General Information

The GNU find utility and some useful parsing methods.

Checklist

• Distro(s): Any

The general syntax of find is:

find [options] [path] [expression]

The [options] allow for how to treat symbolic links, debugging, and optimization.
The defaults are almost always used. (see 'man find' if curious)

[path] is the directory in which you are starting the search.

[expression]s are made up of options that manipulate the operation of find.

Some of the useful find commands that have been “tested in production”.

If you run into a situation in which you have high inode usage as seen by 'df -i', the following syntax will show folders with the most files:

nice find / -mount -printf '%h\n' | sort | uniq -c | sort -n -k 1

Explanation:

• nice = Use nice in a production environment to lower CPU scheduling priority by a default of 10, as find can be CPU intensive
• find / = start in the “/” directory (change this to the root of a mount point you wish to investigate as identified by 'df -i')
• mount = Do not descend directories on other file systems.
• printf '%h\n' = Print the leading directories of a file's name (%h), then a newline (\n). (man find, then search for 'printf\ format' to see all available formats)
• sort = Default sort by starting of line alphabetical
• uniq -c = Filter matching adjacent lines, prefix lines with the count of occurrences
• sort -n -k 1 = Sort numerically (-n) via the “key” (-k) at field 1 (field 1 is the count from 'uniq -c').

This will give output with the first column displaying file count and the second column displaying the folder it is in.

Example Output (last 5 lines):

   1814 /usr/bin
   1983 /usr/share/doc
   2075 /usr/share/man/man3
   2122 /usr/share/linuxmint/mintinstall/installed
   2123 /usr/share/linuxmint/mintinstall/icons

find / -user rjones -type f

find / -user rjones -type f -exec rm '{}' \;

find / -mtime -3 -type f