Finding files in Linux

Many beginning Linux users experience difficulties getting used to the filesystem structure. Indeed, there are many files and directories, the structure of which are not as obvious as it could be. Choosing an appropriate location for a new file or directory is difficult and many choose to follow their own instincts.

With more experience, the file hierarchy becomes clearer and old concepts of placing files and directories start to fade out. When it happens, finding things becomes difficult. It is than that users learn that Linux has many tools for finding things. And it is than that they become confused once again.

Read on for a quick introduction into searching tools available in Linux.

find

find is a very powerful tool to search through filesystem hierarchy. It goes from directory to directory and from file to file. It finds only stuff that is physically present on the hard disk. find accepts a multitude of parameters. It can search for files and directories by name, path, mount point, inode number, owner, permissions, creation or modification timestamp, etc. It can perform a number of actions on the results – print them out, delete them, or pass them as parameters to external scripts.

find is one of those tools that you learn and than can’t imagine your life without. Read the manual page (man 1 find) and than refresh your memory once in a while.

Example of usage:

# Find in the current directory (recursively)
# all files named core.
[me@here dir]$ find . -name core

locate

Once you start using find, you’ll notice that searching through a large directory or even a whole hard drive takes a long time. You’ll get bored and tired of waiting and will be wondering if there is any other, – faster – way. It is than that you will be glad to learn about locate.

locate builds an index of all files and directories on the system and uses it to find things much faster than find. This index is refreshed periodically (anywhere from 1 day to 1 month – check your cron setup for specifics of your system).

While you would certainly appreciate the speed with which locate finds files and directories, I should warn that it can get pretty frastrating sometimes. You know that the file or directory is there, you are certain even, and you can list it with ls, but locate doesn’t find it. What’s wrong? Well, it can mean only one of two things. Either the file or directory that you are looking for is new, and was created after the last update to locate index and thus cannot be found. Or this directory is outside of those paths indexed by locate. Usually temporary and spool directories are not index as they are meant to hold short-lived items. Check the locate configuration file (usually /etc/updatedb.conf) for specifics of your system.

Example of usage:

# Find all files and directories on the 
# system that have exim in their name.
[me@here dir]$ locate exim

whereis

whereis looks for “tasty” stuff in the places where “tasty” stuff is usually stored. By “tasty” I mean program binaries, sources, and manuals. If you’ve used Linux even for a little while, you know that programs’ executables are usually stored in /bin, /sbin, /usr/bin, /usr/local/bin, and other similar directories. There are similar places for sources (/usr/include) and manuals (/usr/man/).

whereis just doesn’t forget about different locations and thus is a bit more efficient at findings interesting stuff than going through many places manually.

Example of usage:

# Find binaries, sources,
# and manuals for ls 
[me@here dir]$ where ls

which

which is one of those little simple programs that can save a lot of confusion. which tells you the full path of the program that you want to execute. For example, I can have a system-wide /bin/ls and my own modified version in /home/leonid/bin/ls. If I use just ls on the command line, than I am not sure which copy of the program the shell is executing. I can run which ls to make sure that the proper one will be started.

which works in a very simple manner. It looks for the program you asked in directories listed in your path (PATH environment variable) and outputs the full path to the first match. It uses exactly the same algorithm as shell itself uses.

If you are trying to start some program and get a different version of it or a totally other program instead, use which to make sure that you are running the proper copy. Also, you can use which to see if the program is in your PATH. If it says it’s not, than shell won’t find it either.

Example of usage:

# Find out which copy of ls
# will start by shell if no full
# path used
[me@here dir]$ which ls

rpm (or any other package manager for that matter)

RPM is a package manager. It is used to install, update and remove applications on your computer. RPM maintains its own database. RPM packages store information regarding what are they installing and where. When the package is installed, this information is added to the RPM database. When the package is removed, the information is also deleted from the database.

rpm tool can be used to query RPM database for directory and file locations. Note that it does know what was actually installed by the package, but rather only what the package told it it would install.

Example of usage:

# Find which binaries and
# in which directories exim
# package installed
[me@here dir]$ rpm -ql exim | grep bin