Shell Programming and Scripting

Oracle Linux 6.4/Bash shell

I am not an expert in find command

I wanted to delete all files with extension .dmp which are older than 60 days. So I executed rm command from within find as show below and it
deleted ALL THE FILES (even files without any extention) which the user had permission !!!!! Luckily this was a pre-production server.
Otherwise , this would have got me fired !! This is caused because I missed -name clause in the find command.

Code:

find / "*.dmp" -mtime +60 -exec rm {} \+ 2>/dev/null

Reproducing the "issue" (my stupidity)

To be safe, in the below example, I am using ls command instead of rm and I using /tmp instead of / directory.
I am skipping -name clause in the find and the ls command will list all files from /tmp .

Code:

$ pwd
/tmp
$
$
$ touch xyz.txt
$
$ find /tmp "*.txt" -mtime +60 -exec ls -larth {} \+ 2>/dev/null

The above command does list all files which are older than 60 days in all the subdirectories in /tmp but it ignores "*.txt" and lists all
the files in /tmp

I wish find command just errored out when you skip -name clause rather that returning all the files. It is dangerous

That is why I always try with -print before going on an rm rampage And try as much as possible to give the complete path and not just / (yeah I know sometimes it's not possible). I have a friend that wiped a server with a find exec rm (stopped at /bin/rm obviously) but he was able to restore everything before monitoring noticed (don't ask).

Did this 'friend' keep your job? Um, I mean 'their' job.

On a destruction side, I've done this at a DR site and it doesn't work well enough the clean a server out usually. I did manage to do a big move once though. We had a scheduled job that was failing with permissions, so we changed it to run as root and the job worked fine. The problem was that it was to move everything from a relative path to an archive filesystem and being root, it moved /dev, /etc, ..... which made recovery rather difficult, especially when you cannot log on as there are no devices

Well, we learn from our mistakes. We did recover and I kept my job



Robin

Yes.

Code:

find <SearchstartLocation> -name <pattern>

is the preferred syntax.

Alternatively you could use

Code:

find /path/pattern

It seems to search only within the specified directory (depth=1 ). So it is safe too

Example

Code:

# touch /u05/xyz.fooo
#
#
# find /u05/*.fooo -print
/u05/xyz.fooo
#
#

The below search which starts in / directory doesn't find the file xyz.fooo as it is within /u05 directory

Code:

# find /*.fooo -print
find: `/*.fooo': No such file or directory
#
#
#
# touch /abc.fooo
#
# find /*.fooo -print
/abc.fooo

Not really... The standard synopsis for the find utility is:

Code:

find [−H|−L] path... [operand_expression...]

Find uses each given path operand as a root from which the operand-expression will be evaluated. If you name a regular file as a path operand, only that file will be evaluated (not the directory in which it resides). If you name a directory, it will evaluate that directory and all files in the file hierarchy rooted in that directory (unless part of the operand_expression limits the search.

When you invoke the command:

Code:

find /u05/*.fooo -print

the shell expands /u05/*.fooo to a list of matching files before find starts running. If you run the command:

Code:

find /u05 -name '*.fooo' -print

the find utility is expanding the *.fooo looking for matching files in and under /u05 and (in your example) prints:

Code:

/u05/xyz.fooo

Note that a common mistake for newbies is to invoke the above command without the quotes:

Code:

find /u05 -name *.fooo -print

If you're sitting in / when you execute that command in your example, it won't print anything. The shell will expand the *.fooo to abc.fooo (which you created in /) so the arguments find will see will be:

Code:

find /u05 -name abc.fooo -print

and /u05 contains xyz.fooo; but no file named abc.fooo.

And the command:

Code:

find /tmp /u05 "$HOME" -name '*.fooo'

with or without a -print primary, will print /u05/xyz.fooo and the names of any other files in /tmp and its subdirectories, /u05 and its subdirectories, and your home directory and its subdirectories with names that end with .fooo.