0

If I want to search the entire filesystem for a file with the name bash, I can run the command

% find / -name "bash" 2> /dev/null

which, on my system produces

/bin/bash
/etc/apparmor.d/abstractions/bash
/usr/share/doc/bash
/usr/share/lintian/overrides/bash
/usr/share/menu/bash
/rofs/bin/bash
/rofs/etc/apparmor.d/abstractions/bash
/rofs/usr/share/doc/bash
/rofs/usr/share/lintian/overrides/bash
/rofs/usr/share/menu/bash

Which is fine, but I know there are certain directories on the system where the file definitely is not, so to the make the search more efficient, I updated the command to:

% find / \ 
-name "proc" -prune -o \
-name "sys" -prune -o \
-name "run" -prune -o \
-name "bash" \
2> /dev/null

Now I am getting screenfuls of extraneous files, why is find doing this?

find version

% find --version
find (GNU findutils) 4.7.0-git
3

Because you haven't specified a final action, find is treating this as if you'd done

find / \( -name .. -prune -o -name .... -o -name bash \) -print

The "-prune" returns true and so it prints out those directories. That means every directory called sys, every directory called proc and so on. Definitely a lot of directories if you have kernel source around!

eg

/sys
/var/run
/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/sys
/usr/src/linux-headers-3.16.0-4-amd64/include/config/keys/debug/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/nf/conntrack/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/proc

All of those are called sys or run or proc or...

The simple answer is to add a -print to the end of your command

% find / -name "proc" -prune -o \
-name "sys" -prune -o \
-name "run" -prune -o \
-name "bash" -print \
2> /dev/null

Now find will only print bash entries

eg

/usr/share/doc/bash
/usr/share/lintian/overrides/bash
/usr/share/menu/bash
/bin/bash
  • thanks, so to summarize your first command, you could say that by default, the implicit -print action is always applied to all "primaries"? – the_velour_fog Aug 5 '16 at 2:20
  • If there's no action defined (other than -prune) then GNU find will implicitly add -print for you. You had no action defined and so it took the whole expression as a single evaluation (effectively added the \(...\) around it) and then used the default -print action. – Stephen Harris Aug 5 '16 at 2:22
  • thanks, yes I already knew about the implicit -print, in fact I had already tried your suggestion of adding an explicit print to the primary I wanted to print . i.e. -name "bash" -print . On my system that seems to make no difference, does it work for you on your system? – the_velour_fog Aug 5 '16 at 2:27
  • What I posted is an exact cut'n'paste of a real session. – Stephen Harris Aug 5 '16 at 2:28
  • Ah ok, I found what was happening - on my terminal I had (invisible) spaces after the `\` at the end of each line. When I cleaned these up, I get the same result as you – the_velour_fog Aug 5 '16 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.