Linux file search command


1. Find the execution file (which/whereis)

  • Which is used to find the absolute PATH of the executable file from the directory defined by the PATH variable of the system. For example, to find the absolute path of passwd command in the system, use the following method:

[root@localhost ~]# which passwd
  • The path can also be found by using whereis, but unlike which, it can find not only its binary files but also the related man files.

2.slocate and slote

The locate command can find the contents matching the provided search terms in files, programs and directories, and display any matching results on the terminal interface in turn.

The locate command does not search the system in real time. In fact, it searches the file name database that is updated automatically every day. Because locate searches a database already created, the search results can be displayed almost instantaneously.

The version of the slote (representing secure locate) command is updated. it does not search for directories that the user running the slote command does not have permission to view (for example, if you are not the root user, the results in the /root directory will not be displayed when searching with locate).

Because Linux systems are case sensitive by default. After this point is made clear, the -i option can be added, so that a case-insensitive search is performed, so that files containing haggard in the path can be found as well as files containing HAGGARD (in fact, HaGgArD, Haggard, etc.).

locate -i haggard

If you only want to see the first x results (x is an integer of your choice), you can use the -n option followed by the number of results you want to see.

$ locate -n 3 pdf


The locate command depends on a database file. By default, Linux system will retrieve all files in the system every day, and then record the retrieved files in the database. When running the locate command, you can directly look up records in the database and print them on the screen, so using the locate command is faster than the find command. Before executing this command, it is generally necessary to execute the updatedb command (this is not necessary because the system will automatically retrieve and update the database information every day, but sometimes the system cannot find the file that actually exists because the file has changed and the system has not updated it again. Therefore, it is sometimes necessary to actively run the command to create the latest file list database) to update the database records in a timely manner. The following is to use the locate command to find the httpd.conf file:

[root@localhost ~]# updatedb
[root@localhost ~]# locate httpd.conf

You can manually update the database used by locate by running updatedb at any time. Because this command basically indexes every file and folder on the computer

However, one thing should be noted here: the running speed of updatedb is directly related to the amount of data in the hard disk and the processing speed of the computer. The faster the processor, the faster the hard disk, and the fewer files, the faster the updatedb will run. If the CPU is slow, the hard disk is only running at 5400RPM, and there are 1 million files, then don’t expect the updatedb to go anywhere soon. If you want to know how long the updatedb took to run, you can add the time command before the updatedb as follows:

# time updatedb

After the updatedb processing is completed, the time command can show how long it took to organize the locate database. This information is very useful, and you need to remember that you may need to use updatedb in the future and the time is very tight.


Although the locate command searches the database of files, making it run fast, it depends on the constantly updated database. The find command can easily search for files according to the specified query criteria.
. Because the find command must analyze the structure of the file, its speed is much slower than the locate command, however, it can be used to complete many functions that cannot be realized with the locate command.

By default, find automatically recursively searches the entire directory structure. To find all MP3 files under the unique Shaggs group in the music disc, see below:

$ cd /media/music
$ find . -name Shaggs

Wildcards are required, but in order to prevent the shell from interpreting wildcards in ways we do not expect, the search must be enclosed in quotation marks. Let’s search again with the new and improved method:

$ find . -name "*Shaggs*"

Another important aspect of the find command is that the format of the search results depends on the path being searched. The previous use is relative path, so the result is also given by relative path. What happens if an absolute path is used (starting with/as the path)?

$ find / -name "*Shaggs*"

Search by User/User Group

Do you want to search the music disc for scott’s files? Use the find command and the -user option, followed by the user name (or user number, which can be found in /etc/passwd), as follows:

$ find . -user scott

It may be easier to find files whose owner is not scott, just add an exclamation mark (! ) is ok.

find . ! -user scott

If you want to search for files owned by a specific user group, just use the -group option, followed by the name or number of the group. In the music disc, scott should be the owner and music is the user group to which it belongs. Let’s see if there are any files that do not belong to the music group, as follows:

$ find . ! -group music

Search by Size

If the file size to be searched is larger than 10MB, a plus sign (+) is required before the specified size; If the file size to be searched is less than 10MB, a minus sign (-) is required before the size, as follows:

$ find . -size +10M

If you want to search for large text files, you can use c after the number. C modifies the size unit of the search to bytes. A character is a byte in a text file, so a simple way to remember option C is to associate it with the “character” in the text file.
For example, to search for large text files, you can use the following code:

$ find /home/scott/documents -size +500000c

4. Find the contents of the file

To search for file content, you should use the grep command. The process of grep is basically to provide it with a search pattern to match, specify one or a group of files (even the entire hard disk space) to search, and then grep will output a list of the contents of each line that can match the search pattern.

wildcard character

Wildcards are not equal to regular expressions. Although wildcards and regular expressions both use asterisks () characters, but their meanings are completely different. Wildcards use specific characters (such as? And) indicates substitution, while the same character in the regular expression indicates the number of times to match the previous content. For example, in wildcards, you can use c? In t? Replace with another character and only once, so this wildcard can match cat, cot and cut, but cannot match ct. In the regular expression, c[a-z]? In t? Indicates that the letters A to Z can be matched, but only 0 or 1 times, so this regular expression can match cat, cot, cut, or ct.

The usage of single quotation marks and double quotation marks in regular expressions is also very different. Single quotation marks (‘and’) tell the shell that it is searching for a string, while double quotation marks (‘and’) let the shell know that it wants to use shell variables.

grep 'hey!' *

The result is much better. Single quotation marks tell grep that the search does not contain any shell variables, but only a string of characters that need to be matched. You see, now there is only one result, which is the one you are looking for.

Recursively search for text in a file

grep -R hideous *
grep -R hideous *| less

Ignore case

grep -i hideous h_p_lovecraft/*

Accurate matching

What if you only need to exactly match pain’s rows? The -w (or –word-regexp) option will be used.

$ grep -w pain *

Find line numbers

To find the line number, you can use the -n (or-line-number) option.
$ grep -n pain *

According to the process user search

The ps command can list the running processes, while the -f option enables ps to provide a complete list, which includes a lot of information about each process; However, the -U option, followed by the user name, can restrict the output of only processes owned by that user.

ps -fU scott | grep firefox

View the context information of the search content in the file

Use the -B (or –before-context=# = #) option to get the answer. As follows:

$ ls -1 | grep -B 3 A_Love_Supreme

If you want to find records after LoveSupreme, you should use the -A (or –after-context=# = #) option. As follows:

$ ls -1 | grep -A 3 

To get the full historical background of A Love Supreme album, try the -C (or-context = #) option, which combines the contents before and after the album.

$ ls -1 | grep -C 2 

If you combine the -n option, the information in the result will be more useful. This option can list the line numbers (because ls -1 is used here, it is the line number in the ls result list).

ls -1 | grep -n -C 1 Live

Reverse matching

Using the -v (or –invert-match) option, you can only display results that do not match the given pattern.
With the -v option, the results can be filtered and only what is needed can be accurately displayed.

ls -1 | grep -v Led_Zeppelin

List the files where these lines are located

With the -l (or-files-with-matches) option, you can list only the files where these lines are located (remember, the -i option is used to make searches case insensitive).

$ grep -il hideous h_p_lovecraft/*