Loading...

VONDS ©

Lab 19: File Search and Manipulation

Back to Lab Index

Search for log and temporary files using find, then safely remove stale targets using -exec or a NUL-delimited xargs pipeline. Refresh the locate database and use locate to enumerate configuration files quickly.

core troubleshooting services

Scenario

The system has accumulated log and temporary files. You have been asked to identify log files under /var/log, find temporary files in /tmp older than 7 days, and remove stale temp files safely. You also need to list configuration files quickly using locate after refreshing the database.

Operator context

This is routine cleanup and triage: target precisely, verify matches, then delete with a safe execution path. The difference between “cleanup” and “incident” is usually one bad pattern.

Objective

  • Find all .log files under /var/log.
  • Find files in /tmp older than 7 days.
  • Delete files older than 7 days in /tmp using a safe find execution method.
  • Refresh the locate database.
  • Use locate to list configuration files matching *.conf.

Concepts

  • Targeted file discovery with find using -type, -name, and time filters like -mtime.
  • Safe deletion workflows: verify first, then delete with -exec (or pipe to xargs when appropriate).
  • Fast path-based search using locate and why updatedb matters.
  • Understanding patterns and quoting (globs vs strings) in search commands.

Walkthrough

Step 1: Find all .log files under /var/log.
Command 
find /var/log -type f -name '*.log'

find searches the filesystem in real time. Quoting '*.log' prevents the shell from expanding the glob before find runs. 

/var/log/syslog.log
/var/log/auth.log
Step 2: Find files in /tmp older than 7 days.
Command 
find /tmp -type f -mtime +7

-mtime +7 matches files whose data was last modified more than 7 days ago. This is a common cleanup filter for temp directories. 

/tmp/debug_old.txt
/tmp/archive_001.tmp
Step 3: Delete files older than 7 days in /tmp.
Command 
find /tmp -type f -mtime +7 -exec rm {} \;

-exec runs a command for each matched file. The \; terminator must be escaped so the shell passes it through. In production, run the same find without rm first, then add deletion once you trust the matches. 

Old temp files deleted.
Step 4: Update the locate database.
Command 
sudo updatedb

locate searches an index, not the live filesystem. updatedb refreshes that index so newly created or moved files can be found. 

mlocate database updated.
Step 5: Use locate to list *.conf files.
Command 
locate '*.conf'

Quoting the pattern prevents the shell from expanding it in your current directory. locate returns matching paths anywhere on the system from the index. 

/etc/ssh/sshd_config
/etc/nginx/nginx.conf
/etc/systemd/journald.conf
Step 6: Batch-delete with xargs using a safe NUL-delimited pipeline.
Command 
find /tmp -type f -mtime +7 -print0 | xargs -0 rm

This is the safe xargs pattern: -print0 and -0 prevent whitespace and special characters from breaking file names. Use this when you want one rm invocation that takes many paths at once. 

# No output is normal for rm on success.

Common breakpoints

Glob expands before find runs

If you forget quotes around patterns like *.log or *.conf, the shell may expand the glob in your current directory and change the command meaning. Quote patterns when passing them to find or locate.

Deleting the wrong paths under /tmp

Always run the find command without rm first to confirm matches. Avoid broad patterns that can catch active sockets, PID files, or app runtime state.

xargs breaks on whitespace or special characters

Use find -print0 with xargs -0. Without NUL delimiters, filenames with spaces, quotes, or newlines can split and cause incorrect deletions.

locate returns stale results

locate uses an index. If you do not run updatedb, the index may not include recent file changes and can return outdated paths.

Cleanup checklist

If you removed files from /tmp, confirm the directory still contains active runtime files expected by services, and re-run the search to verify your deletion filter is no longer matching targets.

Commands 
find /tmp -type f -mtime +7
locate '*.conf' | head
Success signal

The find query returns no stale files, and locate returns current paths after running updatedb.

Reference

  • find <path> -type f -name '<pattern>': Searches files in real time using filters.
    • -type f: Restricts matches to regular files.
    • -name '<pattern>': Matches filename patterns (quote globs).
  • find ... -mtime +<days>: Matches files modified more than N days ago.
    • -mtime +7: Files modified more than 7 days ago.
  • find ... -exec <cmd> {} \;: Executes a command once per matched path.
    • {}: Placeholder for the matched path.
    • \;: Terminator for -exec (must be escaped).
  • find ... -print0 | xargs -0 <cmd>: Safely passes paths to a command using NUL delimiters.
    • -print0: Outputs NUL-delimited paths.
    • xargs -0: Reads NUL-delimited input.
  • updatedb: Refreshes the locate database.
  • locate '<pattern>': Searches the locate database for matching paths.
    • Quote patterns to prevent shell glob expansion.