LFCS - Essential Commands - File searching
This post covers the commands for finding files on your system and searching the contents of files for patterns.
Search for files
find [path] [params]
# go-there find it (if you leave out path its current dir)
find /usr/share/ -name '*.jpg' #regex of name
find /lib64/ -size +10M # files greater than 10Meg
find /dev/ -mmin -1 # modified in last minute
find -iname felix # will find felix and Felix
find -name "f*" # all files starting with f
find -mmin [minute] #modified minute
# can have multiple in search expression
find -name "f*" -size 512k # implied AND
find -name "f*" -o -size 512k # explicit OR
find -not -name "f*" -o -size 512k # not being with f
#or
find \! -name "f*" -o -size 512k # need to escape not
find -perm 664 # file with these permissions
find -perm -664 # file with at least these permissions
find -perm /664 # any of these OR
find -perm 664
#or
find -perm u=rw,g=rw,o=r # exactly 664 permission
find \! -perm -o=r # files others cannot read
Grep in files
grep [options] 'search_pattern' ./file # options are optional
grep -i 'password' ./config.txt # case insensitive
grep -r 'password' ./dir # recursive
sudo grep -r --color 'password' ./dir # sets colour
grep -v 'password' ./file # inverse search
grep -w 'password' ./file # word search (exact word)
grep -o 'password' ./file # only matching (just shows match not rest of line)
Regex
# operatiors
^ # line beginning with
grep -v '^#' ./file # lines that dont begin with # -v is inverse
$ # last character
grep -w '7$' ./file # match word (single 7)
. # any character
\ # escaping
grep '\.' ./file # escapes the period
* # 0 - many times
grep 'let*' ./file
# mactches
# le
# let
# lett
grep '/.*/' ./file # period any character * is any number of times, so this will match any string between / and /
+ # element exists at least once or more
grep -r '0\+' ./dir # need to escape the + (unless using extended regex)
Extended Regex
# You dont have to escape characters with Extended Regex
grep -Er '0+' /etc/ # E with capital
# egrep is same as grep -E
egrep -r '0{3,}' /etc/ # min and max amount of repetitions
egrep -r '10{,3}' /etc/ # string with 1 the at most 3 zeros
egrep -r '0{3}' /etc/ # exactly 3 zeros
egrep -r 'disabled?' /etc/ # d is optional
egrep -r 'disabled|enabled' /etc/ # or
egrep -r 'c[au]t' /etc/ # range [a-z] set [az]
egrep -r '/dev/[a-z]*' /etc/ # any number of letters from a-z
egrep -r '/dev/[a-z]*[0-9]?' /etc/ # any number of letters from a-z, with optional 0-9
egrep -r '/dev/([a-z]*[0-9]?)*' /etc/ # subexpression (regex gets repeated 0 or more times) will match tty0p0
egrep -r '/dev/(([a-z]|[A-Z])*[0-9]?)*' /etc/ # subexpression (regex gets repeated 0 or more times) will match tty0p0
egrep -r 'https[^:]' /etc/ # negated ranges
egrep -r 'http[^s:]' /etc/ # negated range set will only match http