Help With 'find' Syntax

[Drew Tomlinson]

----- Original Message -----
From: "David Carter-Hitchin" <david at carter-hitchin.clara.co.uk>
To: "Drew Tomlinson" <drew at mykitchentable.net>
Sent: Friday, October 31, 2003 5:04 PM


> Hi Drew,
>
> Find is one of those classic commands for confusing people.  One just gets
> used to it over time.  The behaviour of find varies significantly with
> different unixes under different shells.
>
> Which shell are you using?

tcsh

> Under bash this command does what you want:
>
> find / -mtime 7 -size +1024c -ls -o -ctime 7 -size +1024c -ls
>
> the sense here is:
>
> find / (-mtime 7 -size +1024c -ls) -o (-ctime 7 -size +1024c -ls)
>
> meaning "find (i.e. examine all files) from / and either
>
> a) print (-ls) files modified exactly 7 days old and greater than size
> 1024 chars (bytes).
>
> or (-o)
>
> b) print (-ls) files whose inode creation times are exactly 7 days old and
> greater than size 1024 chars.
>
> If neither a) nor b) are true for a file found under / then it is silently
> ignored.
>
> You may find the following note from man find helpful:
>
> # All primaries which take a numeric argument allow the number to be pre-
> # ceded by a plus sign (``+'') or a minus sign (``-'').  A preceding plus
> # sign means ``more than n'', a preceding minus sign means ``less than n''
> # and neither means ``exactly n''.
>
> So that is why I put a "+" in from of 1024 - to find files over 1024 bytes
> (c).

This is the piece I was missing.  Thanks!

> So in your example below:
>
> > find /usr \( -mtime 6 -ls -size 100 \) -o \( -ctime 6 -ls -size 100
> > \) -print
>
> You are trying to find files that are exactly 100 512k blocks in
> size. Admittedly the files you found were not of this size and I don't
> know why they were found - I can replicate this on my machine here, but I
> don't know why - perhaps it is the file allocation.  This is why I chose
> 1024c instead of block size.
>
> > (And why is this file listed twice, anyway?)
>
> Perhaps because there was a symbolic link pointing to it (as shown by the
> '2' before the permissions).

Ah yes, that's why?  Thanks for your help and time.  Now if I could just
figure out where my disk space went...  I'm still not seeing anything
significant.  I'll go back and look (now that I know how) at Oct. 24 and see
if I can find anything there.

Thanks again!

Drew