The Geek Diary

File Access Commands in Linux – find, sort, head, tail

by

The following file access commands are UNIX commands, not specific shell commands.

Command Remakr
find Finds the location of a file
sort Reads a file and sort the output
hear or tail Looks at just the start or end of a file

The find Command

The find command allows you to search for files and directories and to execute commands on those files. The syntax of the find command has three general argument sections. The paths section is a list of pathnames (directories) to search. The search_criteria section is a list of options that are considered to be a Boolean (true or false) expression. Each option (condition) is tested in turn and if the result is true, the indicated action is taken.

A few of the possible search criteria are:

  • -name – If the file name matches
  • -user – If the file belongs to a user (login name)
  • -atime – If the file was accessed the specified number of days ago
  • -mtime – If the file was last modified the specified number of days ago
  • -size – If the file is the specific block size

A few of the possible actions are:

  • -print – Displays the path name of the file
  • -exec – Executes the command
  • -ok – Executes the command only after receiving a y from stdin

Examples of Using the find Command

You do not need to know the entire name of the file to find it. For example, log files tend to grow rather rapidly. As a system administrator, you might want to watch the size of log files. To search for the administrative log files (files in the /var/log directory), use the following command:

# find /var/log -name "*.log" -print
/var/log/audit/audit.log
/var/log/tuned/tuned.log
/var/log/cloud-init.log
/var/log/pm-powersave.log
/var/log/awslogs-agent-setup.log
/var/log/awslogs.log
/var/log/boot.log
/var/log/wpa_supplicant.log
/var/log/amazon/ssm/amazon-ssm-agent.log
/var/log/amazon/ssm/errors.log
/var/log/amazon/ssm/hibernate.log
/var/log/dpkg.log
/var/log/yum.log
/var/log/auth.log

As part of a file system clean-up, you might want to search for core files and delete them. The following two commands find any file named core. The first command executes the rm command without operator input. The second command prints the rm command and requires operator input.

$ find / -name core -exec rm -f {} \;
$ find / -name core -ok rm -f {} \;

To find files that are larger than 1000 blocks, use the following command:

$ find / -size +1000 -print

The sort Command

A file, such as the password file, is frequently built by adding new users to the end of the file. The file is not in any particular order; however, when you are looking for something or someone in the file, it would be helpful if the file was sorted in some order. The sort command provides a way to sort the file.

Some of the more commonly used sort options are:

  • -r – Sorts in reverse order (z to a, instead of a to z)
  • -n – Sorts the fields numerically, instead of as just American Standard Code for Information Interchange (ASCII) strings
  • -t [ch] – Sets the field separator character
  • + num – Sets the field number from which to begin sorting (fields are numbered from 0 [zero])
  • – num – Sets the field number to stop sorting before (this is the first field that is not considered for sorting)
  • -b – Ignores leading blanks (they are normally considered to be part of the fields specified during keyed sorts)
  • -r – Sorts in reverse order (z to a, instead of a to z)
  • -o – file Sets the file to be used to hold the output of the sort (which might be the same file that contains the original input)
# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
...

To sort the file by the login name, use the following command:

# sort /etc/passwd
adm:x:3:4:adm:/var/adm:/sbin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
bin:x:1:1:bin:/bin:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
cloud_user:x:1002:1003::/home/cloud_user:/bin/bash
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
geoclue:x:994:990:User for geoclue:/var/lib/geoclue:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
...

To sort the file by the 5th field (the comment), where fields are separated by the colon, use the following command:

# sort -t: -k5 /etc/passwd
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
...

You can put the output of a sort into a file. You can even output the sort into the original file; for example:

# cat names
Big Ape 415
Roger Rabbit 408
Jessica Rabbit 510
Easter Rabbit 408
Doctor Doom 415
Easter Rabbit 408
Peter Wolf 510
Roger Rabbit 408
Peter Rabbit 510
# sort names -o names

Verify the file again:

# cat names
Big Ape 415
Doctor Doom 415
Easter Rabbit 408
Easter Rabbit 408
Jessica Rabbit 510
Peter Rabbit 510
Peter Wolf 510
Roger Rabbit 408
Roger Rabbit 408

If you have multiple files, already sorted, that you want to merge into a single file, use the following command:

# sort file1 file2 file3 -o file4

Merging files might give you duplicate entries. To output only the unique lines of the file, use the following command:

# sort -u names
Big Ape 415
Doctor Doom 415
Easter Rabbit 408
Jessica Rabbit 510
Peter Rabbit 510
Peter Wolf 510
Roger Rabbit 408

Reading Part of a File

Frequently, you do not want to review an entire file. You might want to browse the beginning of the file to determine if it is the correct one or look at the end of a file to review what was last entered in the file.

The head Command

To review the start of a file, use the head command:

# head -5 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

The tail Command

When reviewing log files, you are probably interested in only the last few entries of that file. You can use the tail command to look at the end of the file.

# tail -5 /etc/passwd
systemd-network:x:995:991:systemd Network Management:/:/sbin/nologin
geoclue:x:994:990:User for geoclue:/var/lib/geoclue:/sbin/nologin
cloud_user:x:1002:1003::/home/cloud_user:/bin/bash
ssm-user:x:1003:1004::/home/ssm-user:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin

You May Also Like