Linux Search Tools - Know how to search the server

This chapter will illustrate how to search for files using specific criteria such as size or time last updated.  It also includes information on how to search for files containing a specific string or pattern of data.  A review of how to search for processes active on the system is also covered.

Using Simple ls Command Options

There will come a time when a user will want to know the last file touched, the last file changed or maybe the largest or smallest file within a directory.  This type of search can be performed with the ls command.  Previously the ls command was used to display directories and files within directories, but by using some of the ls command options and piping the output of ls to the head command to limit the number of displayed lines we can find some of these more specific results.

Sample directory

The following home directory is used for the next few examples.  Using the ?A option makes ls show files beginning with . but eliminates the . and .. files from the display.

$ ls -Al
total 44
-rw-------    1 tclark   tclark       7773 Feb  2 17:11 .bash_history
-rw-r--r--    1 tclark   tclark         24 Aug 18 11:23 .bash_logout
-rw-r--r--    1 tclark   tclark        191 Aug 18 11:23 .bash_profile
-rw-r--r--    1 tclark   tclark        124 Aug 18 11:23 .bashrc
-rw-r--r--    1 tclark   tclark        237 May 22  2003 .emacs
-rw-rw-r--    1 tclark   tclark          0 Feb  3 09:00 example1.fil
-rw-rw-r--    1 tclark   tclark          0 Jan 13 21:13 example2.xxx
drwxrwxr-x    2 tclark   authors      4096 Jan 27 10:17 examples
-rw-r--r--    1 tclark   tclark        120 Aug 24 06:44 .gtkrc
drwxr-xr-x    3 tclark   tclark       4096 Aug 12  2002 .kde
-rw-r--r--    1 tclark   authors         0 Jan 27 00:22 umask_example.fil
-rw-------    1 tclark   tclark        876 Jan 17 17:33 .viminfo
-rw-r--r--    1 tclark   tclark        220 Nov 27  2002 .zshrc

Finding the File Last Touched (Modified) in a Directory

The ?t option is used to sort the outpu of ls by the time the file was modified.  Then, the first two lines can be listed by piping the ls command to the head command.

Using the pipe (|) character in this way tells Linux to take the output of the command preceeding the pipe and use it as input for the second command.  In this case, the output of ls ?Alt is taken and passed to the head -2 command which treats the input just like it would a text file.  This type of piping is a common way to combine commands to do complex tasks in Linux.

Finding the File with the Last Attribute Change

The ?c option changes ls to display the last time there was an attribute change of a file such as a permission, ownership or name change.

Again we are using the head command to only see the first two rows of the output.  While the columns for this form of the ls command appear identical the date and time in the output now reflect the last attribute change.  Any chmod, chown, chgrp or mv operation will cause the attribute timestamp to be updated.

Finding the File Last Accessed in a Directory

Beyond file and attribute modifications we can also look at when files were last accessed.  Using the ?u option will give the time the file was last used or accessed.

$ ls -Alu|head -2
total 44
-rw-------    1 tclark   tclark       7773 Feb  3 08:56 .bash_history

Any of these ls commands could be used without the |head -2 portion to list information on all files in the current directory.

Finding the Largest Files in a Directory

The ?S option displays files by their size, in descending order.  Using this option and the head command this time to see the first four lines of output we can see the largest files in our directory.

Adding the ?r option reverses the display, sorting sizes in ascending order.

$ ls -AlSr|head -4
total 44
-rw-r--r--    1 tclark   authors         0 Jan 27 00:22 umask_example.fil
-rw-rw-r--    1 tclark   tclark          0 Jan 13 21:13 example2.xxx
-rw-rw-r--    1 tclark   tclark          0 Feb  3 09:00 example1.fil

The ?r option can also be used with the other options discussed in this section, for example to find the file which has not been modified or accessed for the longest time.

Use of the ls command options is acceptable when the user is just interested in files in the current working directory, but when we want to search overa broader structure we will use the find command.

Using the find Command

The find command can be used to fish for important files.