0

If I want to search the entire filesystem for a file with the name bash, I can run the command

% find / -name "bash" 2> /dev/null

which, on my system produces

/bin/bash
/etc/apparmor.d/abstractions/bash
/usr/share/doc/bash
/usr/share/lintian/overrides/bash
/usr/share/menu/bash
/rofs/bin/bash
/rofs/etc/apparmor.d/abstractions/bash
/rofs/usr/share/doc/bash
/rofs/usr/share/lintian/overrides/bash
/rofs/usr/share/menu/bash

Which is fine, but I know there are certain directories on the system where the file definitely is not, so to the make the search more efficient, I updated the command to:

% find / \ 
-name "proc" -prune -o \
-name "sys" -prune -o \
-name "run" -prune -o \
-name "bash" \
2> /dev/null

Now I am getting screenfuls of extraneous files, why is find doing this?

find version

% find --version
find (GNU findutils) 4.7.0-git
1

1 Answer 1

3

Because you haven't specified a final action, find is treating this as if you'd done

find / \( -name .. -prune -o -name .... -o -name bash \) -print

The "-prune" returns true and so it prints out those directories. That means every directory called sys, every directory called proc and so on. Definitely a lot of directories if you have kernel source around!

eg

/sys
/var/run
/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/sys
/usr/src/linux-headers-3.16.0-4-amd64/include/config/keys/debug/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/nf/conntrack/proc
/usr/src/linux-headers-3.16.0-4-amd64/include/config/proc

All of those are called sys or run or proc or...

The simple answer is to add a -print to the end of your command

% find / -name "proc" -prune -o \
-name "sys" -prune -o \
-name "run" -prune -o \
-name "bash" -print \
2> /dev/null

Now find will only print bash entries

eg

/usr/share/doc/bash
/usr/share/lintian/overrides/bash
/usr/share/menu/bash
/bin/bash
6
  • thanks, so to summarize your first command, you could say that by default, the implicit -print action is always applied to all "primaries"? Aug 5, 2016 at 2:20
  • If there's no action defined (other than -prune) then GNU find will implicitly add -print for you. You had no action defined and so it took the whole expression as a single evaluation (effectively added the \(...\) around it) and then used the default -print action. Aug 5, 2016 at 2:22
  • thanks, yes I already knew about the implicit -print, in fact I had already tried your suggestion of adding an explicit print to the primary I wanted to print . i.e. -name "bash" -print . On my system that seems to make no difference, does it work for you on your system? Aug 5, 2016 at 2:27
  • What I posted is an exact cut'n'paste of a real session. Aug 5, 2016 at 2:28
  • Ah ok, I found what was happening - on my terminal I had (invisible) spaces after the `\` at the end of each line. When I cleaned these up, I get the same result as you Aug 5, 2016 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .