每天一个Linux命令030——find
Linux下find命令在目录结构中搜索文件，并执行指定的操作。Linux下find命令提供了相当多的查找条件，功能很强大。你可以指定匹配条件，如：文件名，权限，属性，时间，大小，类型等等查找你想要的文件。除了三剑客(grep,sed,awk)之外，应该算是最为强大的命令之一了。
联想记忆：
find - search for files in a directory hierarchy
语法：
find [path...] [expression]
说明：find为命令，path表示在哪个路径下搜索，expression则是条件表达式
下面我们根据几个常用选项来讲讲find的用法
例1：
在系统中查找名为deploy.sh的脚本文件
参数说明：
-name pattern
Base of file name (the path with the leading directories removed) matches shell pattern pattern. The metacharacters(‘*’, ‘?’, and ‘[]’) match a ‘.’ at the start of the base name (this is a change in findutils-4.2.2; see section STAN-DARDS CONFORMANCE below). To ignore a directory and the files under it, use -prune; see an example in the descriptionof -path. Braces are not recognised as being special, despite the fact that some shells including Bash imbue braces with a special meaning in shell patterns. The filename matching is performed with the use of the fnmatch(3) libraryfunction. Don’t forget to enclose the pattern in quotes in order to protect it from expansion by the shell.
# find / -name deploy.sh
例2：
查找7天以前的访问日志
-ctime n #以文件的修改时间来查找
File’s status was last changed n*24 hours ago. See the comments for -atime to understand how rounding affects the interpretation of file status change times.
-atime n #以文件的访问时间来查找
File was last accessed n*24 hours ago. When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago.
-mtime n #以文件的更改时间来查找
File’s data was last modified n*24 hours ago. See the comments for -atime to understand how rounding affects the inter-pretation of file modification times.
n -n +n #分别代表：n天，n天以内，n天以前
# find /data/logs/access -ctime +7
例3：
在/dev路径下查找块设备文件
文件类型：
-type c
File is of type c:
b block (buffered) special #块设备文件
c character (unbuffered) special #字符设备
d directory #目录
p named pipe (FIFO) #管道文件
f regular file #普通文件
l symbolic link; this is never true if the -L option or the -follow option is in effect, unless the symbolic link is broken. If you want to search for symbolic links when -L is in effect, use -xtype. #链接文件
s socket #套接字文件
# find /dev -type b
例4：
在/data路径下查找7天以前并且是目录文件
-and #与关系，两个条件都需要满足
-or #或关系，只需满足一个
-!not #非关系，取反
# find /data -ctime +7 -and -type d
例5：
查找系统中大于1G的文件
-size n[cwbkMG]
File uses n units of space. The following suffixes can be used:
‘b’ for 512-byte blocks (this is the default if no suffix is used)
‘c’ for bytes
‘w’ for two-byte words
‘k’ for Kilobytes (units of 1024 bytes)
‘M’ for Megabytes (units of 1048576 bytes)
‘G’ for Gigabytes (units of 1073741824 bytes)
# find / -size +1G
例6：
查找/data/logs下7天以前的日志文件并删除之
法1：
-exec command {} +
This variant of the -exec action runs the specified command on the selected files, but the command line is built by appending each selected file name at the end; the total number of invocations of the command will be much less than the number of matched files. The command line is built in much the same way that xargs builds its command lines. Only one instance of ‘{}’ is allowed within the command. The command is executed in the starting directory.
说明：-exec后面跟需要执行的命令，后面是{} \;这是一个固定用法
# find /data/logs -ctime +7 -exec rm -f {} \;
法2：
xargs本身就是一个独立的命令，有兴趣的可以单独研究，常常和find搭配来使用
# find /data/logs -ctime +7 | xargs rm -f
xargs与exec的区别：
在使用find命令的-exec选项处理匹配到文件时，find命令将所有匹配到的文件一起传递给exec执行。但有些系统对能够传递给exec的命令长度有限制，这样在find命令运行几分钟之后，就会出现溢出错误。错误信息通常是“参数列太长”或“参数列溢出”。这就是xargs命令的用处所在，特别是与find命令搭配使用。
find命令把匹配到的文件传递给xargs命令，而xargs命令每次只获取一部分文件而不是全部，不像-exec选项那样。这样它可以先处理最先获取的一部分文件，然后是下一批，反复下去，xargs命令只有一个进程。
不常用选项：
-mindepth 指定目录的最小深度查找
-maxdepth 指定目录的最大深度查找
-empty 查找大小为零的文件或目录
-prune 忽略某个目录
总结：-name指定文件名，可以匹配正则表达式 -size按照大小来查找 -mtime,-ctime,-atime按照时间查找 -type按照文件类型查找 xargs搭配find使用，很常用
