]# find /home -user wang
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
搜索用户是root的并且后缀是sh的文件
使用正则表达式或者通配符
[root@centos72 ~]# find /root -user root -name "*.sh"
/root/reset1.sh
/root/reset.sh
2）-uid UserID：查找属主为指定的UID号的文件
[root@centos72 ~]# id root
uid=0(root) gid=0(root) groups=0(root)
[root@centos72 ~]# find /root -uid 0 -name "*.sh"
/root/reset1.sh
/root/reset.sh
3）-nouser：查找没有属主的文件
因为权限问题，普通用户不能在此目录下创建文件
[root@centos72 app]# su wang
[wang@centos72 app]$ ls
alias.txt as.txt bb dd
[wang@centos72 app]$ touch ssss
touch: cannot touch ‘ssss’: Permission denied
[wang@centos72 app]$ pwd
/app
修改目录权限
[root@centos72 app]# ll -d
drwxr-xr-x. 3 root root 57 May 1 10:32 .
[root@centos72 app]# chmod a+rwx -R /app
[root@centos72 app]# ll -d
drwxrwxrwx. 3 root root 57 May 1 10:32 .
在普通用户下创建文件，然后把此用户删除就会出现没有属主的文件
[root@centos72 app]# id hahaha
uid=1001(hahaha) gid=1001(hahaha) groups=1001(hahaha)
[root@centos72 app]# getent passwd hahaha
hahaha:x:1001:1001::/home/hahaha:/bin/bash
[root@centos72 app]# su hahaha
[hahaha@centos72 app]$ ls
alias.txt as.txt bb dd
[hahaha@centos72 app]$ touch fffff
[hahaha@centos72 app]$ ls
alias.txt as.txt bb dd fffff
[hahaha@centos72 app]$ exit
exit
[root@centos72 app]# userdel -r hahaha
[root@centos72 app]# id hahaha
id: hahaha: no such user
[root@centos72 app]# ll
total 8
-rwxrwxrwx 1 root root 102 Apr 28 15:29 alias.txt
-rwxrwxrwx 1 root root 102 Apr 28 15:29 as.txt
-rwxrwxrwx 2 root root 0 May 1 10:32 bb
drwxrwxrwx 2 root root 18 May 1 10:33 dd
-rw-rw-r-- 1 1001 1001 0 May 1 11:30 fffff
[root@centos72 app]# find -nouser
./fffff
4）-nogroup：查找没有属组的文件
前面创建的文件没有属主和属组
[root@centos72 app]# find -nogroup
./fffff
（九）根据文件类型查找
-type TYPE:
- f: 普通文件
- d: 目录文件
- l: 符号链接文件
- s：套接字文件
- b: 块设备文件
- c: 字符设备文件
- p: 管道文件
s：套接字文件
[root@centos72 ~]# find / -type s
/dev/log
find: ‘/proc/sys/fs/binfmt_misc’: No such device
/run/vmware/guestServicePipe
/run/chrony/chronyd.sock
/run/dbus/system_bus_socket
/run/udev/control
/run/systemd/shutdownd
/run/systemd/private
/run/systemd/journal/socket
/run/systemd/journal/stdout
/run/systemd/cgroups-agent
/run/systemd/notify
/var/spool/postfix/private/tlsmgr
/var/spool/postfix/private/rewrite
/var/spool/postfix/private/bounce
/var/spool/postfix/private/defer
/var/spool/postfix/private/trace
/var/spool/postfix/private/verify
/var/spool/postfix/private/proxymap
/var/spool/postfix/private/proxywrite
/var/spool/postfix/private/smtp
/var/spool/postfix/private/relay
/var/spool/postfix/private/error
/var/spool/postfix/private/retry
/var/spool/postfix/private/discard
/var/spool/postfix/private/local
/var/spool/postfix/private/virtual
/var/spool/postfix/private/lmtp
/var/spool/postfix/private/anvil
/var/spool/postfix/private/scache
/var/spool/postfix/public/pickup
/var/spool/postfix/public/cleanup
/var/spool/postfix/public/qmgr
/var/spool/postfix/public/flush
/var/spool/postfix/public/showq
[root@centos72 ~]# find /run -type s
/run/vmware/guestServicePipe
/run/chrony/chronyd.sock
/run/dbus/system_bus_socket
/run/udev/control
/run/systemd/shutdownd
/run/systemd/private
/run/systemd/journal/socket
/run/systemd/journal/stdout
/run/systemd/cgroups-agent
/run/systemd/notify
显示详细的属性
[root@centos72 ~]# find /run -type s -ls
18000 0 srw-rw-rw- 1 root root 0 May 1 10:10 /run/vmware/guestServicePipe
17534 0 srwxr-xr-x 1 chrony chrony 0 May 1 10:10 /run/chrony/chronyd.sock
17039 0 srw-rw-rw- 1 root root 0 May 1 10:10 /run/dbus/system_bus_socket
15069 0 srw------- 1 root root 0 May 1 10:10 /run/udev/control
14962 0 srw------- 1 root root 0 May 1 10:10 /run/systemd/shutdownd
14913 0 srwxrwxrwx 1 root root 0 May 1 10:10 /run/systemd/private
9972 0 srw-rw-rw- 1 root root 0 May 1 10:09 /run/systemd/journal/socket
9970 0 srw-rw-rw- 1 root root 0 May 1 10:09 /run/systemd/journal/stdout
9960 0 srwx------ 1 root root 0 May 1 10:09 /run/systemd/cgroups-agent
9958 0 srwxrwxrwx 1 root root 0 May 1 10:09 /run/systemd/notify
d: 目录文件
[root@centos72 ~]# find /root -type d
/root
/root/.ssh
/root/.pki
/root/.pki/nssdb
[root@centos72 ~]# find /root -type d -ls
100663361 8 dr-xr-x--- 4 root root 4096 May 1 10:26 /root
100703772 0 drwx------ 2 root root 25 Apr 15 23:37 /root/.ssh
34006530 0 drwxr----- 3 root root 19 Apr 30 09:21 /root/.pki
67528002 0 drwxr----- 2 root root 6 Apr 30 09:21 /root/.pki/nssdb
如果是搜索当前目录，那么也可以不写明路径
[root@centos72 ~]# find -type d -ls
100663361 8 dr-xr-x--- 4 root root 4096 May 1 10:26 .
100703772 0 drwx------ 2 root root 25 Apr 15 23:37 ./.ssh
34006530 0 drwxr----- 3 root root 19 Apr 30 09:21 ./.pki
67528002 0 drwxr----- 2 root root 6 Apr 30 09:21 ./.pki/nssdb
[root@centos72 ~]# find . -type d -ls
100663361 8 dr-xr-x--- 4 root root 4096 May 1 10:26 .
100703772 0 drwx------ 2 root root 25 Apr 15 23:37 ./.ssh
34006530 0 drwxr----- 3 root root 19 Apr 30 09:21 ./.pki
67528002 0 drwxr----- 2 root root 6 Apr 30 09:21 ./.pki/nssdb
（十）组合条件
- 与：-a
- 或：-o
- 非：-not, !
注意多个条件默认是并且，所以可以不添加-a
[root@centos72 ~]# find /root -uid 0 -name "*.sh"
/root/reset1.sh
/root/reset.sh
[root@centos72 ~]# find /root -uid 0 -a -name "*.sh"
/root/reset1.sh
/root/reset.sh
或：-o
[root@centos72 ~]# find /root -uid 0 -o -name "*.sh"
/root
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh
/root/.ssh/known_hosts
/root/reset1.sh
/root/.pki
/root/.pki/nssdb
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
非：-not, !
[root@centos72 ~]# find /root -uid 0 ! -name "*.sh"
/root
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh
/root/.ssh/known_hosts
/root/.pki
/root/.pki/nssdb
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/.bashrc
/root/.lesshst
[root@centos72 ~]# find /root -uid 0 -not -name "*.sh"
/root
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh
/root/.ssh/known_hosts
/root/.pki
/root/.pki/nssdb
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/.bashrc
/root/.lesshst
（十一）德·摩根定律
在shell脚本里面的文件判断有涉及到此知识点
(非 A) 或 (非 B) = 非(A 且 B)
(非 A) 且 (非 B) = 非(A 或 B)
既不是root用户的文件，也不是后缀为sh的文件
[root@centos72 ~]# find /home ! -uid 0 -a ! -name "*.sh"
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
[root@centos72 ~]#
使用括号括起来，要在括号前面添加斜线转义
[root@centos72 ~]# find /home ! \( -uid 0 -o -name "*.sh" \)
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
[root@centos72 ~]# find /home -not \( -uid 0 -o -name "*.sh" \)
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
（十二）根据文件大小来查找
-size [+|-]#UNIT
常用单位：k, M, G，c（byte）
#UNIT: (#-1, #]
如：6k 表示(5k,6k]
-#UNIT：[0,#-1]
如：-6k 表示[0,5k]
+#UNIT：(#, ∞ )
如：+6k 表示(6k ,∞ )
创建文件
[root@centos72 ~]# dd if=/dev/zero of=f1 bs=1 count=1024
1024+0 records in
1024+0 records out
1024 bytes (1.0 kB) copied, 0.00146332 s, 700 kB/s
[root@centos72 ~]# ls
aa.txt anaconda-ks.cfg f1 oCam.exe reset1.sh reset.sh tree-1.6.0-10.el7.x86_64.rpm
[root@centos72 ~]# ls -lth
total 5.3M
-rw-r--r-- 1 root root 1.0K May 1 20:07 f1
-rw-r--r-- 1 root root 0 Apr 30 23:19 aa.txt
-rw-r--r-- 1 root root 47K Apr 30 22:00 tree-1.6.0-10.el7.x86_64.rpm
-rw-r--r-- 1 root root 275 Apr 28 23:17 reset1.sh
-rw-r--r-- 1 root root 210 Apr 28 23:01 reset.sh
-rw-------. 1 root root 1.6K Jan 13 00:22 anaconda-ks.cfg
-rw-r--r-- 1 root root 5.2M Oct 19 2018 oCam.exe
[root@centos72 ~]# ll f1
-rw-r--r-- 1 root root 1024 May 1 20:07 f1
[root@centos72 ~]# ll f1 -h
-rw-r--r-- 1 root root 1.0K May 1 20:07 f1
注意是小写的k
查找的是1k,但是显示的文件有小于1k的
[root@centos72 ~]# find -size 1k
./.bash_logout
./.bash_profile
./.cshrc
./.tcshrc
./.ssh
./.ssh/known_hosts
./reset1.sh
./.pki
./.pki/nssdb
./f1
./.bashrc
./.lesshst
./reset.sh[root@centos72 ~]# ll ./.ssh
total 4
-rw-r--r--. 1 root root 352 Apr 17 10:49 known_hosts
[root@centos72 ~]# ll ./.bashrc
-rw-r--r--. 1 root root 229 Apr 17 11:35 ./.bashrc
[root@centos72 ~]# ll ./.ssh/known_hosts
-rw-r--r--. 1 root root 352 Apr 17 10:49 ./.ssh/known_hosts
写上最小单位字节可以精确的找出来
[root@centos72 ~]# find -size 1024
[root@centos72 ~]# find -size 1024
[root@centos72 ~]# find -size 1024
[root@centos72 ~]# find -size 1024c
./f1
[root@centos72 ~]# find -size 1024c
./f1
[root@centos72 ~]# find -size 1024c
./f1
创建新的文件
[root@centos72 ~]# ls
aa.txt anaconda-ks.cfg f1 oCam.exe reset1.sh reset.sh tree-1.6.0-10.el7.x86_64.rpm
[root@centos72 ~]# dd if=/dev/zero of=f2 bs=1 count=2048
2048+0 records in
2048+0 records out
2048 bytes (2.0 kB) copied, 0.00258822 s, 791 kB/s
[root@centos72 ~]# ll f2
-rw-r--r-- 1 root root 2048 May 2 01:03 f2
[root@centos72 ~]# find -size 2048c
./f2
文件单位是k,那么查找的时候显示的是一个范围，而不是很精确的
如果是查找2k，实际上查找的是1k到2k，不包括1k
因为搜索出来的精确大小的文件意义不大
[root@centos72 ~]# find -size 2K
find: invalid -size type `K'
[root@centos72 ~]# find -size 2k
./anaconda-ks.cfg
./f2
[root@centos72 ~]# ll anaconda-ks.cfg
-rw-------. 1 root root 1592 Jan 13 00:22 anaconda-ks.cfg
[root@centos72 ~]# dd if=/dev/zero of=f3 bs=1 count=2000
2000+0 records in
2000+0 records out
2000 bytes (2.0 kB) copied, 0.00333845 s, 599 kB/s
[root@centos72 ~]# ls
aa.txt anaconda-ks.cfg f1 f2 f3 oCam.exe reset1.sh reset.sh tree-1.6.0-10.el7.x86_64.rpm
[root@centos72 ~]# ll f3
-rw-r--r-- 1 root root 2000 May 2 01:10 f3
[root@centos72 ~]# find -size 2k
./anaconda-ks.cfg
./f2
./f3
下面是精确匹配，因为搜索范围是在2047字节到2048字节，不包括2047
问题字节和位的关系
[root@centos72 ~]# find -size 2048c
./f2
[root@centos72 ~]# ll f2
-rw-r--r-- 1 root root 2048 May 2 01:03 f2
不包括0字节即可
文件大小在0G到1G之间
[root@centos72 ~]# find -size 1G
.
./oCam.exe
./.bash_logout
./.bash_profile
./.cshrc
./.tcshrc
./anaconda-ks.cfg
./.bash_history
./.ssh
./.ssh/known_hosts
./reset1.sh
./.pki
./.pki/nssdb
./tree-1.6.0-10.el7.x86_64.rpm
./.viminfo
./f1
./f2
./f3
./.bashrc
./.lesshst
./reset.sh
[root@centos72 ~]# find -size 1M
.
./.bash_logout
./.bash_profile
./.cshrc
./.tcshrc
./anaconda-ks.cfg
./.bash_history
./.ssh
./.ssh/known_hosts
./reset1.sh
./.pki
./.pki/nssdb
./tree-1.6.0-10.el7.x86_64.rpm
./.viminfo
./f1
./f2
./f3
./.bashrc
./.lesshst
./reset.sh
为了查找到接近1G大小的文件，使用M查找会更好
[root@centos72 ~]# find / -size 1024M
find: ‘/proc/sys/fs/binfmt_misc’: No such device
find: ‘/proc/81475/task/81475/fd/6’: No such file or directory
find: ‘/proc/81475/task/81475/fdinfo/6’: No such file or directory
find: ‘/proc/81475/fd/5’: No such file or directory
find: ‘/proc/81475/fdinfo/5’: No such file or directory
#UNIT: (#-1, #]
如：6k 表示(5k,6k]
-#UNIT：[0,#-1]
如：-6k 表示[0,5k]
+#UNIT：(#, ∞ )
如：+6k 表示(6k ,∞]
假设以6k为搜索条件，那么查找是（5k,6k]
涉及到了数学的集合，（表示开区间，]表示闭区间
-6k为搜索条件，那么查找的是[-∞,6k),因为没有-∞，所以实际上就是[0,5k)
+6k为搜索条件，那么查找的是（6k，+∞)
查找大于50M，小于100M的文件？
[root@centos72 ~]# find / -size +50M -size -100M
find: ‘/proc/sys/fs/binfmt_misc’: No such device
find: ‘/proc/82395/task/82395/fd/6’: No such file or directory
find: ‘/proc/82395/task/82395/fdinfo/6’: No such file or directory
find: ‘/proc/82395/fd/5’: No such file or directory
find: ‘/proc/82395/fdinfo/5’: No such file or directory
/var/lib/rpm/Packages
[root@centos72 ~]# find /etc/ -size +50M -size -100M
下面是正确写法，如果技术部的人觉得很奇怪那么就在后面写上注释
[root@centos72 ~]# find /etc/ -size +50M -size -101M
（十三）根据时间戳
以“天”为单位；
-atime [+|-]#,
#: [#,#+1)
+#: [#+1, ∞ ]
-#: [0,#)
以3天为例，那么#就表示3天多的时间，+#表示4天及以上，-#表示3天以下的。
-mtime
-ctime
以“分钟”为单位：
-amin
-mmin
-cmin
查看最近1分钟之内发生变化的文件，不到1分钟
[root@centos72 ~]# useradd caicaaicai
[root@centos72 ~]# find /etc/ -mmin -1
/etc/
/etc/group
/etc/gshadow
/etc/passwd
/etc/shadow
[root@centos72 ~]# ll /etc/group
-rw-r--r-- 1 root root 563 May 2 14:05 /etc/group
[root@centos72 ~]# ll /etc/passwd
-rw-r--r-- 1 root root 1161 May 2 14:05 /etc/passwd
[root@centos72 ~]# ll /etc/shadow
---------- 1 root root 857 May 2 14:05 /etc/shadow
查找大于20个字节，小于30个字节的文件，并且文件后缀是conf结尾的
使用正则表达式*.conf即可
[root@centos72 ~]# find / -size +20c -size -31c -name "*.conf"
find: ‘/proc/sys/fs/binfmt_misc’: No such device
/run/systemd/system/session-29.scope.d/50-TasksMax.conf
/run/systemd/system/session-29.scope.d/50-SendSIGHUP.conf
/run/systemd/system/session-29.scope.d/50-Slice.conf
/run/systemd/system/user-0.slice.d/50-TasksMax.conf
/etc/ld.so.conf
/usr/lib/dracut/dracut.conf.d/01-microcode.conf
/usr/lib/dracut/dracut.conf.d/02-rescue.conf
/usr/lib/tmpfiles.d/rpm.conf
[root@centos72 ~]# ll /run/systemd/system/session-29.scope.d/50-TasksMax.conf -rw-r--r-- 1 root root 26 May 2 12:34 /run/systemd/system/session-29.scope.d/50-TasksMax.conf
[root@centos72 ~]# ll /etc/ld.so.conf
-rw-r--r--. 1 root root 28 Feb 28 2013 /etc/ld.so.conf
（十四）根据权限查找
-perm [/|-] MODE
perm是permission的简写。
MODE: 精确权限匹配
/MODE：任何一类(u,g,o)对象的权限中只要能一位匹配即可，或关系。
因为表示并且的关系情况就少，所以+
注意+ 从centos7开始淘汰。
-MODE：每一类对象都必须同时拥有指定权限，与关系。因为表示并且的关系情况就少，所以-
0 表示不关注，在精确匹配里面是指无权限。
find -perm 755 会匹配权限模式恰好是755的文件
只要当任意人有写权限时，find -perm +222就会匹配
只有当每个人都有写权限时，find -perm -222才会匹配
只有当其它人（other）有写权限时，find -perm -002才会匹配
[root@centos72 ~]# find -perm 600
./anaconda-ks.cfg
./.bash_history
./.viminfo
./.lesshst
[root@centos72 ~]# find -perm 644
./oCam.exe
./.bash_logout
./.bash_profile
./.cshrc
./.tcshrc
./.ssh/known_hosts
./reset1.sh
./tree-1.6.0-10.el7.x86_64.rpm
./aa.txt
./f1
./f2
./f3
./.bashrc
./reset.sh
搜索普通文件，非目录
[root@centos72 ~]# ll oCam.exe
-rw-r--r-- 1 root root 5447024 Oct 19 2018 oCam.exe
[root@centos72 ~]# ll f*
-rw-r--r-- 1 root root 1024 May 1 20:07 f1
-rw-r--r-- 1 root root 2048 May 2 01:03 f2
-rw-r--r-- 1 root root 2000 May 2 01:10 f3
/MODE：任何一类(u,g,o)对象的权限中只要能一位匹配即可，或关系，+ 从centos7开始淘汰
只要其中一个有读权限即可
[root@centos72 ~]# find /root -perm /444 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f1
/root/f2
/root/f3
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
[root@centos72 ~]# ll /root/oCam.exe
-rw-r--r-- 1 root root 5447024 Oct 19 2018 /root/oCam.exe
[root@centos72 ~]# ll /root/aa.txt
-rw-r--r-- 1 root root 0 Apr 30 23:19 /root/aa.txt
[root@centos72 ~]# ll /root/.bashrc
-rw-r--r--. 1 root root 229 Apr 17 11:35 /root/.bashrc
修改文件权限，f1只有所有者有读权限
[root@centos72 ~]# ll f*
-rw-r--r-- 1 root root 1024 May 1 20:07 f1
-rw-r--r-- 1 root root 2048 May 2 01:03 f2
-rw-r--r-- 1 root root 2000 May 2 01:10 f3
[root@centos72 ~]# chmod 400 f1
[root@centos72 ~]# ll f*
-r-------- 1 root root 1024 May 1 20:07 f1
-rw-r--r-- 1 root root 2048 May 2 01:03 f2
-rw-r--r-- 1 root root 2000 May 2 01:10 f3
f1依然可以被查找到
[root@centos72 ~]# find /root -perm /444 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f1
/root/f2
/root/f3
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
并且的关系，3种人每个人都要有读权限才可以
[root@centos72 ~]# find /root -perm -444 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f2
/root/f3
/root/.bashrc
/root/reset.sh
[root@centos72 ~]# ll /root/f2
-rw-r--r-- 1 root root 2048 May 2 01:03 /root/f2
指定类对象不参与到条件测试里面，那么就在此对象的权限上写0
440表示所有者和所属组都要同时具有读和写权限
[root@centos72 ~]# find /root -perm -440 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f2
/root/f3
/root/.bashrc
/root/reset.sh
只要所有者或者所属组只要有一个有读权限即可，其他人不关心
[root@centos72 ~]# find /root -perm /440 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f1
/root/f2
/root/f3
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
下面是精确匹配
[root@centos72 ~]# find /root -perm 440 -type f
[root@centos72 ~]# chmod 440 f1
[root@centos72 ~]# chmod 440 f2
[root@centos72 ~]# chmod 440 f3
[root@centos72 ~]# ll f*
-r--r----- 1 root root 1024 May 1 20:07 f1
-r--r----- 1 root root 2048 May 2 01:03 f2
-r--r----- 1 root root 2000 May 2 01:10 f3
[root@centos72 ~]# find /root -perm 440 -type f
/root/f1
/root/f2
/root/f3
查找3种人只要其中一个有写的权限
[root@centos72 ~]# find /root -perm /222 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
[root@centos72 ~]# ll /root/.bashrc
-rw-r--r--. 1 root root 229 Apr 17 11:35 /root/.bashrc
[root@centos72 ~]# ll /root/oCam.exe
-rw-r--r-- 1 root root 5447024 Oct 19 2018 /root/oCam.exe
所有人都有写权限
[root@centos72 ~]# find /root -perm -222 -type f
[root@centos72 ~]# chmod a+w f*
[root@centos72 ~]# ll f*
-rw-rw--w- 1 root root 1024 May 1 20:07 f1
-rw-rw--w- 1 root root 2048 May 2 01:03 f2
-rw-rw--w- 1 root root 2000 May 2 01:10 f3
[root@centos72 ~]# find /root -perm -222 -type f
/root/f1
/root/f2
/root/f3
注意如果是3个0那么就表示全部文件，这样查找是没有意义的
[root@centos72 ~]# find /root -perm /000 -type f
find: warning: you have specified a mode pattern /000 (which is equivalent to /000). The meaning of -perm /000 has now been changed to be consistent with -perm -000; that is, while it used to match no files, it now matches all files.
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f1
/root/f2
/root/f3
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
[root@centos72 ~]# find /root -perm -000 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/f1
/root/f2
/root/f3
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
精确匹配，权限是000的
[root@centos72 ~]# find /root -perm 000 -type f
只有当其它人（other）有写权限时，find -perm -002才会匹配
只有1个条件，或和并是没区别的
[root@centos72 ~]# find /root -perm -002 -type f
/root/f1
/root/f2
/root/f3
[root@centos72 ~]# find /root -perm /002 -type f
/root/f1
/root/f2
/root/f3
[root@centos72 ~]# find /root -perm 002 -type f
[root@centos72 ~]# ll f*
-rw-rw--w- 1 root root 1024 May 1 20:07 f1
-rw-rw--w- 1 root root 2048 May 2 01:03 f2
-rw-rw--w- 1 root root 2000 May 2 01:10 f3
五处理动作
-print：默认的处理动作，显示至屏幕
-ls：类似于对查找到的文件执行“ls -l”命令
-delete：删除查找到的文件
-fls file：查找到的所有文件的长格式信息保存至指定文件中
-ok COMMAND {} \; 对查找到的每个文件执行由 COMMAND指定的命令，对于每个文件执行命令之前，都会交互式要求用户确认
[root@centos72 ~]# find /root -perm 002 -type f -print
[root@centos72 ~]# find /root -perm /002 -type f -print
/root/f1
/root/f2
/root/f3
[root@centos72 ~]# find /root -perm -002 -type f -print
/root/f1
/root/f2
/root/f3
[root@centos72 ~]# ll f*
-rw-rw--w- 1 root root 1024 May 1 20:07 f1
-rw-rw--w- 1 root root 2048 May 2 01:03 f2
-rw-rw--w- 1 root root 2000 May 2 01:10 f3
-ls：类似于对查找到的文件执行“ls -l”命令
[root@centos72 ~]# ll f*
-rw-rw--w- 1 root root 1024 May 1 20:07 f1
-rw-rw--w- 1 root root 2048 May 2 01:03 f2
-rw-rw--w- 1 root root 2000 May 2 01:10 f3
[root@centos72 ~]# find /root -perm -002 -type f -print -ls
/root/f1
100663523 4 -rw-rw--w- 1 root root 1024 May 1 20:07 /root/f1
/root/f2
100663548 4 -rw-rw--w- 1 root root 2048 May 2 01:03 /root/f2
/root/f3
100663550 4 -rw-rw--w- 1 root root 2000 May 2 01:10 /root/f3
-delete：删除查找到的文件
此命令很危险，最好不要使用
[root@centos72 ~]# find /root -perm -002 -type f -delete
[root@centos72 ~]# ll f*
ls: cannot access f*: No such file or directory
[root@centos72 ~]# ls f*
ls: cannot access f*: No such file or directory
[root@centos72 ~]#
-fls file：查找到的所有文件的长格式信息保存至指定文件中
[root@centos72 ~]# find /root -perm /202 -type f
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/.bashrc
/root/.lesshst
/root/reset.sh
[root@centos72 ~]# find /root -perm /202 -type f > 202.txt
[root@centos72 ~]# cat 202.txt
/root/oCam.exe
/root/.bash_logout
/root/.bash_profile
/root/.cshrc
/root/.tcshrc
/root/anaconda-ks.cfg
/root/.bash_history
/root/.ssh/known_hosts
/root/reset1.sh
/root/tree-1.6.0-10.el7.x86_64.rpm
/root/aa.txt
/root/.viminfo
/root/202.txt
/root/.bashrc
/root/.lesshst
/root/reset.sh
以长格式保存
[root@centos72 ~]# find /root -perm /202 -type f -ls > 202.txt
[root@centos72 ~]# cat 202.txt
100663373 5320 -rw-r--r-- 1 root root 5447024 Oct 19 2018 /root/oCam.exe
100895678 4 -rw-r--r-- 1 root root 18 Dec 29 2013 /root/.bash_logout
100895679 4 -rw-r--r-- 1 root root 176 Dec 29 2013 /root/.bash_profile
100895681 4 -rw-r--r-- 1 root root 100 Dec 29 2013 /root/.cshrc
100895682 4 -rw-r--r-- 1 root root 129 Dec 29 2013 /root/.tcshrc
100663363 4 -rw------- 1 root root 1592 Jan 13 00:22 /root/anaconda-ks.cfg
100702753 32 -rw------- 1 root root 32684 May 2 14:55 /root/.bash_history
100703790 4 -rw-r--r-- 1 root root 352 Apr 17 10:49 /root/.ssh/known_hosts
100663521 4 -rw-r--r-- 1 root root 275 Apr 28 23:17 /root/reset1.sh
100663522 48 -rw-r--r-- 1 root root 47509 Apr 30 22:00 /root/tree-1.6.0-10.el7.x86_64.rpm
100663547 0 -rw-r--r-- 1 root root 0 Apr 30 23:19 /root/aa.txt
100663549 12 -rw------- 1 root root 8536 May 2 14:40 /root/.viminfo
100663523 0 -rw-r--r-- 1 root root 0 May 2 16:22 /root/202.txt
100708088 4 -rw-r--r-- 1 root root 229 Apr 17 11:35 /root/.bashrc
100663365 4 -rw------- 1 root root 85 Apr 30 21:46 /root/.lesshst
100708048 4 -rw-r--r-- 1 root root 210 Apr 28 23:01 /root/reset.sh
[root@centos72 ~]# find /root -perm /202 -type f -fls 2.txt
[root@centos72 ~]# cat 2.txt
100663373 5320 -rw-r--r-- 1 root root 5447024 Oct 19 2018 /root/oCam.exe
100895678 4 -rw-r--r-- 1 root root 18 Dec 29 2013 /root/.bash_logout
100895679 4 -rw-r--r-- 1 root root 176 Dec 29 2013 /root/.bash_profile
100895681 4 -rw-r--r-- 1 root root 100 Dec 29 2013 /root/.cshrc
100895682 4 -rw-r--r-- 1 root root 129 Dec 29 2013 /root/.tcshrc
100663363 4 -rw------- 1 root root 1592 Jan 13 00:22 /root/anaconda-ks.cfg
100702753 32 -rw------- 1 root root 32684 May 2 14:55 /root/.bash_history
100703790 4 -rw-r--r-- 1 root root 352 Apr 17 10:49 /root/.ssh/known_hosts
100663521 4 -rw-r--r-- 1 root root 275 Apr 28 23:17 /root/reset1.sh
100663522 48 -rw-r--r-- 1 root root 47509 Apr 30 22:00 /root/tree-1.6.0-10.el7.x86_64.rpm
100663547 0 -rw-r--r-- 1 root root 0 Apr 30 23:19 /root/aa.txt
100663549 12 -rw------- 1 root root 8536 May 2 14:40 /root/.viminfo
100663523 4 -rw-r--r-- 1 root root 1403 May 2 16:22 /root/202.txt
100663548 0 -rw-r--r-- 1 root root 0 May 2 16:23 /root/2.txt
100708088 4 -rw-r--r-- 1 root root 229 Apr 17 11:35 /root/.bashrc
100663365 4 -rw------- 1 root root 85 Apr 30 21:46 /root/.lesshst
100708048 4 -rw-r--r-- 1 root root 210 Apr 28 23:01 /root/reset.sh
-ok COMMAND {} \; 对查找到的每个文件执行由 COMMAND指定的命令
对于每个文件执行命令之前，都会交互式要求用户确认
对查找到的文件进行备份
{}表示查找到的文件名，并且对其备份
[root@centos72 ~]# ll /app
total 8
-rwxrwxrwx 1 root root 102 Apr 28 15:29 alias.txt
-rwxrwxrwx 1 root root 102 Apr 28 15:29 as.txt
-rwxrwxrwx 2 root root 0 May 1 10:32 bb
drwxrwxrwx 2 root root 18 May 1 10:33 dd
-rw-rw-r-- 1 zhang zhang 0 May 1 11:30 fffff
[root@centos72 ~]# ls /app
alias.txt as.txt bb dd fffff
[root@centos72 ~]# find -name "*.txt" -ok cp {} /app{}.bak \;
< cp ... ./aa.txt > ? y
cp: cannot create regular file ‘/app./aa.txt.bak’: No such file or directory
< cp ... ./202.txt > ? y
cp: cannot create regular file ‘/app./202.txt.bak’: No such file or directory
< cp ... ./2.txt > ? y
cp: cannot create regular file ‘/app./2.txt.bak’: No such file or directory
[root@centos72 ~]# ls /app
alias.txt as.txt bb dd fffff
注意细节，写成/app/，而不是/app
[root@centos72 ~]# find -name "*.txt" -ok cp {} /app/{}.bak \;
< cp ... ./aa.txt > ? y
< cp ... ./202.txt > ? y
< cp ... ./2.txt > ? y
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff
[root@centos72 ~]# ls /app -l
total 16
-rw-r--r-- 1 root root 1403 May 2 16:31 202.txt.bak
-rw-r--r-- 1 root root 1485 May 2 16:31 2.txt.bak
-rw-r--r-- 1 root root 0 May 2 16:31 aa.txt.bak
-rwxrwxrwx 1 root root 102 Apr 28 15:29 alias.txt
-rwxrwxrwx 1 root root 102 Apr 28 15:29 as.txt
-rwxrwxrwx 2 root root 0 May 1 10:32 bb
drwxrwxrwx 2 root root 18 May 1 10:33 dd
-rw-rw-r-- 1 zhang zhang 0 May 1 11:30 fffff
上面的方法每次都要询问，下面的方法直接执行
-exec COMMAND {} \; 对查找到的每个文件执行由COMMAND指定的命令
只要前面是exec或者ok后面都必须要加上\;
[root@centos72 ~]# find -name "*.sh"
./reset1.sh
./reset.sh
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff
[root@centos72 ~]# find -name "*.txt" -exec cp {} /app/{}.bak \;
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff
[root@centos72 ~]# find -name "*.sh" -exec cp {} /app/{}.bak \;
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff reset1.sh.bak reset.sh.bak
六参数替换xargs
由于很多命令不支持管道|来传递参数，而日常工作中有这个必要，所以就有了xargs命令
xargs用于产生某个命令的参数，xargs 可以读入 stdin 的数据，并且以空格符或回车符将 stdin 的数据分隔成为arguments
注意：文件名或者是其他意义的名词内含有空格符的情况。
有些命令不能接受过多参数，命令执行可能会失败，xargs可以解决
常见配合： find和xargs格式：find | xargs COMMAND
表示find命令查找到的文件作为后面命令的参数
查看节点号
[root@centos72 ~]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda2 26214400 36359 26178041 1% /
devtmpfs 121493 380 121113 1% /dev
tmpfs 124486 1 124485 1% /dev/shm
tmpfs 124486 718 123768 1% /run
tmpfs 124486 16 124470 1% /sys/fs/cgroup
/dev/sda3 10485760 13 10485747 1% /app
/dev/sda1 524288 333 523955 1% /boot
tmpfs 124486 1 124485 1% /run/user/0
/dev/sr0 0 0 0 - /mnt
[root@centos72 ~]# df -ih
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda2 25M 36K 25M 1% /
devtmpfs 119K 380 119K 1% /dev
tmpfs 122K 1 122K 1% /dev/shm
tmpfs 122K 718 121K 1% /run
tmpfs 122K 16 122K 1% /sys/fs/cgroup
/dev/sda3 10M 13 10M 1% /app
/dev/sda1 512K 333 512K 1% /boot
tmpfs 122K 1 122K 1% /run/user/0
/dev/sr0 0 0 0 - /mnt
使用xargs创建文件
创建的速度很快，创建的文件个数和节点数没有关系
因为是一个个传递参数就可以突破参数个数的极限
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff reset1.sh.bak reset.sh.bak
[root@centos72 ~]# echo /app/test{1..10000} | xargs touch
[root@centos72 ~]# ls /app/test* | wc
10000 10000
如果是使用下面这种方法，那么参数太多了
touch命令后面跟的参数不能太多
[root@centos72 ~]# touch /app/test{1..10000}
直接把刚才创建的10000个文件删除了
[root@centos72 ~]# echo /app/test{1..10000} | xargs rm
[root@centos72 ~]# ls /app
202.txt.bak 2.txt.bak aa.txt.bak alias.txt as.txt bb dd fffff reset1.sh.bak reset.sh.bak
创建的文件太多了，无法显示也无法删除
[root@centos72 ~]# echo /app/test{1..100000} | xargs touch
[root@centos72 ~]# ls /app/test* | wc
-bash: /usr/bin/ls: Argument list too long
0 0 0
[root@centos72 ~]# ls /app/test* | grep test1
-bash: /usr/bin/ls: Argument list too long
[root@centos72 ~]# ls /app/test* | grep test100000
-bash: /usr/bin/ls: Argument list too long
[root@centos72 ~]# rm -rf /app/test*
-bash: /usr/bin/rm: Argument list too long
[root@centos72 ~]# echo /app/test{1..100000} | xargs touch
[root@centos72 ~]# find /app -name "test*" -type f | xargs rm
[root@centos72 ~]# ls /app
dd
[root@centos72 ~]# ls /app -dl
drwxrwxrwx. 3 root root 16 May 2 17:21 /app
[root@centos72 ~]# ll /app/dd/
total 0
[root@centos72 ~]# ll /app/dd/ -d
drwxrwxrwx 2 root root 6 May 2 17:19 /app/dd/
[root@centos72 ~]# rm -rf /app/dd/
[root@centos72 ~]# ls /app -d
/app
查找文件，并且修改查找到的文件权限
[root@centos72 ~]# find /app -perm 644 -name "*.bak" -exec chmod 755 {} \;
[root@centos72 ~]# ls /app -l
total 24
-rwxr-xr-x 1 root root 1403 May 2 16:34 202.txt.bak
-rwxr-xr-x 1 root root 1485 May 2 16:34 2.txt.bak
-rwxr-xr-x 1 root root 0 May 2 16:34 aa.txt.bak
-rwxrwxrwx 1 root root 102 Apr 28 15:29 alias.txt
-rwxrwxrwx 1 root root 102 Apr 28 15:29 as.txt
-rwxrwxrwx 2 root root 0 May 1 10:32 bb
drwxrwxrwx 2 root root 18 May 1 10:33 dd
-rw-rw-r-- 1 zhang zhang 0 May 1 11:30 fffff
-rwxr-xr-x 1 root root 275 May 2 16:35 reset1.sh.bak
-rwxr-xr-x 1 root root 210 May 2 16:35 reset.sh.bak
七find示例
（一）找出不是wang也不是zhang用户的文件
find -not \( -user wang -o -user zhang \)
[root@centos72 ~]# !tr
tree /home/
/home/
├── wang
└── zhang 2 directories, 0 files
[root@centos72 ~]# id wang
uid=1000(wang) gid=1000(wang) groups=1000(wang)
[root@centos72 ~]# id zhang
uid=1001(zhang) gid=1001(zhang) groups=1001(zhang)
[root@centos72 ~]# getent passwd wang
wang:x:1000:1000:wang:/home/wang:/bin/bash
[root@centos72 ~]# getent passwd zhang
zhang:x:1001:1001::/home/zhang:/bin/bash
[root@centos72 ~]# find /home -not \( -user wang -o -user zhang \)
/home
另外一种写法，更容易理解
[root@centos72 ~]# find /home -not -user wang -a -not -user zhang
/home
如果是写或，那么就白写了
显示此目录里面所有的文件
逻辑思维要训练
[root@centos72 ~]# find /home -not -user wang -o -not -user zhang
/home
/home/wang
/home/wang/.bash_logout
/home/wang/.bash_profile
/home/wang/.bashrc
/home/wang/.bash_history
/home/zhang
/home/zhang/.bash_logout
/home/zhang/.bash_profile
/home/zhang/.bashrc
（二）找出/tmp目录下，属主不是root，且文件名不以f开头的文件
[root@centos72 ~]# ll /tmp/
total 4
drwx------ 3 root root 17 May 1 10:10 systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5
drwx------ 2 root root 6 Apr 29 23:03 vmware-root
-rw------- 1 root root 237 Apr 30 09:23 yum_save_tx.2019-04-30.09-23.9VAtc_.yumtx
[root@centos72 ~]# ll /tmp/*
-rw------- 1 root root 237 Apr 30 09:23 /tmp/yum_save_tx.2019-04-30.09-23.9VAtc_.yumtx /tmp/systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5:
total 0
drwxrwxrwt 2 root root 6 May 1 10:10 tmp /tmp/vmware-root:
total 0
[root@centos72 ~]# ll /tmp/
total 4
drwx------ 3 root root 17 May 1 10:10 systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5
drwx------ 2 root root 6 Apr 29 23:03 vmware-root
-rw------- 1 root root 237 Apr 30 09:23 yum_save_tx.2019-04-30.09-23.9VAtc_.yumtx
[root@centos72 ~]# ll /tmp/*
-rw------- 1 root root 237 Apr 30 09:23 /tmp/yum_save_tx.2019-04-30.09-23.9VAtc_.yumtx /tmp/systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5:
total 0
drwxrwxrwt 2 root root 6 May 1 10:10 tmp /tmp/vmware-root:
total 0
[root@centos72 ~]# find /tmp -not \( -user wang -o -name 'f*' \)
/tmp
/tmp/.ICE-unix
/tmp/.Test-unix
/tmp/.X11-unix
/tmp/.XIM-unix
/tmp/.font-unix
/tmp/vmware-root
/tmp/yum_save_tx.2019-04-30.09-23.9VAtc_.yumtx
/tmp/systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5
/tmp/systemd-private-ccfcba5acdc24240951049a6d445ca36-chronyd.service-MLtLN5/tmp
（三）查找/etc/下，除了/etc/yum目录里面的.conf后缀文件的其它所有.conf后缀的文件
[root@centos72 ~]# ll /etc/yum
total 4
drwxr-xr-x. 2 root root 6 Apr 13 2018 fssnap.d
drwxr-xr-x. 2 root root 54 Jan 13 00:21 pluginconf.d
drwxr-xr-x. 2 root root 26 Apr 13 2018 protected.d
drwxr-xr-x. 2 root root 37 Apr 13 2018 vars
-rw-r--r--. 1 root root 444 Apr 13 2018 version-groups.conf
[root@centos72 ~]# ll /etc/yum -d
drwxr-xr-x. 6 root root 100 Jan 13 00:16 /etc/yum
[root@centos72 ~]# tree /etc/yum
/etc/yum
├── fssnap.d
├── pluginconf.d
│ ├── fastestmirror.conf
│ └── langpacks.conf
├── protected.d
│ └── systemd.conf
├── vars
│ ├── contentdir
│ └── infra
└── version-groups.conf 4 directories, 6 files
[root@centos72 ~]# find /etc -path "/etc/yum" -a -prune -o -name "*.conf"
/etc/resolv.conf
/etc/libaudit.conf
/etc/depmod.d/dist.conf
/etc/dracut.conf
/etc/prelink.conf.d/nss-softokn-prelink.conf
/etc/prelink.conf.d/fipscheck.conf
/etc/prelink.conf.d/grub2.conf
/etc/modprobe.d/tuned.conf
/etc/modprobe.d/firewalld-sysctls.conf
/etc/rsyslog.d/listen.conf
/etc/systemd/bootchart.conf
/etc/systemd/coredump.conf
/etc/systemd/journald.conf
/etc/systemd/logind.conf
/etc/systemd/system.conf
/etc/systemd/user.conf
/etc/host.conf
/etc/dbus-1/system.d/org.freedesktop.hostname1.conf
/etc/dbus-1/system.d/org.freedesktop.import1.conf
/etc/dbus-1/system.d/org.freedesktop.locale1.conf
/etc/dbus-1/system.d/org.freedesktop.login1.conf
/etc/dbus-1/system.d/org.freedesktop.machine1.conf
/etc/dbus-1/system.d/org.freedesktop.systemd1.conf
/etc/dbus-1/system.d/org.freedesktop.timedate1.conf
/etc/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
/etc/dbus-1/system.d/wpa_supplicant.conf
/etc/dbus-1/system.d/nm-dispatcher.conf
/etc/dbus-1/system.d/nm-ifcfg-rh.conf
/etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf
/etc/dbus-1/system.d/teamd.conf
/etc/dbus-1/system.d/com.redhat.tuned.conf
/etc/dbus-1/system.d/FirewallD.conf
/etc/dbus-1/session.conf
/etc/dbus-1/system.conf
/etc/sysctl.d/99-sysctl.conf
/etc/udev/udev.conf
/etc/NetworkManager/NetworkManager.conf
/etc/X11/xorg.conf.d/00-keyboard.conf
/etc/pki/ca-trust/ca-legacy.conf
/etc/ld.so.conf
/etc/ld.so.conf.d/mariadb-x86_64.conf
/etc/nsswitch.conf
/etc/yum
/etc/krb5.conf
/etc/sysctl.conf
/etc/sestatus.conf
/etc/security/access.conf
/etc/security/chroot.conf
/etc/security/group.conf
/etc/security/limits.conf
/etc/security/limits.d/20-nproc.conf
/etc/security/namespace.conf
/etc/security/pam_env.conf
/etc/security/sepermit.conf
/etc/security/time.conf
/etc/security/pwquality.conf
/etc/sasl2/smtpd.conf
/etc/fuse.conf
/etc/GeoIP.conf
/etc/logrotate.conf
/etc/asound.conf
/etc/openldap/ldap.conf
/etc/libuser.conf
/etc/selinux/semanage.conf
/etc/selinux/targeted/setrans.conf
/etc/wpa_supplicant/wpa_supplicant.conf
/etc/plymouth/plymouthd.conf
/etc/yum.conf
/etc/tuned/tuned-main.conf
/etc/vmware-tools/guestproxy-ssl.conf
/etc/vmware-tools/vgauth.conf
/etc/man_db.conf
/etc/firewalld/firewalld.conf
/etc/kdump.conf
/etc/audisp/audispd.conf
/etc/audisp/plugins.d/af_unix.conf
/etc/audisp/plugins.d/syslog.conf
/etc/audit/auditd.conf
/etc/e2fsck.conf
/etc/mke2fs.conf
/etc/sudo-ldap.conf
/etc/sudo.conf
/etc/vconsole.conf
/etc/locale.conf
/etc/ntp.conf
/etc/keepalived/keepalived.conf
/etc/rsyslog.conf
/etc/chrony.conf
/etc/nginx/conf.d/default.conf
/etc/nginx/conf.d/vhosts.conf
/etc/nginx/nginx.conf
/etc/vsftpd/vsftpd.conf
/etc/httpd/conf/httpd.conf
/etc/httpd/conf.d/autoindex.conf
/etc/httpd/conf.d/userdir.conf
/etc/httpd/conf.d/welcome.conf
/etc/httpd/conf.modules.d/00-base.conf
/etc/httpd/conf.modules.d/00-dav.conf
/etc/httpd/conf.modules.d/00-lua.conf
/etc/httpd/conf.modules.d/00-mpm.conf
/etc/httpd/conf.modules.d/00-proxy.conf
/etc/httpd/conf.modules.d/00-systemd.conf
/etc/httpd/conf.modules.d/01-cgi.conf
/etc/updatedb.conf
[root@centos72 ~]# find /etc/yum/ -name "*.conf"
/etc/yum/protected.d/systemd.conf
/etc/yum/pluginconf.d/fastestmirror.conf
/etc/yum/pluginconf.d/langpacks.conf
/etc/yum/version-groups.conf
[root@centos72 ~]# find /etc -path "/etc/yum" -a -prune -o -name "*.conf" | grep /etc/yum/protected.d/systemd.conf
（四）查找/etc/下，除/etc/systemd和/etc/yum两个目录的其它所有.conf后缀的文件
注意两个目录都不要在最后加斜线
[root@centos72 ~]# find /etc \( -path '/etc/systemd' -o -path '/etc/yum' \) -a -prune -o -name "*.conf"
/etc/resolv.conf
/etc/libaudit.conf
/etc/depmod.d/dist.conf
/etc/dracut.conf
/etc/prelink.conf.d/nss-softokn-prelink.conf
/etc/prelink.conf.d/fipscheck.conf
/etc/prelink.conf.d/grub2.conf
/etc/modprobe.d/tuned.conf
/etc/modprobe.d/firewalld-sysctls.conf
/etc/rsyslog.d/listen.conf
/etc/systemd
/etc/host.conf
/etc/dbus-1/system.d/org.freedesktop.hostname1.conf
/etc/dbus-1/system.d/org.freedesktop.import1.conf
/etc/dbus-1/system.d/org.freedesktop.locale1.conf
/etc/dbus-1/system.d/org.freedesktop.login1.conf
/etc/dbus-1/system.d/org.freedesktop.machine1.conf
/etc/dbus-1/system.d/org.freedesktop.systemd1.conf
/etc/dbus-1/system.d/org.freedesktop.timedate1.conf
/etc/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
/etc/dbus-1/system.d/wpa_supplicant.conf
/etc/dbus-1/system.d/nm-dispatcher.conf
/etc/dbus-1/system.d/nm-ifcfg-rh.conf
/etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf
/etc/dbus-1/system.d/teamd.conf
/etc/dbus-1/system.d/com.redhat.tuned.conf
/etc/dbus-1/system.d/FirewallD.conf
/etc/dbus-1/session.conf
/etc/dbus-1/system.conf
/etc/sysctl.d/99-sysctl.conf
/etc/udev/udev.conf
/etc/NetworkManager/NetworkManager.conf
/etc/X11/xorg.conf.d/00-keyboard.conf
/etc/pki/ca-trust/ca-legacy.conf
/etc/ld.so.conf
/etc/ld.so.conf.d/mariadb-x86_64.conf
/etc/nsswitch.conf
/etc/yum
/etc/krb5.conf
/etc/sysctl.conf
/etc/sestatus.conf
/etc/security/access.conf
/etc/security/chroot.conf
/etc/security/group.conf
/etc/security/limits.conf
/etc/security/limits.d/20-nproc.conf
/etc/security/namespace.conf
/etc/security/pam_env.conf
/etc/security/sepermit.conf
/etc/security/time.conf
/etc/security/pwquality.conf
/etc/sasl2/smtpd.conf
/etc/fuse.conf
/etc/GeoIP.conf
/etc/logrotate.conf
/etc/asound.conf
/etc/openldap/ldap.conf
/etc/libuser.conf
/etc/selinux/semanage.conf
/etc/selinux/targeted/setrans.conf
/etc/wpa_supplicant/wpa_supplicant.conf
/etc/plymouth/plymouthd.conf
/etc/yum.conf
/etc/tuned/tuned-main.conf
/etc/vmware-tools/guestproxy-ssl.conf
/etc/vmware-tools/vgauth.conf
/etc/man_db.conf
/etc/firewalld/firewalld.conf
/etc/kdump.conf
/etc/audisp/audispd.conf
/etc/audisp/plugins.d/af_unix.conf
/etc/audisp/plugins.d/syslog.conf
/etc/audit/auditd.conf
/etc/e2fsck.conf
/etc/mke2fs.conf
/etc/sudo-ldap.conf
/etc/sudo.conf
/etc/vconsole.conf
/etc/locale.conf
/etc/ntp.conf
/etc/keepalived/keepalived.conf
/etc/rsyslog.conf
/etc/chrony.conf
/etc/nginx/conf.d/default.conf
/etc/nginx/conf.d/vhosts.conf
/etc/nginx/nginx.conf
/etc/vsftpd/vsftpd.conf
/etc/httpd/conf/httpd.conf
/etc/httpd/conf.d/autoindex.conf
/etc/httpd/conf.d/userdir.conf
/etc/httpd/conf.d/welcome.conf
/etc/httpd/conf.modules.d/00-base.conf
/etc/httpd/conf.modules.d/00-dav.conf
/etc/httpd/conf.modules.d/00-lua.conf
/etc/httpd/conf.modules.d/00-mpm.conf
/etc/httpd/conf.modules.d/00-proxy.conf
/etc/httpd/conf.modules.d/00-systemd.conf
/etc/httpd/conf.modules.d/01-cgi.conf
/etc/updatedb.conf
只有任何一个目录添加/就会报错
[root@centos72 ~]# find /etc \( -path '/etc/systemd' -o -path '/etc/yum/' \) -a -prune -o -name "*.conf" | grep /etc/yum/*.conf
find: warning: -path /etc/yum/ will not match anything because it ends with /.
/etc/yum/version-groups.conf
（五）查找大于20个字节，小于30个字节的文件，并且文件后缀是conf结尾的
使用正则表达式*.conf即可
[root@centos72 ~]# find / -size +20c -size -31c -name "*.conf"
find: ‘/proc/sys/fs/binfmt_misc’: No such device
/run/systemd/system/session-29.scope.d/50-TasksMax.conf
/run/systemd/system/session-29.scope.d/50-SendSIGHUP.conf
/run/systemd/system/session-29.scope.d/50-Slice.conf
/run/systemd/system/user-0.slice.d/50-TasksMax.conf
/etc/ld.so.conf
/usr/lib/dracut/dracut.conf.d/01-microcode.conf
/usr/lib/dracut/dracut.conf.d/02-rescue.conf
/usr/lib/tmpfiles.d/rpm.conf
[root@centos72 ~]# ll /run/systemd/system/session-29.scope.d/50-TasksMax.conf -rw-r--r-- 1 root root 26 May 2 12:34 /run/systemd/system/session-29.scope.d/50-TasksMax.conf
[root@centos72 ~]# ll /etc/ld.so.conf
-rw-r--r--. 1 root root 28 Feb 28 2013 /etc/ld.so.conf
（六）查找/var目录下不属于root、wang的所有文件
[root@centos72 ~]# find /usr/ -not \( -user root -o -user wang \)
/usr/share/polkit-1/rules.d
[root@centos72 ~]# ll /usr/share/polkit-1/rules.d
total 0
[root@centos72 ~]# ll /usr/share/polkit-1/rules.d -d
drwx------. 2 polkitd root 6 Apr 11 2018 /usr/share/polkit-1/rules.d
[root@centos72 ~]#
（七）查找/var目录下最近一周内其内容修改过，同时属主不为root，也不是postfix的文件
[root@centos72 ~]# find /etc/ -mtime -7 -not -user root -not -user wang
（八）查找当前系统上没有属主或属组，且最近一个周内曾被访问过的文件
[root@centos72 ~]# find / -nouser -nogroup -atime -30
find: ‘/proc/5109/task/5109/fd/6’: No such file or directory
find: ‘/proc/5109/task/5109/fdinfo/6’: No such file or directory
find: ‘/proc/5109/fd/5’: No such file or directory
find: ‘/proc/5109/fdinfo/5’: No such file or directory
（九）查找/etc/sysconfig/目录下大于1M且类型为普通文件的所有文件
[root@centos72 ~]# find /etc/sysconfig/ -size -$[1*1024*1024] -type f
/etc/sysconfig/ip6tables-config
/etc/sysconfig/iptables-config
/etc/sysconfig/cbq/avpkt
/etc/sysconfig/cbq/cbq-0000.example
/etc/sysconfig/rdisc
/etc/sysconfig/init
/etc/sysconfig/netconsole
/etc/sysconfig/network-scripts/ifcfg-lo
/etc/sysconfig/network-scripts/ifdown-bnep
/etc/sysconfig/network-scripts/ifdown-eth
/etc/sysconfig/network-scripts/ifdown-ippp
/etc/sysconfig/network-scripts/ifdown-ipv6
/etc/sysconfig/network-scripts/ifdown-post
/etc/sysconfig/network-scripts/ifdown-ppp
/etc/sysconfig/network-scripts/ifdown-routes
/etc/sysconfig/network-scripts/ifdown-sit
/etc/sysconfig/network-scripts/ifdown-tunnel
/etc/sysconfig/network-scripts/ifup-aliases
/etc/sysconfig/network-scripts/ifup-bnep
/etc/sysconfig/network-scripts/ifup-eth
/etc/sysconfig/network-scripts/ifup-ippp
/etc/sysconfig/network-scripts/ifup-ipv6
/etc/sysconfig/network-scripts/ifup-plip
/etc/sysconfig/network-scripts/ifup-plusb
/etc/sysconfig/network-scripts/ifup-post
/etc/sysconfig/network-scripts/ifup-ppp
/etc/sysconfig/network-scripts/ifup-routes
/etc/sysconfig/network-scripts/ifup-sit
/etc/sysconfig/network-scripts/ifup-tunnel
/etc/sysconfig/network-scripts/ifup-wireless
/etc/sysconfig/network-scripts/init.ipv6-global
/etc/sysconfig/network-scripts/network-functions
/etc/sysconfig/network-scripts/network-functions-ipv6
/etc/sysconfig/network-scripts/ifdown-Team
/etc/sysconfig/network-scripts/ifdown-TeamPort
/etc/sysconfig/network-scripts/ifup-Team
/etc/sysconfig/network-scripts/ifup-TeamPort
/etc/sysconfig/network-scripts/ifcfg-ens33
/etc/sysconfig/readonly-root
/etc/sysconfig/crond
/etc/sysconfig/run-parts
/etc/sysconfig/wpa_supplicant
/etc/sysconfig/ebtables-config
/etc/sysconfig/irqbalance
/etc/sysconfig/man-db
/etc/sysconfig/rsyslog
/etc/sysconfig/firewalld
/etc/sysconfig/kdump
/etc/sysconfig/sshd
/etc/sysconfig/authconfig
/etc/sysconfig/cpupower
/etc/sysconfig/kernel
/etc/sysconfig/network
/etc/sysconfig/anaconda
（十）查找/etc目录下所有用户都没有写权限的文件
[root@centos72 ~]# find /etc/ -not -perm /222
/etc/gshadow-
/etc/gshadow
/etc/shadow-
/etc/udev/hwdb.bin
/etc/machine-id
/etc/shadow
/etc/pki/ca-trust/extracted/java/cacerts
/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
/etc/ld.so.conf.d/kernel-3.10.0-862.el7.x86_64.conf
/etc/openldap/certs/password
/etc/sudoers
[root@centos72 ~]#
[root@centos72 ~]# find /etc/ -not -perm /222 -ls
67398888 4 ---------- 1 root root 833 Jul 11 20:57 /etc/gshadow-
67554388 4 ---------- 1 root root 849 Jul 11 20:57 /etc/gshadow
67424460 4 ---------- 1 root root 1501 Jul 11 20:57 /etc/shadow-
33554499 7600 -r--r--r-- 1 root root 7780559 Jan 13 2019 /etc/udev/hwdb.bin
67427672 4 -r--r--r-- 1 root root 33 Jan 13 2019 /etc/machine-id
67554386 4 ---------- 1 root root 1529 Jul 11 20:57 /etc/shadow
67205635 160 -r--r--r-- 1 root root 160286 Jan 13 2019 /etc/pki/ca-trust/extracted/java/cacerts
100758445 260 -r--r--r-- 1 root root 264921 Jan 13 2019 /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
21404 216 -r--r--r-- 1 root root 219895 Jan 13 2019 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
21405 176 -r--r--r-- 1 root root 179176 Jan 13 2019 /etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
21406 0 -r--r--r-- 1 root root 0 Jan 13 2019 /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
100882165 4 -r--r--r-- 1 root root 63 Apr 21 2018 /etc/ld.so.conf.d/kernel-3.10.0-862.el7.x86_64.conf
33866872 4 -r-------- 1 root root 45 Jan 13 2019 /etc/openldap/certs/password
67620640 4 -r--r----- 1 root root 3938 Apr 11 2018 /etc/sudoers
（十一）查找/etc目录下至少有一类用户没有执行权限的文件
[root@centos72 ~]# find /etc/ \( -perm -220 -o -perm -202 -o -perm -022 \) -not -perm -
（十二）查找/etc/init.d目录下，所有用户都有执行权限，且其它用户有写权限的文件
[root@centos72 ~]# find /etc/init.d/ -perm -
（十三）查找/var目录下属主为root，且属组为mail的所有文件
[root@centos77 ~]# find /var/ -user root -group mail
/var/spool/mail
[root@centos77 ~]# ll -d /var/spool/mail
drwxrwxr-x. 2 root mail 4096 Jul 12 00:08 /var/spool/mail