Searching for files using the find, locate and whereis commands

Sep 28, 2006 06:45 GMT  ·  By

Files can be found under Linux in many different ways. The easiest way is to use Kfind, the KDE graphical search tool. But what if you're connected through SSH from a remote PC and can't run a graphical desktop or simply don't have it installed, then, you don't really have a choice but to use the command line to find your files. I'm going to explain how to use the three most important (in my humble opinion) file searching commands. The commands are 'find', 'locate' and 'whereis'. 'Whereis' command is basically used for searching other commands so when invoked, it looks for the binary, the source code and the online manual page for the specified program. Whereas, the 'find' and 'locate' commands are used for finding files or folders on your system.

You may ask what the difference between 'find' and 'locate' is. Well, besides the fact that 'find' is a lot more advanced and complex, the main difference consists of the way the search is made. 'Locate' uses a database which is updated periodically, this way the search results are printed very quickly, whereas 'find' does a live search on your filesystem which can sometimes take quite long. So, basically, 'locate' is likely to be faster, but 'find' will be more up to date. Moreover, 'find' has a huge number of parameters which can be set so that Linux finds exactly those files that you were searching for.

find

Here are a few ways to use find:

# find / -name 'program.c' 2>/dev/null # find / -name 'program.c' 2>errors.txt

/: Start searching from the root directory (i.e / directory). -name: Given search text is the filename rather than any other attribute of a file. 'program.c': Search text that we have entered. Always enclose the filename in single quotes. Don't ask why because the answer is very long, complex and boring. Just do so. 2>: Indicates the error stream in Linux and the target where to send them to. If you choose to send the error messages to /dev/null, they will simply disappear. If you send them to a .txt file, you can use them for future reference.

# find /home/tim -name 'index*' # find /home/tim -iname 'index*'

The first command will search for files that have 'index' at the beginning of their name. The search will be started in the /home/tim directory and proceed with that directory and its subdirectories.

The second command is pretty much the same as the first, the difference is that it will search for filenames beginning with 'index' but ignoring the case. So, files such as ?InDeX? or ?indEX? will be returned as results.

# find -name docu*

This command searches for files that begin with the letters 'docu' but since there is no search directory specified, Linux will begin the search in the current directory and its subdirectories.

# find /music -name '*.mp3' -size -5000k # find / -size +10000k

The first command starts searching within the directory named 'music' and will only print as results the songs that have a size smaller than 5000 Kb (5 MB).

The second command searches everywhere on your disk for files larger than 10000 Kb (10 MB)

# find /home/tim -amin -10 -name '*.c' # find /home/time -atime -2 -name '*.c' # find /home/tim -mmin -10 -name '*.c' # find /home/tim -mtime -2 -name '*.c'

The first command starts the search in the /home/tim directory and print as results only the files with the .c extension and which have been accessed in the last 10 minutes.

The second command does the same but prints as results only files that have been accessed in the last 10 hours.

The last two commands do the same as the first two, the difference is that only files modified, not accessed in the last 10 minutes or hours are displayed as results.

The exec option is one of the most important features of 'find' tool. It allows you to execute a command on the search results. With the exec option, there is only one limit and that's set by your own imagination. For instance, you can view the details of the files found. Or you can delete those files. It's really up to your needs and wishes.

# find / -name "*.avi? -exec ls -l {} ;

This command searches your whole system for avi files and prints the filenames as well as their details (permissions, owner, size, date created).

Also, there are plenty of more options to use with 'find' which will be easier to understand once you get the hang of it.

locate

This search tool depends on a database created by another command. This database is basically a text file containing a tree of your filesystem. Imagine all the files you have on your hard drive, each on every line with its full path, in a single text file. That's a lot of lines! When you use 'locate' for the first time, it will warn you that the database isn't available. To be able to use 'locate', you must first execute the command:

# updatedb

This could take quite some time, depending on your specs and on how many files you have on your hard drive. After the update process is complete, you can simply type the command:

# locate index.php

and it will print all the index.php files with their relevant paths from your hard drive. And this in a very short time because it takes much less to search a single text file for the search input than to search through hundreds of directories.

# locate ?*.mp3? -q 10

This command will search for mp3 files but limiting the results to a specific number. In this case, 10. Also, you can initiate an insensitive case search. This means that files named Log or lOG are considered the same thing as LOG and therefore, will be returned as results. For this, you can use the command:

# locate LOG -i

As with the 'find' tool, 'locate' has its own extra parameters to use in your searches, but you can easily find them in the main page or in the documentation files. If you really want to.

whereis

As I've said in the beginning, the 'whereis' search tool is used to locate the binary files for programs, as well as for locating the MAN pages and the source codes.

The basic search syntax is:

# whereis ls

This command will print the location of ls (generally /bin/ls) and the location of the online manual files, generally /usr/share/man/man1/ls.1.gz.

There are several options to use with 'whereis' in order to enhance the results returned. For instance, the -b option tells it to search only for binary codes, while the -m option returns only the location of man pages.

Of course, searching for source code files depends on your Linux distribution. If you run a RPM-based distribution such as Fedora or Mandrake, chances to find the source code files are close to zero.