Technical document collection

Linux初学之体验Find+xargs

linux版本fedora core 6

内核版本2.6.18-1.2798.fc6

 

由于局域网内某台windos机器中毒，导致服务器samba共享文件夹下出现n多Desktop_.ini

手动一一删除显然不现实（存在于每个文件夹下）

经多方打探，google  baidu  live  yahoo等终于找到解决办法

可以用find+xargs来操作

samba共享文件夹路径为 /opt/english/

具体命令如下

 

find后一定加上路径，最好不要用/，否则可能会很耗时

而且貌似find不设定路径的话默认是./即当前文件夹

-name为find参数，更多参数问man

建议在执行这条命令前先运行该命令的前半部分

如果执行无结果显示，再敲个

更新一下

这里也可以将find /opt/english/ -name替换成locate

不过经测试发现，假如某文件在/tmp/下时，locate命令无法找到

真是太神奇了，windows下需要n次鼠标键盘的搜索并删除在linux下一个命令行就解决

当然上例只是个简单的删除名字相同的一批文件，还可以结合find的用法组合多种方式执行

比如特定文件夹下最近两个小时更新的文件，或者文件大小是0的文件

xargs还可以用ls ，locate，px等等组合出多种应用

留着以后再进一步研究

 

ps，本例中删除众多Desktop_.ini还利用find命令的-exec参数来操作

 

再次感叹一下，linux真是博大精深，命令行操作便捷又高效，94不太容易记

附加以上涉及到的命令的用法

 

find
find命令基本形式如下

find pathname -options [-print] [-exec] [-ok]

pathname:  查找的目录路径。例如用.来表示当前目录，用/来表示系统根目录。
-print：   将匹配的文件输出到标准输出。
-exec：    对匹配的文件执行该参数所给出的shell命令。相应命令的形式为' command' {} \;，注意{ }和\；之间的空格。
-ok：       和-exec的作用相同，只不过以一种更为安全的模式来执行该参数所给出的s h e l l命令，在执行每一个命令之前，都会给出提示，让用户来确定是否执行。

options:

常用的：

-name：按照文件名查找文件 -iname: 同上，区分大小写 -perm：按照文件权限来查找文件。 -prune：使用这一选项可以使find命令不在当前指定的目录中查找，如果同时使用-depth选项，那么-prune将被find命令忽略。 -user： 按照文件属主来查找文件。 -group：按照文件所属的组来查找文件。 -mtime -n +n：按照文件的更改时间来查找文件， - n表示文件更改时间距现在n天以内，+ n表示文件更改时间距现在n天以前。find命令还有 -atime 和 -ctime 选项 -nogroup：查找无有效所属组的文件，即该文件所属的组在/etc/groups中不存在。 -nouser：查找无有效属主的文件，即该文件的属主在/etc/passwd中不存在。 -newer file1 ! file2：查找更改时间比文件file1新但比文件file2旧的文件。 -type 查找某一类型的文件，诸如： b - 块设备文件。 d - 目录。 c - 字符设备文件。 p - 管道文件。 l - 符号链接文件。 f - 普通文件。 -size n：[c] 查找文件长度为n块的文件，带有c时表示文件长度以字节计。 -depth：在查找文件时，首先查找当前目录中的文件，然后再在其子目录中查找。 -fstype：查找位于某一类型文件系统中的文件，这些文件系统类型通常可以在配置文件/etc/fstab中找到，该配置文件中包含了本系统中有关文件系统的信息。 -mount：在查找文件时不跨越文件系统mount点。 -follow：如果遇到符号链接文件，就跟踪至链接所指向的文件。 -cpio：对匹配的文件使用cpio命令，将这些文件备份到磁带设备中。

wholname pattern选项

-wholename pattern -iwholename patern -path pattern -ipath pattern -regex expr -iregex expr  -regextype name -regextype name    regex types:    'emacs'    'posix-awk'    'posix-basic'    'posix-egrep'    'posix-extended'

symbolic link options:

time options:

1. access (read the file's contents) 2. change the status (modify the file or its attributes) 3. modify (change the file's contents)

last accessed:
Hours:

-atime n -ctime n -mtime n

minutes:

-amin n -cmin n -mmin n

find /u/bill -amin +2 -amin -6

-daystart

 Measure times from the beginning of today rather than from 24 hours
ago.  So, to list the regular files in your home directory that were modified yesterday, do

find ~ -daystart -type f -mtime 1

Comparing Timestamps

-anewer file -cnewer file -newer file -used n

Combining Primaries With Operators
`( EXPR )'
     Force precedence.  True if EXPR is true.

`! EXPR'
`-not EXPR'
     True if EXPR is false.  In some shells, it is necessary to protect
     the `!' from shell interpretation by quoting it.

`EXPR1 EXPR2'
`EXPR1 -a EXPR2'
`EXPR1 -and EXPR2'
     And; EXPR2 is not evaluated if EXPR1 is false.

`EXPR1 -o EXPR2'
`EXPR1 -or EXPR2'
     Or; EXPR2 is not evaluated if EXPR1 is true.

`EXPR1 , EXPR2'
     List; both EXPR1 and EXPR2 are always evaluated.  True if EXPR2 is
     true.  The value of EXPR1 is discarded.  This operator lets you do
     multiple independent operations on one traversal, without
     depending on whether other operations succeeded.  The two
     operations EXPR1 and EXPR2 are not always fully independent, since
     EXPR1 might have side effects like touching or deleting files, or
     it might use `-prune' which would also affect EXPR2.



忽略某个目录

$ find /apps -path "/apps/bin" -prune -o -print

避开多个文件夹

find /usr/sam \( -path /usr/sam/dir1 -o -path /usr/sam/file1 \) -prune -o -print

使用exec或ok来执行shell命令

使用find时，只要把想要的操作写在一个文件里，就可以用exec来配合find查找，很方便的.
-exec选项后面跟随着所要执行的命令或脚本，然后是一对{}，一个空格和一个\，最后是一个分号。

为了使用-exec选项，必须要同时使用print选项。如果验证一下find命令，会发现该命令只输出从当前路径起的相对路径及文件名。
在当前目录中文件属主具有读、写权限，并且文件所属组的用户和其他用户具有读权限的文件，可以用：

$ find . -type f -perm 644 -exec ls -l {} \;

查找系统中所有文件长度为0的普通文件，并列出它们的完整路径，可以用：

$ find / -type f -size 0 -exec ls -l {} \;

xargs

   在使用find命令的-exec选项处理匹配到的文件时， find命令将所有匹配到的文件一起传递给exec执行。但有些系统对能够传递给exec的命令长度有限制，这样在find命令运行几分钟之后，就会出现溢出错误。错误信息通常是“参数列太长”或“参数列溢出”。这就是xargs命令的用处所在，特别是与find命令一起使用。
 
   find命令把匹配到的文件传递给xargs命令，而xargs命令每次只获取一部分文件而不是全部，不像-exec选项那样。这样它可以先处理最先获取的一部分文件，然后是下一批，并如此继续下去。

  在有些系统中，使用-exec选项会为处理每一个匹配到的文件而发起一个相应的进程，并非将匹配到的文件全部作为参数一次执行；这样在有些情况下就会出现进程过多，系统性能下降的问题，因而效率不高；
  而使用xargs命令则只有一个进程。另外，在使用xargs命令时，究竟是一次获取所有的参数，还是分批取得参数，以及每一次获取参数的数目都会根据该命令的选项及系统内核中相应的可调参数来确定。

  来看看xargs命令是如何同find命令一起使用的，并给出一些例子。

下面的例子查找系统中的每一个普通文件，然后使用xargs命令来测试它们分别属于哪类文件

#find . -type f -print | xargs file ./.kde/Autostart/Autorun.desktop: UTF-8 Unicode English text ./.kde/Autostart/.directory: ISO-8859 text\ ......

在整个系统中查找内存信息转储文件(core dump) ，然后把结果保存到/tmp/core.log 文件中：

$ find / -name "core" -print | xargs echo "" >/tmp/core.log

在当前目录下查找所有用户具有读、写和执行权限的文件，并收回相应的写权限：

# ls -l drwxrwxrwx 2 sam adm 4096 10月 30 20:14 file6 -rwxrwxrwx 2 sam adm 0 10月 31 01:01 http3.conf -rwxrwxrwx 2 sam adm 0 10月 31 01:01 httpd.conf # find . -perm -7 -print | xargs chmod o-w # ls -l drwxrwxr-x 2 sam adm 4096 10月 30 20:14 file6 -rwxrwxr-x 2 sam adm 0 10月 31 01:01 http3.conf -rwxrwxr-x 2 sam adm 0 10月 31 01:01 httpd.conf

locate
    


 
    

locate PATTERN

is almost equivalent to

find DIRECTORIES -name PATTERN

`--all'
`-A'
     Print only names which match all non-option arguments, not those
     matching one or more non-option arguments.

`--basename'
`-b'
     The specified pattern is matched against just the last component of
     the name of a file in the `locate' database.  This last component
     is also called the "base name".  For example, the base name of
     `/tmp/mystuff/foo.old.c' is `foo.old.c'.  If the pattern contains
     metacharacters, it must match the base name exactly.  If not, it
     must match part of the base name.

`--count'
`-c'
     Instead of printing the matched file names, just print the total
     number of matches found, unless `--print' (`-p') is also present.

`--database=PATH'
`-d PATH'
     Instead of searching the default `locate' database, `locate'
     search the file name databases in PATH, which is a colon-separated
     list of database file names.  You can also use the environment
     variable `LOCATE_PATH' to set the list of database files to
     search.  The option overrides the environment variable if both are
     used.  Empty elements in PATH (that is, a leading or trailing
     colon, or two colons in a row) are taken to stand for the default
     database.  A database can be supplied on stdin, using `-' as an
     element of `path'. If more than one element of `path' is `-',
     later instances are ignored (but a warning message is printed).

`--existing'
`-e'
     Only print out such names which currently exist (instead of such
     names which existed when the database was created).  Note that
     this may slow down the program a lot, if there are many matches in
     the database.  The way in which broken symbolic links are treated
     is affected by the `-L', `-P' and `-H' options.  Please note that
     it is possible for the file to be deleted after `locate' has
     checked that it exists, but before you use it.

`--non-existing'
`-E'
     Only print out such names which currently do not exist (instead of
     such names which existed when the database was created).  Note that
     this may slow down the program a lot, if there are many matches in
     the database.  The way in which broken symbolic links are treated
     is affected by the `-L', `-P' and `-H' options.  Please note that
     `locate' checks that the file does not exist, but a file of the
     same name might be created after `locate''s check but before you
     read `locate''s output.

`--follow'
`-L'
     If testing for the existence of files (with the `-e' or `-E'
     options), consider broken symbolic links to be non-existing.  This
     is the default behaviour.

`--nofollow'
`-P'
`-H'
     If testing for the existence of files (with the `-e' or `-E'
     options), treat broken symbolic links as if they were existing
     files.  The `-H' form of this option is provided purely for
     similarity with `find'; the use of `-P' is recommended over `-H'.

`--ignore-case'
`-i'
     Ignore case distinctions in both the pattern and the file names.

`--limit=N'
`-l N'
     Limit the number of results printed to N.  When used with the
     `--count' option, the value printed will never be larger than this
     limit.

`--mmap'
`-m'
     Accepted but does nothing.  The option is supported only to provide
     compatibility with BSD's `locate'.

`--null'
`-0'
     Results are separated with the ASCII NUL character rather than the
     newline character.  To get the full benefit of the use of this
     option, use the new `locate' database format (that is the default
     anyway).

`--print'
`-p'
     Print search results when they normally would not, because of the
     presence of `--statistics' (`-S') or `--count' (`-c').

`--wholename'
`-w'
     The specified pattern is matched against the whole name of the
     file in the `locate' database.  If the pattern contains
     metacharacters, it must match exactly.  If not, it must match part
     of the whole file name.  This is the default behaviour.

`--regex'
`-r'
     Instead of using substring or shell glob matching, the pattern
     specified on the command line is understood to be a regular
     expression.  GNU Emacs-style regular expressions are assumed unless
     the `--regextype' option is also given.  File names from the
     `locate' database are matched using the specified regular
     expression.  If the `-i' flag is also given, matching is
     case-insensitive.  Matches are performed against the whole path
     name, and so by default a pathname will be matched if any part of
     it matches the specified regular expression.  The regular
     expression may use `^' or `$' to anchor a match at the beginning
     or end of a pathname.

`--regextype'
     This option changes the regular expression syntax and behaviour
     used by the `--regex' option.  *Note Regular Expressions:: for more
     information on the regular expression dialects understood by GNU
     findutils.

`--stdio'
`-s'
     Accepted but does nothing.  The option is supported only to provide
     compatibility with BSD's `locate'.

`--statistics'
`-S'
     Print some summary information for each `locate' database.  No
     search is performed unless non-option arguments are given.

`--help'
     Print a summary of the command line usage for `locate' and exit.

`--version'
     Print the version number of `locate' and exit.

updatedb


`--findoptions='OPTION...''
     Global options to pass on to `find'.  The environment variable
     `FINDOPTIONS' also sets this value.  Default is none.

`--localpaths='PATH...''
     Non-network directories to put in the database.  Default is `/'.

`--netpaths='PATH...''
     Network (NFS, AFS, RFS, etc.) directories to put in the database.
     The environment variable `NETPATHS' also sets this value.  Default
     is none.

`--prunepaths='PATH...''
     Directories to omit from the database, which would otherwise be
     included.  The environment variable `PRUNEPATHS' also sets this
     value.  Default is `/tmp /usr/tmp /var/tmp /afs'.  The paths are
     used as regular expressions (with `find ... -regex', so you need
     to specify these paths in the same way that `find' will encounter
     them.  This means for example that the paths must not include
     trailing slashes.

`--prunefs='PATH...''
     Filesystems to omit from the database, which would otherwise be
     included.  Note that files are pruned when a filesystem is reached;
     Any filesystem mounted under an undesired filesystem will be
     ignored.  The environment variable `PRUNEFS' also sets this value.
     Default is `nfs NFS proc'.

`--output=DBFILE'
     The database file to build.  Default is system-dependent, but
     typically `/usr/local/var/locatedb'.

`--localuser=USER'
     The user to search the non-network directories as, using `su'.
     Default is to search the non-network directories as the current
     user.  You can also use the environment variable `LOCALUSER' to
     set this user.

`--netuser=USER'
     The user to search network directories as, using `su'.  Default
     `user' is `daemon'.  You can also use the environment variable
     `NETUSER' to set this user.

`--old-format'
     Generate a `locate' database in the old format, for compatibility
     with versions of `locate' other than GNU `locate'.  Using this
     option means that `locate' will not be able to properly handle
     non-ASCII characters in file names (that is, file names containing
     characters which have the eighth bit set, such as many of the
     characters from the ISO-8859-1 character set).

`--help'
     Print a summary of the command line usage and exit.

`--version'
     Print the version number of `updatedb' and exit.

 

 

Bring back deleted files with lsof

 

There you are, happily playing around with an audio file you've spent all afternoon tweaking, and you're thinking, "Wow, doesn't it sound great? Lemme just move it over here." At that point your subconscious chimes in, "Um, you meant mv, not rm, right?" Oops. I feel your pain -- this happens to everyone. But there's a straightforward method to recover your lost file, and since it works on every standard Linux system, everyone ought to know how to do it.

Briefly, a file as it appears somewhere on a Linux filesystem is actually just a link to an inode, which contains all of the file's properties, such as permissions and ownership, as well as the addresses of the data blocks where the file's content is stored on disk. When you rm a file, you're removing the link that points to its inode, but not the inode itself; other processes (such as your audio player) might still have it open. It's only after they're through and all links are removed that an inode and the data blocks it pointed to are made available for writing.

This delay is your key to a quick and happy recovery: if a process still has the file open, the data's there somewhere, even though according to the directory listing the file already appears to be gone.

This is where the Linux process pseudo-filesystem, the /proc directory, comes into play. Every process on the system has a directory here with its name on it, inside of which lies many things -- including an fd ("file descriptor") subdirectory containing links to all files that the process has open. Even if a file has been removed from the filesystem, a copy of the data will be right here:

/proc/process id/fd/file descriptor

To know where to go, you need to get the id of the process that has the file open, and the file descriptor. These you get with lsof, whose name means "list open files." (It actually does a whole lot more than this and is so useful that almost every system has it installed. If yours isn't one of them, you can grab the latest version straight from its author.)

Once you get that information from lsof, you can just copy the data out of /proc and call it a day.

This whole thing is best demonstrated with a live example. First, create a text file that you can delete and then bring back:

$ man lsof | col -b > myfile

Then have a look at the contents of the file that you just created:

$ less myfile

You should see a plaintext version of lsof's huge man page looking out at you, courtesy of less.

Now press Ctrl-Z to suspend less. Back at a shell prompt make sure your file is still there:

$ ls -l myfile
-rw-r--r--  1 jimbo jimbo 114383 Oct 31 16:14 myfile
$ stat myfile
  File: `myfile'
  Size: 114383          Blocks: 232        IO Block: 4096   regular file
Device: 341h/833d       Inode: 1276722     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1010/    jimbo)   Gid: ( 1010/    jimbo)
Access: 2006-10-31 16:15:08.423715488 -0400
Modify: 2006-10-31 16:14:52.684417746 -0400
Change: 2006-10-31 16:14:52.684417746 -0400

Yup, it's there all right. OK, go ahead and oops it:

$ rm myfile
$ ls -l myfile
ls: myfile: No such file or directory
$ stat myfile
stat: cannot stat `myfile': No such file or directory
$

It's gone.

At this point, you must not allow the process still using the file to exit, because once that happens, the file will really be gone and your troubles will intensify. Your background less process in this walkthrough isn't going anywhere (unless you kill the process or exit the shell), but if this were a video or sound file that you were playing, the first thing to do at the point where you realize you deleted the file would be to immediately pause the application playback, or otherwise freeze the process, so that it doesn't eventually stop playing the file and exit.

Now to bring the file back. First see what lsof has to say about it:

$ lsof | grep myfile
less      4158    jimbo    4r      REG       3,65   114383   1276722 /home/jimbo/myfile (deleted)

The first column gives you the name of the command associated with the process, the second column is the process id, and the number in the fourth column is the file descriptor (the "r" means that it's a regular file). Now you know that process 4158 still has the file open, and you know the file descriptor, 4. That's everything you have to know to copy it out of /proc.

You might think that using the -a flag with cp is the right thing to do here, since you're restoring the file -- but it's actually important that you don't do that. Otherwise, instead of copying the literal data contained in the file, you'll be copying a now-broken symbolic link to the file as it once was listed in its original directory:

$ ls -l /proc/4158/fd/4
lr-x------  1 jimbo jimbo 64 Oct 31 16:18 /proc/4158/fd/4 -> /home/jimbo/myfile (deleted)
$ cp -a /proc/4158/fd/4 myfile.wrong
$ ls -l myfile.wrong
lrwxr-xr-x  1 jimbo jimbo 24 Oct 31 16:22 myfile.wrong -> /home/jimbo/myfile (deleted)
$ file myfile.wrong
myfile.wrong: broken symbolic link to `/home/jimbo/myfile (deleted)'
$ file /proc/4158/fd/4
/proc/4158/fd/4: broken symbolic link to `/home/jimbo/myfile (deleted)'

So instead of all that, just a plain old cp will do the trick:

$ cp /proc/4158/fd/4 myfile.saved

And finally, verify that you've done good:

$ ls -l myfile.saved
-rw-r--r--  1 jimbo jimbo 114383 Oct 31 16:25 myfile.saved
$ man lsof | col -b > myfile.new
$ cmp myfile.saved myfile.new

No complaints from cmp -- your restoration is the real deal.

什么是SSH

　　SSH (Secure Shell)是一套安全的网络连接程序,它可以让你通过网络连接至其他电脑，在其他电脑上执行程序,在电脑之间拷贝文件,它甚至可以提供给你更安全的X连接，而以上的这些连接，都是在编码的保护下完成的。也就是说安装了SSH后就可以将不安全的Telnet和FTP给关掉了。

　　为什么要使用SSH

　　上面所说的各项功能,早期BSD所提供的r指令(rsh, rlogin, rcp)几乎都能完成,那为什么要用SSH呢?理由就在于r指令所提供的连接并没有经过编码加密,有心人只要使用合适的工具就能够截下你所输入的每一个字,包括密码。如果你利用X protocol在远端机器执行X程序，也可以截下你传输的资料,当然也包括密码。而SSH就针对了这些弱点做了弥补,对所传输的资料加以编码。

　　SSH2与SSH1

　　SSH2对SSH1的程序码做了大幅度的改写,根据SSH公司的说法, SSH2有98%的程序码和SSH1的不一样。除了SSH1所提供的RSA法之外，SSH2也提供了另外的公开金匙编码法以及金匙交换法,SSH2预设采用DSA编码以及Diffie-Hellman金匙交换法。此外,更提供了SFTP,使我们能在FTP方面也得到安全的保障。

　　文件下载：ftp://ftp.SSH.com/pub/SSH/；linuxnews.idv.tw/download/SSH-1.2.31.tar.gz 1MB for Linux Server；linuxnews.idv.tw/download/SSHWin-2.4.0-pl2.exe 5MB for Win32 Client

　　安装环境：Redhat 7.0

　　1、下载完后将文件解压缩

　　tar zxvf SSH-1.2.31.tar.gz

　　2、开始编译，安装

　　cd SSH-1.2.31;

　　./configure;

　　make;

　　make install;

　　3、编辑/etc/rc.d/rc.local加入/usr/sbin/SSHd以便开机自动启动。

　　4、完成

　　如果你是2台Linux要相连就都要装这个程序，如果是Windows系统要连Linux的话就要安装for Winxx的程序。Winxx部分请自己试试。

　　Linux的使用方法

　　/usr/bin/SSH -l username 187.136.5.1

　　然后输入密码，连进去后是一般的文字界面，就可以开始用了。

　　另外，SSH可以直接使用root登入。

　　注：如果你要对连接进来的IP做限制的话可以编辑/etc/hosts.deny和/etc/hosts.allow

　　示例如下：

　　/etc/hosts.deny：

　　ALL:ALL

　　#禁止所有IP使用所有的服务

　　/etc/hosts.allow：

　　SSHd:111.222.333.444

　　#开放111.222.333.444使用SSH连接

　　利用SSH来ftp

　　1、Linux对Linux传文件：

　　上传：scp wrong.php bha@187.136.5.1:

　　这时会问你密码，输入密码吧。

　　说明：

　　scp是指令

　　wrong.php是本地端的文件名

　　bha@187.136.5.1是远端的用户(user name)和IP

　　最后记住那个冒号一定要加，那是远端的home directory。

　　下传：scp bha@187.136.5.1:wrong.php .

　　说明：

　　用scp将bha@187.136.5.1目录的wrong.php拷贝到目前的目录(就是那个.)

　　2、Win对Linux传文件：

　　ls：就是dir

　　et：下传文件

　　put：上传文件

　　exit：退出ftp程序

　　指令：psftp-x86 187.136.5.1

　　这时会问名字密码和要不要产生加密键值，然后再用put和get来上下传文件

Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=492510

 

SSH或Telnet登录linux中文乱码解决办法

我的系统是Fedora core 6

 

通过修改

vi /etc/sysconfig/i18n

将内容改为

LANG="zh_CN.GB18030"
LANGUAGE="zh_CN.GB18030:zh_CN.GB2312:zh_CN"
SUPPORTED="zh_CN.GB18030:zh_CN:zh:en_US.UTF-8:en_US:en"
SYSFONT="lat0-sun16"

这样中文在SSH,telnet终端就可以正常显示了。 

 

注释

关于Linux 文件系统中路径的理解