Finding files & commands

find, locate, which, whereis, xargs.

On a server you constantly need to locate things — a config file, all the logs older than a week, which program a command actually runs. A few search tools answer every version of "where is it?", and one (find) is powerful enough that it doubles as a way to act on the files it finds.

find — the workhorse

find walks a directory tree and matches files by criteria: -name matches by filename (quote wildcards so the shell does not expand them), -type f or -type d restricts to files or directories, -mtime finds by modification age, and -size by size. It searches recursively from the starting path you give it. It is verbose but precise, and it is the tool that answers almost any "find me all the files that..." question.

$ find /etc -name "*.conf" -type f      # all .conf files under /etc
/etc/ssh/sshd_config.d/10-hardening.conf
/etc/nginx/nginx.conf
$ find . -name "*.log" -mtime +7        # log files modified more than 7 days ago
$ find /var -type f -size +100M         # files bigger than 100 MB (find the disk hog)
$ find / -perm -4000 -type f 2>/dev/null # every SUID binary (the security check you know)

find -exec and xargs — act on the results

find does not just list — it can run a command on each file it finds. -exec ... {} \; runs a command per file (the {} is replaced by the filename). More often you pipe find into xargs, which takes the list of filenames and feeds them as arguments to another command. Together they are how you do bulk operations: delete all old logs, change permissions on every config, grep inside every matching file.

# delete every .log older than 30 days
$ find /var/log/app -name "*.log" -mtime +30 -delete
# run a command per file with -exec
$ find . -name "*.sh" -exec chmod 750 {} \;
# or feed the list to another command with xargs
$ find . -name "*.py" | xargs grep -l "import os"   # which python files import os?

locate — the fast index

Where find searches the disk live (accurate but slower), locate queries a prebuilt database of filenames, so it returns results instantly — great for "where is that file called X?" when you do not need it to be perfectly up to date. The database is refreshed periodically (updatedb); a file created seconds ago may not show up yet, which is the tradeoff for the speed.

$ locate nginx.conf
/etc/nginx/nginx.conf
/usr/share/doc/nginx/examples/nginx.conf
$ sudo updatedb        # refresh the index if a recent file is missing

which and whereis — locate a command

When you type a command, the shell finds the actual program by searching your PATH. which tells you exactly which file will run — useful when there are several versions installed and you need to know which one you are getting. whereis additionally finds the command’s manual page and source. These answer "what does this command actually point to?", which matters both for troubleshooting and for spotting a suspicious binary shadowing a real one.

$ which python3
/usr/bin/python3
$ which -a python3          # ALL matches in PATH order (the first one wins)
/usr/bin/python3
/usr/local/bin/python3
$ whereis ssh
ssh: /usr/bin/ssh /usr/share/man/man1/ssh.1.gz