Loading...

VONDS ©

Lab 19: File Search and Manipulation

Lab Index

Search for log and temporary files using find, then safely delete targets using -exec or xargs. Refresh the locate database and use locate to enumerate configuration files quickly.

core troubleshooting services

Scenario

The system has accumulated log and temporary files. You have been asked to identify log files under /var/log, find temporary files in /tmp older than 7 days, and remove stale temp files safely. You also need to list configuration files quickly using locate after refreshing the database.

Operator context

This is what cleanup and triage looks like in real environments: target precisely, verify matches, then delete with a safe execution path. The difference between “cleanup” and “incident” is usually one bad pattern.

Objective

  • Find all .log files under /var/log.
  • Find files in /tmp older than 7 days.
  • Delete files older than 7 days in /tmp using a safe find execution method.
  • Refresh the locate database.
  • Use locate to list configuration files matching *.conf.

What You’ll Practice

  • Targeted file discovery with find using -type, -name, and time filters like -mtime.
  • Safe deletion workflows: verify first, then delete with -exec (or pipe to xargs when appropriate).
  • Fast path-based search using locate and why updatedb matters.
  • Understanding patterns and quoting (globs vs strings) in search commands.

Walkthrough

Step 1 : Find all .log files under /var/log.
Command 
find /var/log -type f -name '*.log'

find searches the filesystem in real time. Quoting '*.log' ensures the shell does not expand the glob before find runs. 

/var/log/syslog.log
/var/log/auth.log
Step 2 : Find files in /tmp older than 7 days.
Command 
find /tmp -type f -mtime +7

-mtime +7 matches files whose data was last modified more than 7 days ago. This is a common cleanup filter for temp directories. 

/tmp/debug_old.txt
/tmp/archive_001.tmp
Step 3 : Delete files older than 7 days in-place.
Command 
find /tmp -type f -mtime +7 -exec rm {} \;

-exec runs a command for each matched file. The \; terminator must be escaped so the shell passes it through. In production, you often run the same find without rm first, then add deletion once you trust the matches. 

Old temp files deleted.
Step 4 : Update the locate database.
Command 
sudo updatedb

locate searches an index, not the live filesystem. updatedb refreshes that index so newly created or moved files can be found. 

mlocate database updated.
Step 5 : Use locate to list all *.conf files.
Command 
locate '*.conf'

Quoting the pattern prevents the shell from expanding it in your current directory. locate will return paths anywhere on the system that match the indexed pattern. 

/etc/ssh/sshd_config
/etc/nginx/nginx.conf
/etc/systemd/journald.conf
Step 6 : Batch-delete with xargs (safe pattern).
Command 
find /tmp -type f -mtime +7 -print0 | xargs -0 rm

This is the safe xargs pattern: -print0 and -0 prevent whitespace and special characters from breaking file names. Use this when you want one rm invocation that takes many paths at once. 

# No output is normal for rm on success.

Reference

  • find : Searches the filesystem in real time using filters such as -type, -name, and -mtime.
  • find ... -exec <cmd> {} \; : Executes a command once per matched path (the \; terminator must be escaped).
  • updatedb : Refreshes the locate database (required to keep locate results current).
  • locate <pattern> : Searches the locate database for matching paths (fast, but index-based).
  • xargs -0 : Safely builds command arguments from NUL-delimited input (pair with find -print0).