Tip: Finding Files Modified By An Administration Tool

The find command below can be used to locate files that have been modified by some command line or GUI administration tool.  Then having learned which files are affected by some task, for a particular system, you could use the man command to learn the syntax of those files.

This can be helpful in situations where you are unfamiliar with a particular version of Unix or Linux, but a standard command line tool (such as useradd) or GUI tool (such as webmin) exists that can do the task.  Once the affected files are located it is often easier or faster or both to edit the files directly (and then restart the affected services).

A variation of this command can be used to locate a just downloaded file, or in other situations where you must locate a file that has just been changed (in the past 5 minutes).

find / -path '/proc' -prune -path '/sys' -prune \
    -o -path '/var/spool' -prune \
    -o -path '/home' -prune \
    -o -mmin -5 -print  2>/dev/null


Other find Command Tips

When using find to locate files for backups, it often pays to use the "-depth" option, which forces the output to be depth-first—that is, files first and then the directories containing them.  This helps when the directories have restrictive permissions, and restoring the directory first could prevent the files from restoring at all (and would change the time stamp on the directory in any case).

When specifying time with find options such as -mmin (minutes) or -mtime (24 hour periods, starting from now), you can specify a number "n" to mean exactly n, "-n" to mean n or less, and "+n" to mean n or more.

Note that fractional 24-hour periods are truncated!  That means that "find -mtime +1" says to match files modified two or more days ago!

See the find command mini-tutorial and the find(1) man page for more information.