当前位置：首页 > news >正文

文件与内容查找，压缩与解压

news 2025/9/26 12:04:35

一、文件查找

1758807680546

[yt@localhost ~]$ cd /etc

1758808145641

查找包含ip开头 的文件
[root@localhost etc]# find ./ -name "ip"
[root@localhost etc]# find ./ -name "ip*"
./ipa
./ppp/ip-down
./ppp/ip-down.ipv6to4
./ppp/ip-up
./ppp/ip-up.ipv6to4
./ppp/ipv6-down
./ppp/ipv6-up
./iproute2
./selinux/targeted/active/modules/100/ipa
./selinux/targeted/active/modules/100/ipmievd
./selinux/targeted/active/modules/100/ipsec
./selinux/targeted/active/modules/100/iptables
./bash_completion.d/ipa
./bash_completion.d/iprutils
./sysconfig/ip6tables-config
./sysconfig/iptables-config
./libibverbs.d/ipathverbs.driver
./firewalld/ipsets
./ipsec.conf
./ipsec.d
./ipsec.secrets
./brltty/ipa.ctb

严格查找对应的文件，绝对匹配
[root@localhost etc]# find ./ -name "passwd"
./passwd
./pam.d/passwd

查找h或f开头的文件
[root@localhost etc]# find ./ -name "[h|f]*"
./fstab
./fonts
./fonts/fonts.conf
./X11/fontpath.d
./X11/fontpath.d/fonts-default
./libreport/forbidden_words.conf
./profile.d/flatpak.sh
./prelink.conf.d/fipscheck.conf
./rc.d/init.d/functions
./java/font.properties
./filesystems

查找以a到Z结尾的文件
[root@localhost log]# find /var/log -name "*[a-Z]"
/var/log
/var/log/tallylog
/var/log/grubby_prune_debug
/var/log/lastlog
/var/log/wtmp
/var/log/btmp
/var/log/samba
/var/log/samba/old
/var/log/sssd
/var/log/ppp
/var/log/glusterfs
/var/log/audit
/var/log/audit/audit.log
/var/log/chrony
/var/log/pluto
/var/log/pluto/peer
/var/log/libvirt
/var/log/libvirt/qemu
/var/log/ntpstats
/var/log/speech-dispatcher
/var/log/cups
/var/log/cups/access_log
/var/log/cups/error_log
/var/log/cups/page_log
/var/log/gdm
/var/log/gdm/:0.log
/var/log/gdm/:0-greeter.log
/var/log/messages
/var/log/secure
/var/log/maillog
/var/log/spooler
/var/log/tuned
/var/log/tuned/tuned.log

查找不是a-Z的文件。^表示非的意思
[root@localhost log]# find ./ -name "[^a-Z]*"
./
./gdm/:0.log.4
./gdm/:0.log.3
./gdm/:0.log.2
./gdm/:0.log.1
./gdm/:0.log
./gdm/:0-greeter.log.4
./gdm/:0-greeter.log.3
./gdm/:0-greeter.log.2
./gdm/:0-greeter.log.1
./gdm/:0-greeter.log

特别的符号，需要用到转义符\
[root@localhost log]# find ./ -name "\\"

1758809629655

1758810046617

按照权限查找
[root@localhost etc]# find ./ -perm 777
./mtab
./fonts/conf.d/65-0-lohit-kannada.conf
./fonts/conf.d/59-liberation-serif.conf
./fonts/conf.d/57-paratype-pt-sans.conf
./fonts/conf.d/10-scale-bitmap-fonts.conf
./fonts/conf.d/20-unhint-small-dejavu-serif.conf验证第一个文件的权限
[root@localhost etc]# ll ./mtab
lrwxrwxrwx. 1 root root 17 Sep 19 07:09 ./mtab -> /proc/self/mounts

查找最近1天更新过的文件
[root@localhost etc]# find /var/log -mtime -1
/var/log
/var/log/lastlog
/var/log/wtmp
/var/log/btmp
/var/log/audit/audit.log
/var/log/cups/access_log
/var/log/gdm/:0.log
/var/log/messages
/var/log/secure
/var/log/sa
/var/log/sa/sa25
/var/log/boot.log
/var/log/vmware-vmsvc.log
/var/log/cron
/var/log/Xorg.0.log
/var/log/boot.log-20250925

查找7天前更新过的文件
[root@localhost etc]# find /var/log -mtime +7
/var/log/samba/old
/var/log/sssd
/var/log/ppp
/var/log/glusterfs
/var/log/chrony
/var/log/pluto/peer
/var/log/libvirt/qemu
/var/log/ntpstats
/var/log/speech-dispatcher
/var/log/qemu-ga

查看软连接文件
[root@localhost etc]# find /etc/ -type l
/etc/mtab
/etc/fonts/conf.d/65-0-lohit-kannada.conf
/etc/fonts/conf.d/59-liberation-serif.conf
/etc/fonts/conf.d/57-paratype-pt-sans.conf
/etc/fonts/conf.d/10-scale-bitmap-fonts.conf
/etc/fonts/conf.d/20-unhint-small-dejavu-serif.conf验证是否是链接文件，查看权限表示的10个字母中的第1个字母是l
[root@localhost etc]# ll /etc/mtab
lrwxrwxrwx. 1 root root 17 Sep 19 07:09 /etc/mtab -> /proc/self/mounts

[root@localhost etc]# uname  -a
Linux localhost.localdomain 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost etc]# cat /etc/centos-release
CentOS Linux release 7.5.1804 (Core)

按照文件大小查找，查找187字节的文件
[root@localhost etc]# find ./ -size 187c
./libreport
./yum.repos.d
./pam.d/sudo-i
./sane.d/ma1509.conf

查找的同时，列出文件的详细信息
[root@localhost etc]# find ./ -size 187c -exec ls -l {} \;
total 28
-rw-------. 1 root root 4586 Apr 27  2018 cert-api.access.redhat.com.pem
drwxr-xr-x. 2 root root   98 Sep 19 07:10 events
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 events.d
-rw-r--r--. 1 root root  212 Apr 27  2018 forbidden_words.conf
-rw-r--r--. 1 root root  115 Apr 27  2018 ignored_words.conf
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 plugins
-rw-r--r--. 1 root root 2295 Apr 27  2018 report_event.conf
drwxr-xr-x. 2 root root  112 Sep 19 07:12 workflows.d
total 32
-rw-r--r--. 1 root root 1664 Apr 28  2018 CentOS-Base.repo
-rw-r--r--. 1 root root 1309 Apr 28  2018 CentOS-CR.repo
-rw-r--r--. 1 root root  649 Apr 28  2018 CentOS-Debuginfo.repo
-rw-r--r--. 1 root root  314 Apr 28  2018 CentOS-fasttrack.repo
-rw-r--r--. 1 root root  630 Apr 28  2018 CentOS-Media.repo
-rw-r--r--. 1 root root 1331 Apr 28  2018 CentOS-Sources.repo
-rw-r--r--. 1 root root 4768 Apr 28  2018 CentOS-Vault.repo
-rw-r--r--. 1 root root 187 Apr 10  2018 ./pam.d/sudo-i
-rw-r--r--. 1 root root 187 Apr 10  2018 ./sane.d/ma1509.conf[root@localhost etc]# find ./ -size 187c | xargs ls -l
-rw-r--r--. 1 root root 187 Apr 10  2018 ./pam.d/sudo-i
-rw-r--r--. 1 root root 187 Apr 10  2018 ./sane.d/ma1509.conf./libreport:
total 28
-rw-------. 1 root root 4586 Apr 27  2018 cert-api.access.redhat.com.pem
drwxr-xr-x. 2 root root   98 Sep 19 07:10 events
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 events.d
-rw-r--r--. 1 root root  212 Apr 27  2018 forbidden_words.conf
-rw-r--r--. 1 root root  115 Apr 27  2018 ignored_words.conf
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 plugins
-rw-r--r--. 1 root root 2295 Apr 27  2018 report_event.conf
drwxr-xr-x. 2 root root  112 Sep 19 07:12 workflows.d./yum.repos.d:
total 32
-rw-r--r--. 1 root root 1664 Apr 28  2018 CentOS-Base.repo
-rw-r--r--. 1 root root 1309 Apr 28  2018 CentOS-CR.repo
-rw-r--r--. 1 root root  649 Apr 28  2018 CentOS-Debuginfo.repo
-rw-r--r--. 1 root root  314 Apr 28  2018 CentOS-fasttrack.repo
-rw-r--r--. 1 root root  630 Apr 28  2018 CentOS-Media.repo
-rw-r--r--. 1 root root 1331 Apr 28  2018 CentOS-Sources.repo
-rw-r--r--. 1 root root 4768 Apr 28  2018 CentOS-Vault.repo

Linux命令中的|表示管道，前面命令的输出作为后面命令的输入

[root@localhost etc]# find ./ -size 187c | xargs ls -l | grep events
drwxr-xr-x. 2 root root   98 Sep 19 07:10 events
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 events.d

将输出的内容进行保存
[root@localhost etc]# find ./ -size 187c | xargs ls -l | grep events > ./result
[root@localhost etc]# cat result
drwxr-xr-x. 2 root root   98 Sep 19 07:10 events
drwxr-xr-x. 2 root root 4096 Sep 19 07:12 events.d

查找到前13行的内容
[root@localhost etc]# head -n 13 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin查找第7行到第13行的内容
[root@localhost etc]# head -n 13 /etc/passwd | tail -n 7
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin

二、内容查找

1758811536566

查找出文件中的包含root的内容
[root@localhost etc]# grep root ./passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin[root@localhost etc]# cat ./passwd 
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
sssd:x:998:996:User for sssd:/:/sbin/nologin
libstoragemgmt:x:997:994:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:996:993:User for colord:/var/lib/colord:/sbin/nologin
gluster:x:995:992:GlusterFS daemons:/var/run/gluster:/sbin/nologin
saslauth:x:994:76:Saslauthd user:/run/saslauthd:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
setroubleshoot:x:993:990::/var/lib/setroubleshoot:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:992:987::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
unbound:x:991:986:Unbound DNS resolver:/etc/unbound:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:990:984:User for geoclue:/var/lib/geoclue:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:989:983::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
yt:x:1000:1000:yt:/home/yt:/bin/bash
jack:x:1001:1001::/home/jack:/bin/bash
james:x:1002:1001::/home/james:/bin/bash
rose:x:1003:1002::/home/rose:/bin/bash
mary:x:1004:1002::/home/mary:/bin/bash
zhangsan:x:1005:1003::/home/zhangsan:/bin/bash[root@localhost etc]# cat ./passwd | grep root
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin

[root@localhost etc]# ls /var/log | grep log
boot.log
boot.log-20250925
lastlog
maillog
tallylog
vmware-vgauthsvc.log.0
vmware-vmsvc.log
wpa_supplicant.log
Xorg.0.log
Xorg.0.log.old
yum.log

1758812213811

统计个数
[root@localhost etc]# ls /var/log | grep log
boot.log
boot.log-20250925
lastlog
maillog
tallylog
vmware-vgauthsvc.log.0
vmware-vmsvc.log
wpa_supplicant.log
Xorg.0.log
Xorg.0.log.old
yum.log[root@localhost etc]# ls /var/log | grep log | wc -l
11

增加行号表示显示出来，方便vi的时候直接定位到对应的行号
[root@localhost etc]# grep -n root passwd
1:root:x:0:0:root:/root:/bin/bash
10:operator:x:11:0:operator:/root:/sbin/nologin

1758812385499

1758812609060

1758812588336

排除包含root的内容
[root@localhost etc]# grep -v root passwd
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

查找以bash结尾的内容
[root@localhost etc]# grep "bash$" ./passwd
root:x:0:0:root:/root:/bin/bash
yt:x:1000:1000:yt:/home/yt:/bin/bash
jack:x:1001:1001::/home/jack:/bin/bash
james:x:1002:1001::/home/james:/bin/bash
rose:x:1003:1002::/home/rose:/bin/bash
mary:x:1004:1002::/home/mary:/bin/bash
zhangsan:x:1005:1003::/home/zhangsan:/bin/bash

以s开头，且login结尾
[root@localhost etc]# grep "^s*.login$" ./passwd

三、文件归档压缩

1758813338683

归档：把一堆文件放到一起，不压缩。

[root@localhost opt]# cd /var/log
[root@localhost log]# ls
anaconda           btmp    dmesg      glusterfs           maillog   ppp      samba              sssd      vmware-vgauthsvc.log.0  Xorg.0.log
audit              chrony  dmesg.old  grubby_prune_debug  messages  qemu-ga  secure             tallylog  vmware-vmsvc.log        Xorg.0.log.old
boot.log           cron    firewalld  lastlog             ntpstats  rhsm     speech-dispatcher  tuned     wpa_supplicant.log      yum.log
boot.log-20250925  cups    gdm        libvirt             pluto     sa       spooler            vmware    wtmp
[root@localhost log]# du -sh /var/log
4.9M	/var/log

[root@localhost opt]# cd /var/log
[root@localhost log]# ls
anaconda           btmp    dmesg      glusterfs           maillog   ppp      samba              sssd      vmware-vgauthsvc.log.0  Xorg.0.log
audit              chrony  dmesg.old  grubby_prune_debug  messages  qemu-ga  secure             tallylog  vmware-vmsvc.log        Xorg.0.log.old
boot.log           cron    firewalld  lastlog             ntpstats  rhsm     speech-dispatcher  tuned     wpa_supplicant.log      yum.log
boot.log-20250925  cups    gdm        libvirt             pluto     sa       spooler            vmware    wtmp
[root@localhost log]# du -sh /var/log
4.9M	/var/log
[root@localhost log]# cp -r ./* /opt/varlog/
cp: target ‘/opt/varlog/’ is not a directory
[root@localhost log]# mkdir /opt/varlog
[root@localhost log]# cp -r ./* /opt/varlog/
[root@localhost log]# cd /opt/varlog/
[root@localhost varlog]# pwd
/opt/varlog

将当前目录下的文件进行归档
[root@localhost varlog]# tar -cvf varlog.var ./*
./anaconda/
./anaconda/anaconda.log
./anaconda/syslog
./anaconda/X.log
./anaconda/program.log
./anaconda/packaging.log
./anaconda/storage.log
./anaconda/ifcfg.log
./anaconda/ks-script-AVqRE0.log
./anaconda/ks-script-O0_SHV.log
./anaconda/ks-script-xffAYM.log
./anaconda/journal.log
./audit/
./audit/audit.log
./boot.log
./boot.log-20250925
./btmp
./chrony/
./cron
./cups/
./cups/access_log
./cups/error_log
./cups/page_log
./dmesg
./dmesg.old
./firewalld
./gdm/
./gdm/:0.log.4
./gdm/:0.log.3
./gdm/:0.log.2
./gdm/:0.log.1
./gdm/:0.log
./gdm/:0-greeter.log.4
./gdm/:0-greeter.log.3
./gdm/:0-greeter.log.2
./gdm/:0-greeter.log.1
./gdm/:0-greeter.log
./glusterfs/
./grubby_prune_debug
./lastlog
./libvirt/
./libvirt/qemu/
./maillog
./messages
./ntpstats/
./pluto/
./pluto/peer/
./ppp/
./qemu-ga/
./rhsm/
./sa/
./sa/sa19
./sa/sa25
./samba/
./samba/old/
./secure
./speech-dispatcher/
./spooler
./sssd/
./tallylog
./tuned/
./tuned/tuned.log
./vmware/
./vmware/rc.local.log
./vmware-vgauthsvc.log.0
./vmware-vmsvc.log
./wpa_supplicant.log
./wtmp
./Xorg.0.log
./Xorg.0.log.old
./yum.log

1758813730551

压缩文件
[root@localhost varlog]# gzip varlog.var 
[root@localhost varlog]# ls
anaconda           btmp    dmesg      glusterfs           maillog   ppp      samba              sssd           vmware                  wtmp
audit              chrony  dmesg.old  grubby_prune_debug  messages  qemu-ga  secure             tallylog       vmware-vgauthsvc.log.0  Xorg.0.log
boot.log           cron    firewalld  lastlog             ntpstats  rhsm     speech-dispatcher  tuned          vmware-vmsvc.log        Xorg.0.log.old
boot.log-20250925  cups    gdm        libvirt             pluto     sa       spooler            varlog.var.gz  wpa_supplicant.log      yum.log
[root@localhost varlog]#

1758813828469

压缩的比例很大
[root@localhost varlog]# du -sh ./
5.4M	./
[root@localhost varlog]# du -sh ./varlog*
572K	./varlog.var.gz
[root@localhost varlog]#

1758813927529

注意后缀是.var.gz，属于Linux系统

将当前文件夹所有文件进行压缩
[root@localhost varlog]# tar -zcvf allzip.tar.gz ./*

1758814130733

解压缩，到当前目录
[root@localhost varlog]# mv allzip.tar.gz /opt
[root@localhost varlog]# cd ../
[root@localhost opt]# ls
allzip.tar.gz  rh  varlog
[root@localhost opt]# tar -zxvf allzip.tar.gz

1758814296024