Create a cpio archive and compress it:

localhost% find path/ -depth -print | cpio -oaV | gzip -c > archive.cpio.gz

Extract a cpio archive:

localhost% cpio -imVd < archive.cpio
localhost% cpio -imVd -I archive.cpio

List the contents of a cpio archive:

localhost% cpio -it < archive.cpio
localhost% cpio -it -I archive.cpio

Use cpio copy-pass to copy a directory structure to another location:

localhost% find path/ -depth -print | cpio -pamVd /new/parent/dir

cpio over SSH

To cpio a local directory, send the output to ssh and feed it to cpio on a remote host:

localhost% find path/ -depth -print | cpio -oaV | ssh user@host ‘cpio -imVd’
Ssh to a remote host, cpio a remote directory, and get its output locally:
localhost% ssh user@host “find path/ -depth -print | cpio -oaV” | cpio -imVd

cpio and rpm

Ever wanted to extract files from an RPM package without installing it? It’s easy. RPMv4 includes a utility called “rpm2cpio”, which creates a cpio stream of files from a given RPM. You can pipe this into cpio just like a regular archive or stream.

List the included files:

localhost% rpm2cpio foo.rpm | cpio -it
./usr/bin/foo
./usr/share/man/man1/foo.1.gz

Extract all files:

localhost% rpm2cpio foo.rpm | cpio -imVd

Extract only the manpage from that package:

localhost% rpm2cpio foo.rpm | cpio -imVd ./usr/share/man/man1/foo.1.gz

Source: http://bradthemad.org/tech/notes/cpio_directory.php

You’ll need at least 15 gigs of free space to make this work.

1) Download and unpack an AMI from Amazon

You can learn how to do that here, or if you have sufficient knowledge you can build a full linux filesystem

2) Prepare a new raw drive file

We’ll create a file backed drive, set it up so we can partition it and create a new filesystem.

Create the file by using the ‘dd’ command.

dd if=/dev/zero of=newimage.raw bs=1M count=10240

Add it to a loopback device

losetup -fv newimage.raw

Partition the file backed loopback device. For this we’ll just create one partition which is the whole disk. Make sure its bootable.

cfdisk /dev/loop0

Write the partition and exit

Now we’re going to create a filesystem on the partition we just created. Please note that there’s a problem with the way mfks works. When trying to automatically determine filesystem sizes on loopback devices it makes a mistake. So for this we need to do a few things.

Find the partition beginning, ending, number of blocks, number of cylinders, and blocksize

fdisk -l -u /dev/loop0

Disk /dev/loop0: 10.7 GB, 10737418240 bytes
255 heads, 63 sectors/track, 1305 cylinders, total 20971520 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x00000000

      Device Boot      Start         End      Blocks   Id  System
/dev/loop0p1   *          63    20964824    10482381   83  Linux

Create a new loopback device for the partition. We do this by calculating the beginning of the partition x blocksize

In this case that’s 512 * 63 (actually in most cases thats what it is)

losetup -fv -o $((512 * 63)) newimage.raw
Loop device is /dev/loop1

Remember those numbers we grabbed earlier using fdisk? Plunk them into this formula. For our example:

( END – START ) x Units / Block Size
If you don’t know the block size use 4096. That’s “standard” and usually the size configured on most ext2/3 filesystems.

So for us it’s this:

echo $(((20964824 - 63) * 512 / 4096 ))

This gives is the number of blocks we need to use in our next command, which is used to create a filesystem with a blocksize of 4096 on /dev/loop1 of block count 2620595. You have to specify the blocksize, otherwise mkfs will try and automatically determine a bunch of things for you which will just break things.

mkfs.ext3 -b 4096 /dev/loop1 2620595

3) Copy & Prepare New Root Filesystem

You can now mount this newly created filesystem somewhere and copy a root filesystem into it. If that filesystem happens to be a Xen image from Amazon, you can use that.

mkdir -p /mnt/loop/1
mount -t ext3 /dev/loop1 /mnt/loop/1
cp -a /some/root/filesystem/* /mnt/loop/1/

Xen virtual machines run with a special kernel that can run under KVM using Xenner, but not other platforms like VirtualBox, so we’re going to copy a real kernel in there. You can use one from another linux system if you want, it will work fine, but you should use one that has the modules required by your virtualization platform. We already have a KVM tuned kernel and initrd available so we’re going to use those.

Note: If you’re going to just copy in the initrd and kernel then make sure the initrd includes all of the modules required to boot your machine.

cp -r /some/boot/filesystem/* /mnt/loop/1/boot/

You should now see a the kernel, initrd and the grub directory in there.

Edit the menu.lst and make sure the root= is set to /dev/sda1

vim /mnt/loop/1/boot/grub/menu.lst

Edit the /etc/fstab in your mounted vm

vim /mnt/loop/1/etc/fstab

Because amazon’s best practices involve setting a random root password, which gets overridden at start time, you’ll have to solve that little problem.

chroot /mnt/loop/1
mv /etc/rc.local /etc/rc.local-old
passwd root
exit

5) Setup Grub on the New Drive

Now unmount /mnt/loop/1 and delete the loopback device for the partition (the one with the offset) so we can setup the bootloader. Grub complains about installing the MBR code when the loopback device is still active on the partition. Leave the loopback device for the entire drive. We’ll need that to get some numbers from fdisk.

umount /mnt/loop/1
losetup -d /mnt/loop1

fdisk -l -u /dev/loop0

Disk /dev/loop0: 10.7 GB, 10737418240 bytes
255 heads, 63 sectors/track, 1305 cylinders, total 20971520 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x00000000

Device Boot      Start         End      Blocks   Id  System
/dev/loop0p1   *          63    20964824    10482381   83  Linux

Make a note of the numbers that were presented here. We’ll need the following to setup grub

• Cylinders : 1305
• Heads : 255
• Sectors / Track : 63

These numbers may be different for you depending on the size of partition you created, or a whole bunch of other variables. It’s important to remember these values because we’ll need them for our next step, which is to setup grub.

The following lists the set of commands required to setup the bootloader on a file backed disk over a loopback device.

grub --device-map=/dev/null
device (hd0) /images/newimage.raw
geometry (hd0) 1305 255 63
root (hd0,0)
setup (hd0)

Here’s what that looks like in the grub dialogue:

grub --device-map=/dev/null

Probing devices to guess BIOS drives. This may take a long time.
Unknown partition table signature

[ Minimal BASH-like line editing is supported.   For
the   first   word,  TAB  lists  possible  command
completions.  Anywhere else TAB lists the possible
completions of a device/filename. ]
grub> device (hd0) /images/newimage.raw
device (hd0) /images/newimage.raw
grub> geometry (hd0) 1305 255 63
geometry (hd0) 1305 255 63
grub> root (hd0,0)
grub> setup (hd0)

Checking if "/boot/grub/stage1" exists... yes
Checking if "/boot/grub/stage2" exists... yes
Checking if "/boot/grub/e2fs_stage1_5" exists... yes
Running "embed /boot/grub/e2fs_stage1_5 (hd0)"...  17 sectors are embedded.
succeeded
Running "install /boot/grub/stage1 (hd0) (hd0)1+17 p (hd0,0)/boot/grub/stage2 /boot/grub/menu.lst"... succeeded
Done.
grub>quit

Conclusion

Yay! All you need to do now is delete all those loopback devices attached to your file, and boot it up in either KVM or VirtualBox
Hope you found that useful.

Source: http://blog.layerboom.com/2009/10/20/how-to-move-a-virtual-machine-from-ec2-to-virtualbox-or-kvm/

Now, upload your public key to a directory in your remote system. You need to import it and add it to the authorized_keys file with the command:

ssh-keygen -i -f key.pub >> ~/.ssh/authorized_keys

Replace key.pub with the path to your key. Now log out and start Putty.

In Putty, configure the following items:

* In Connection/Data, add your rmeote username
* Connection/SSH/Auth, browse to your private key file (<your_key_name>.ppk)
* Go back to Sessions, fill in the name or IP address of your remote machine, give your session a name and click on Save.

Now we need to set up Pageant – it is Pageant who will be doing the authentication for us. Open it up, right click on the icon in the system tray and select “Add key”. Select your private key. Now you have an item under “Saved sessions” in Pageant – clicking on your session will fire up Putty and Pageant handles authenticaton for you. Great eh? If your key has a passphrase, you will need to enter it only once, and after that Pageant remembers it for you.

Simple and a great time saver if you do this often

Source: http://www.dailyiteration.com/howto-passwordless-ssh-authentication-with-putty/

In its crudest form, this is called “poking a hole in the firewall.” I’ll call it an SSH back door. To use it, you’ll need a machine on the Internet that you can use as an intermediary.

In our example, we’ll call our machine blackbox.example.com. The machine behind the company firewall is called ginger. Finally, the machine that technical support is on will be called tech. Figure 4 explains how this is set up.

Here’s how to proceed:

1. Check that what you’re doing is allowed, but make sure you ask the right people. Most people will cringe that you’re opening the firewall, but what they don’t understand is that it is completely encrypted. Furthermore, someone would need to hack your outside machine before getting into your company. Instead, you may belong to the school of “ask-for-forgiveness-instead-of-permission.” Either way, use your judgment and don’t blame me if this doesn’t go your way.

2. SSH from ginger to blackbox.example.com with the -R flag. I’ll assume that you’re the root user on ginger and that tech will need the root user ID to help you with the system. With the -R flag, you’ll forward instructions of port 2222 on blackbox to port 22 on ginger. This is how you set up an SSH tunnel. Note that only SSH traffic can come into ginger: You’re not putting ginger out on the Internet naked.

You can do this with the following syntax:

~# ssh -R 2222:localhost:22 thedude@blackbox.example.com

Once you are into blackbox, you just need to stay logged in. I usually enter a command like:

thedude@blackbox:~$ while [ 1 ]; do date; sleep 300; done

to keep the machine busy. And minimize the window.
3. Now instruct your friends at tech to SSH as thedude into blackbox without using any special SSH flags. You’ll have to give them your password:

root@tech:~# ssh thedude@blackbox.example.com .
4. Once tech is on the blackbox, they can SSH to ginger using the following command:

thedude@blackbox:~$: ssh -p 2222 root@localhost
5. Tech will then be prompted for a password. They should enter the root password of ginger.

6. Now you and support from tech can work together and solve the problem. You may even want to use screen together! (See Trick 4.)

Source: IBM DeveloperWorks

$ /usr/local/pgsql/bin/psql postgres postgres
Password: (oldpassword)
# ALTER USER postgres WITH PASSWORD ‘tmppassword’;

$ /usr/local/pgsql/bin/psql postgres postgres
Password: (tmppassword)

Changing the password for a normal postgres user is similar as changing the password of the root user. Root user can change the password of any user, and the normal users can only change their passwords as Unix way of doing.

# ALTER USER username WITH PASSWORD ‘tmppassword’;

2. How to setup PostgreSQL SysV startup script?

$ su – root

# tar xvfz postgresql-8.3.7.tar.gz

# cd postgresql-8.3.7

# cp contrib/start-scripts/linux /etc/rc.d/init.d/postgresql

# chmod a+x /etc/rc.d/init.d/postgresql

3. How to check whether PostgreSQL server is up and running?

$ /etc/init.d/postgresql status
Password:
pg_ctl: server is running (PID: 6171)
/usr/local/pgsql/bin/postgres “-D” “/usr/local/pgsql/data”
[Note: The status above indicates the server is up and running]

$ /etc/init.d/postgresql status
Password:
pg_ctl: no server running
[Note: The status above indicates the server is down]

4. How to start, stop and restart PostgreSQL database?

# service postgresql stop
Stopping PostgreSQL: server stopped
ok

# service postgresql start
Starting PostgreSQL: ok

# service postgresql restart
Restarting PostgreSQL: server stopped
ok

5. How do I find out what version of PostgreSQL I am running?

$ /usr/local/pgsql/bin/psql test
Welcome to psql 8.3.7, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
\h for help with SQL commands
\? for help with psql commands
\g or terminate with semicolon to execute query
\q to quit

test=# select version();
version
—————————————————————————————————-
PostgreSQL 8.3.7 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
(1 row)

test=#

5. How to create a PostgreSQL user ?

There are two methods in which you can create user.

Method 1: Creating the user in the PSQL prompt, with CREATE USER command.

# CREATE USER ramesh WITH password ‘tmppassword’;
CREATE ROLE

Method 2: Creating the user in the shell prompt, with createuser command.

$ /usr/local/pgsql/bin/createuser sathiya
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n
CREATE ROLE

6. How to create a PostgreSQL Database ?

There are two metods in which you can create two databases.

Method 1: Creating the database in the PSQL prompt, with createuser command.

# CREATE DATABASE mydb WITH OWNER ramesh;
CREATE DATABASE

Method 2: Creating the database in the shell prompt, with createdb command.

$ /usr/local/pgsql/bin/createdb mydb -O ramesh
CREATE DATABASE

* -O owner name is the option in the command line.
7. How do I get a list of databases in a Postgresql database ?

# \l  [Note: This is backslash followed by lower-case L]
List of databases
Name | Owner | Encoding
———-+———-+———-
backup | postgres | UTF8
mydb | ramesh | UTF8
postgres | postgres | UTF8
template0 | postgres | UTF8
template1 | postgres | UTF8

8. How to Delete/Drop an existing PostgreSQL database ?

# \l
List of databases
Name | Owner | Encoding
———-+———-+———-
backup | postgres | UTF8
mydb | ramesh | UTF8
postgres | postgres | UTF8
template0 | postgres | UTF8
template1 | postgres | UTF8

# DROP DATABASE mydb;
DROP DATABASE

9. Getting help on postgreSQL commands

\? will show PSQL command prompt help. \h CREATE will shows help about all the commands that starts with CREATE, when you want something specific such as help for creating index, then you need to give CREATE INDEX.

# \?

# \h CREATE

# \h CREATE INDEX

10. How do I get a list of all the tables in a Postgresql database?

# \d

On an empty database, you’ll get “No relations found.” message for the above command.

11. How to turn on timing, and checking how much time a query takes to execute ?

# \timing — After this if you execute a query it will show how much time it took for doing it.

# \timing
Timing is on.

# SELECT * from pg_catalog.pg_attribute ;
Time: 9.583 ms

12. How To Backup and Restore PostgreSQL Database and Table?

We discussed earlier how to backup and restore postgres database and tables using pg_dump and psql utility.

13. How to see the list of available functions in PostgreSQL ?

To get to know more about the functions, say \df+

# \df

# \df+

14. How to edit PostgreSQL queries in your favorite editor ?

# \e

\e will open the editor, where you can edit the queries and save it. By doing so the query will get executed.
15. Where can i find the postgreSQL history file ?

Similar to the Linux ~/.bash_history file, postgreSQL stores all the sql command that was executed in a history filed called ~/.psql_history as shown below.

$ cat ~/.psql_history
alter user postgres with password ‘tmppassword’;
\h alter user
select version();
create user ramesh with password ‘tmppassword’;
\timing
select * from pg_catalog.pg_attribute;

Post from: The Geek Stuff

1. Upgrade RPM to the version in 11.0
2. Install the full package management stack from 11.0
3. Upgrade all packages.

Stages

The specific steps required to upgrade using the above method may vary from system to system, these are just those that I needed.

* Disable all the repositories I was using on 10.3.

mv /etc/zypp/repos.d /etc/zypp/repos.d.old

* Delete the repository cache.

rm /var/cache/zypp/zypp.db

* Add the main openSUSE 11.0 repository.

zypper ar http://download.opensuse.org/distribution/11.0/repo/oss openSUSE110

* Install the new RPM from openSUSE 11.0.

On 64bit:

rpm -Uhv ‘http://download.opensuse.org/distribution/11.0/repo/oss/suse/x86_64/rpm-4.4.2-199.1.x86_64.rpm’

Or if you are on 32 bit:

rpm -Uhv ‘http://download.opensuse.org/distribution/11.0/repo/oss/suse/i586/rpm-4.4.2-199.1.i586.rpm’

* Install the 11.0 package management stack.

zypper in zypper

* Add the 11.0 version of the nonoss and packman repositories, as I have several packages installed from these.

zypper ar http://download.opensuse.org/distribution/11.0/repo/non-oss openSUSE110_NonFree
zypper ar http://packman.iu-bremen.de/suse/11.0/ packman

* Upgrade all packages. At this point I had to confirm several package vendor changes and removal of a few obsolete packages.

zypper ref
zypper dup

* Reboot

Problems

I had only two significant problems after upgrading. Both turned out to be down to my having edited configuration files, so they were not automatically overwritten with the updated configuration files.

* Networkmanager would immediately disconnect after connecting. This turned out to be down to a stale dhclient configuration file. I solved this with:

mv ./dhclient.conf.rpmnew ./dhclient.conf

* openSUSE updater could not find any backends. This turned out to be down to a stale zypp configuration file. I solved this with:

mv /etc/zypp/zypp.conf.rpmnew /etc/zypp/zypp.conf

Since lack of a new configuration files can cause breakage in unexpected places it would be nice to offer users the chance of replacing or merging their configuration file changes, rather than requiring users to know about these files and merge them manually.

Source: http://blogs.warwick.ac.uk/bweber/entry/upgrading_opensuse_103/

Gentoo uses the file /etc/portage/package.keywords to configure when to use the masked version. Simply list the package and add your arch to unmask packages.

/etc/portage/package.keywords can look like this:

app-emulation/wine ~x86
net-www/mplayerplug-in   ~x86
media-libs/libquicktime ~x86
net-www/mozilla-firefox ~x86
media-video/transcode  ~x86

You can add entries to this file using the echo command:

echo app-cdr/k3b ~x86 >> /etc/portage/package.keywords

Explanation: (I/O Redirection, Bourne Shell Reference)

pgm > file     Output of pgm is redirected to file.
pgm < file     Program pgm reads its input from file.
pgm >> file    Output of pgm is appended to file.

:vnoremap > >gv
:vnoremap < <gv

An alternative for anyone using :behave mswin, is to select lines by holding down Shift and pressing the cursor down or up arrow keys. However, in select mode, if you press >, the selected text will be replaced with ‘>’. Instead, you can use Tab to increase the indent, and Shift-Tab to decrease it, with these mappings:

:vnoremap <Tab> >
:vnoremap <S-Tab> <

In select mode, visual-mode mappings temporarily set visual mode (:help Select-mode-mapping).Also, the select mode will be retained. You could use the following alternative if you want to exit from select mode after pressing Tab or Shift-Tab:

:vnoremap <Tab> >gV
:vnoremap <S-Tab> <gV

Following are the main reason to use editcap command.

• Divide a dump file into multiple files.
• Select only the required packets.
• Translate the capture file from one format to another.
• Ability to read from a compressed dump file.
• Make the job easier for network analyzer tool by loading only selective packets, instead of loading whole dump.
• All feature results in less time consumption when processing or analyzing packets.

Let us assume the scenario where you have to analyze only some specific packet types in a huge dump file. In this situation, we cant use the network packet analyzer (wireshark or ethereal) to load the huge dump file in a single shoh, as it will be a CPU intensive process and the system may hang. Editicap utility makes the job easier by giving only relevant packets, so it could be loaded by network analyzer tool in quick time.

Editcap is available in the wireshark package. Make sure wireshark/ethereal package is installed to use the editcap.

11 Practical Examples Of edicap Usage

Example 1: Discard set of packets from the beginning of input_dump file

The output_dump file will contain all packets except the first 10 packets.

# editcap -v input_dump output_dump 1-10

Example 2: Discard set of packets from the middle of input_dump file

The output_dump file will contain all packets except packets from 200 to 210.

# editcap -v input_dump output_dump 200-210

Example 3: Select multiple range of packets (from beginning and middle)

The output_dump file will contain first 10 packets and packets from 100 and 200.

# editcap -r  -v input_dump output_dump 1-10  100-200

Example 4: Change the encapsulation type of the capture file using option -T

By default the encapsulation type of the dump file is ether. The example below, translates the capture file into ieee-802-11-bsd format

# editcap -v -T  ieee-802-11-radiotap input_dump output_dump

Example 5: Process the compressed input_dump files

editcap automatically detects the compressed capture file formats. Currently it supports for the gzip format. In the example below, it takes packets from the compressed input file and writes the first 10 packets and the packets in-between 100 and 200 into the output_dump file.

# editcap -r -v input_dump.gz output_dump 1-10 100-200

Example 6: Extract packets between a specific timeperiod using option -A and -B

This example create the output_dump, which contains the packets that are captured between the time mentioned in option A and the time mentioned in option B.

# editcap -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump output_dump

Example 7: Change packet’s timestamp (reduce or advance) using option -t

To advances the timestamp of packets to one hour.

# editcap -t 3600 input_dump output_dump

To reduces the timestamp of packets to 30 minutes,

# editcap -t -1800 input_dump output_dump

Example 8: Remove duplicate packets from the output_dump file using option -d

The example below looks back the previous frames to find the duplication. Finally it gives the dump which does not contain duplication.

# editcap -v -d input_dump output_dump

Example 9: Truncate the packets to the specific length using option -s

Produces the ouptut_dump file with packets length limited to 100. This can be very helpful under lot of situations. For example, you can use this method if you want to get only the IP layer of all the packets and does not require other layer.

# editcap -s 100 -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump.gz output_dump

Example 10: Divide input_dump file into multiple files using option -c

Divide the single dump into multiple file and each contains specified number of packets.

# editcap -v -c 1000 input_dump output

If the input_dump contains 5000 packets, editcap will generate the following 5 different output files.

output-00000
output-00001
output-00002
output-00003
output-00004

Example 11: Remove certain bytes from the bottom of all packets using option -C

This example removes 10 bytes from every packets and writes into the output file. You can confirm this, by viewing the output file in wireshark, the frame layer of every packet will show “50 bytes bytes on wire, 40 bytes captured” (here the actual size of a packet is 50 bytes).

# editcap -C 10 input_dump output

This article was written by Balakrishnan Mariyappan. He is working in bk Systems (p) Ltd, and interested in contributing to the open source.

1. Find Files Using Name

This is a basic usage of the find command. This example finds all files with name — MyCProgram.c in the current directory and all it’s sub-directories.

# find -name "MyCProgram.c"
./backup/MyCProgram.c
./MyCProgram.c

2. Find Files Using Name and Ignoring Case

This is a basic usage of the find command. This example finds all files with name — MyCProgram.c (ignoring the case) in the current directory and all it’s sub-directories.

# find -iname "MyCProgram.c"
./mycprogram.c
./backup/mycprogram.c
./backup/MyCProgram.c
./MyCProgram.c

3. Limit Search To Specific Directory Level Using mindepth and maxdepth

Find the passwd file under all sub-directories starting from root directory.

# find / -name passwd
./usr/share/doc/nss_ldap-253/pam.d/passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd

Find the passwd file under root and one level down. (i.e root — level 1, and one sub-directory — level 2)

# find -maxdepth 2 -name passwd
./etc/passwd

Find the passwd file under root and two levels down. (i.e root — level 1, and two sub-directories — level 2 and 3 )

# find / -maxdepth 3 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd

Find the password file between sub-directory level 2 and 4.

# find -mindepth 3 -maxdepth 5 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd

4. Executing Commands on the Files Found by the Find Command.

In the example below, the find command calculates the md5sum of all the files with the name MyCProgram.c (ignoring case). {} is replaced by the current file name.

# find -iname "MyCProgram.c" -exec md5sum {} \;
d41d8cd98f00b204e9800998ecf8427e  ./mycprogram.c
d41d8cd98f00b204e9800998ecf8427e  ./backup/mycprogram.c
d41d8cd98f00b204e9800998ecf8427e  ./backup/MyCProgram.c
d41d8cd98f00b204e9800998ecf8427e  ./MyCProgram.c

5. Inverting the match.

Shows the files or directories whose name are not MyCProgram.c .Since the maxdepth is 1, this will look only under current directory.

# find -maxdepth 1 -not -iname "MyCProgram.c"
.
./MybashProgram.sh
./create_sample_files.sh
./backup
./Program.c

6. Finding Files by its inode Number.

Every file has an unique inode number, using that we can identify that file. Create two files with similar name. i.e one file with a space at the end.

# touch "test-file-name"

# touch "test-file-name "
[Note: There is a space at the end]

# ls -1 test*
test-file-name
test-file-name

From the ls output, you cannot identify which file has the space at the end. Using option -i, you can view the inode number of the file, which will be different for these two files.

# ls -i1 test*
16187429 test-file-name
16187430 test-file-name

You can specify inode number on a find command as shown below. In this example, find command renames a file using the inode number.

# find -inum 16187430 -exec mv {} new-test-file-name \;

# ls -i1 *test*
16187430 new-test-file-name
16187429 test-file-name

You can use this technique when you want to do some operation with the files which are named poorly as shown in the example below. For example, the file with name — file?.txt has a special character in it. If you try to execute “rm file?.txt”, all the following three files will get removed. So, follow the steps below to delete only the “file?.txt” file.

# ls
file1.txt  file2.txt  file?.txt

Find the inode numbers of each file.

# ls -i1
804178 file1.txt
804179 file2.txt
804180 file?.txt

Use the inode number to remove the file that had special character in it as shown below.

# find -inum 804180 -exec rm {} \;

# ls
file1.txt  file2.txt
[Note: The file with name "file?.txt" is now removed]

7. Find file based on the File-Permissions

Following operations are possible.

• Find files that match exact permission
• Check whether the given permission matches, irrespective of other permission bits
• Search by giving octal / symbolic representation

For this example, let us assume that the directory contains the following files. Please note that the file-permissions on these files are different.

# ls -l
total 0
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
---------- 1 root root 0 2009-02-19 20:31 no_for_all
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r----- 1 root root 0 2009-02-19 20:27 others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27 others_can_only_read

Find files which has read permission to group. Use the following command to find all files that are readable by the world in your home directory, irrespective of other permissions for that file.

# find . -perm -g=r -type f -exec ls -l {} \;
-rw-r--r-- 1 root root 0 2009-02-19 20:30 ./everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 ./all_for_all
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read
-rw-r----- 1 root root 0 2009-02-19 20:27 ./others_can_also_read

Find files which has read permission only to group.

# find . -perm g=r -type f -exec ls -l {} \;
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read

Find files which has read permission only to group [ search by octal ]

# find . -perm 040 -type f -exec ls -l {} \;
----r----- 1 root root 0 2009-02-19 20:27 ./others_can_only_read

8. Find all empty files (zero byte file) in your home directory and it’s subdirectory

Most files of the following command output will be lock-files and place holders created by other applications.

# find ~ -empty

List all the empty files only in your home directory.

# find . -maxdepth 1 -empty

List only the non-hidden empty files only in the current directory.

# find . -maxdepth 1 -empty -not -name ".*"

9. Finding the Top 5 Big Files

The following command will display the top 5 largest file in the current directory and it’s subdirectory. This may take a while to execute depending on the total number of files the command has to process.

# find . -type f -exec ls -s {} \; | sort -n -r | head -5

10. Finding the Top 5 Small Files

Technique is same as finding the bigger files, but the only difference the sort is ascending order.

# find . -type f -exec ls -s {} \; | sort -n  | head -5

In the above command, most probably you will get to see only the ZERO byte files ( empty files ). So, you can use the following command to list the smaller files other than the ZERO byte files.

# find . -not -empty -type f -exec ls -s {} \; | sort -n  | head -5

11. Find Files Based on file-type using option -type

Find only the socket files.

# find . -type s

Find all directories

# find . -type d

Find only the normal files

# find . -type f

Find all the hidden files

# find . -type f -name ".*"

Find all the hidden directories

# find -type d -name ".*"

12. Find files by comparing with the modification time of other file.

Show files which are modified after the specified file. The following find command displays all the files that are created/modified after ordinary_file.

# ls -lrt
total 0
-rw-r----- 1 root root 0 2009-02-19 20:27 others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27 others_can_only_read
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
---------- 1 root root 0 2009-02-19 20:31 no_for_all

# find -newer ordinary_file
.
./everybody_read
./all_for_all
./no_for_all

13. Find Files by Size

Using the -size option you can find files by size.

Find files bigger than the given size

# find ~ -size +100M

Find files smaller than the given size

# find ~ -size -100M

Find files that matches the exact given size

# find ~ -size 100M

Note: – means less than the give size, + means more than the given size, and no symbol means exact given size.

14. Create Alias for Frequent Find Operations

If you find some thing as pretty useful, then you can make it as an alias. And execute it whenever you want.

Remove the files named a.out frequently.

# alias rmao="find . -iname a.out -exec rm {} \;"
# rmao

Remove the core files generated by c program.

# alias rmc="find . -iname core -exec rm {} \;"
# rmc

15. Remove big archive files using find command

The following command removes *.zip files that are over 100M.

# find / -type f -name *.zip -size +100M -exec rm -i {} \;"

Remove all *.tar file that are over 100M using the alias rm100m (Remove 100M). Use the similar concepts and create alias like rm1g, rm2g, rm5g to remove file size greater than 1G, 2G and 5G respectively.

# alias rm100m="find / -type f -name *.tar -size +100M -exec rm -i {} \;"
# alias rm1g="find / -type f -name *.tar -size +1G -exec rm -i {} \;"
# alias rm2g="find / -type f -name *.tar -size +2G -exec rm -i {} \;"
# alias rm5g="find / -type f -name *.tar -size +5G -exec rm -i {} \;"

# rm100m
# rm1g
# rm2g
# rm5g

This article was written by SathiyaMoorthy, author of numbertotext Vim plugin, which will replace the numbers with the equivalent text inside Vim. The Geek Stuff welcomes your tips and guest articles.