Skip to content

Finding information

Practical 4.2 finding-information-annex.pdf · PDF

Who has lost a file this month? A photo, a PDF for class, a save game? You probably found it with the search box. Good. But try asking the search box this: every file bigger than 1 MB that nobody has touched in a year. Or: which of 300 invoices says UNPAID.

It cannot. The terminal can, in one line. At Tramuntana Apps the shared folder grew for years with no rules, and today you are the help desk: people will ask, and you will answer with a command.

What you will learn

  • Select many files at once with the wildcards *, ? and [ ]
  • Find files by name, type, size and age with find
  • Search inside files with grep and its options -i, -r, -n, -c, -l, -v
  • Join two commands with a pipe (|) and count results with wc -l
  • Explain why locate is instant — and why it can be wrong
  • Why grep does not find files, and ls *.png does not search the whole tree

Three ways to search a pantry

Remember the kitchen from Unit 1: the disk is the pantry, and every file is a jar. There are three ways to find a jar, and each command of this page is one of them:

Tool In the pantry Looks at
find Reads the labels on the jars Name, type, size, date
grep Opens the jars and looks inside The text inside files
locate Reads last night's inventory list A list of names made in advance

Build the share

The Practical 4.2 sheet comes with a script, tramuntana-share.sh (on Classroom), that builds a messy shared folder of 32 files. Run it in deb-lab and go inside:

student@deb-lab:~$ bash ~/Downloads/tramuntana-share.sh
Ready: 32 files and 14 directories in /home/student/tramuntana-share
student@deb-lab:~$ cd ~/tramuntana-share
student@deb-lab:~/tramuntana-share$ ls
admin  design  dev  tmp

Stay in ~/tramuntana-share for every example below. You can run the script again at any time: it rebuilds the folder from zero.

Wildcards

A wildcard is a character that stands for other characters.

The shell replaces the pattern by the names that match before the command runs. ls never sees the *; it receives the list of names.

Wildcard Stands for Example in the share
* Any number of characters, also none ls design/logos/*.png → the 4 PNG files
? Exactly one character ls design/logos/logo-v?.png → logo-v1.png, logo-v2.png
[1-3] One character from the list or range ls admin/invoices/2026/invoice-2026-00[1-3].txt → 3 files

Wildcards can appear in several places of one path: ls admin/invoices/*/*.txt lists the invoices of every year folder at once (11 files).

Careful: *.png does not search everywhere

A wildcard only looks in the directory you point at. ls *.png in ~/tramuntana-share answers No such file or directory: the PNGs are two levels down. To search a whole tree you need find.

find: read the labels

find has a simple shape: where to look, then what to test.

find   .      -name "*.py"
       where  test

student@deb-lab:~/tramuntana-share$ find . -name "*.py"
./dev/tapes-app/src/main.py
./dev/bus-app/src/stops.py
./dev/bus-app/src/main.py

find walks down the whole tree under the starting point — here ., the current directory. The quotes matter: they stop the shell from replacing * itself, so that find receives the pattern.

Test Meaning In the share
-name "*.jpg" Name matches; capitals count 1 file
-iname "*.jpg" The same, capitals ignored 2 files (Team-Photo.JPG too)
-type d · -type f Only directories · only files 15 · 32
-size +1M Bigger than 1 MiB 2 files
-mtime +365 Last changed more than 365 days ago 1 file
-empty Size zero 1 file

Tests can be chained: find . -type f -size +1M means files and bigger than 1 MiB.

When the screen fills with errors

Search the whole disk for one file:

student@deb-lab:~$ find / -name "os-release"

The screen fills with Permission denied. A normal user may not read every directory, and find complains about each one. Add 2>/dev/null to throw the complaints away and keep the answers:

student@deb-lab:~$ find / -name "os-release" 2>/dev/null
/usr/lib/os-release
/etc/os-release

For now, take 2>/dev/null as a spell; Unit 5 explains exactly what it does. A third line under /run may appear on your machine: that is fine.

“find did not find it, so it does not exist”

Check three things first: the starting point (. is here, not the whole disk), the capitals (try -iname), and the quotes.

grep: open the jars

1973, Bell Labs. Ken Thompson takes the search code out of his text editor ed and makes it a command of its own. In ed, "show every line that matches" was typed g/re/p: global, regular expression, print. The name stayed: grep. It shipped with Version 4 Unix.

grep prints the lines of a file that contain a text.

student@deb-lab:~/tramuntana-share$ grep ERROR dev/bus-app/logs/server.log
2026-11-23 08:14:40 ERROR database timeout
2026-11-23 11:05:59 ERROR database timeout
2026-11-23 16:44:21 ERROR disk almost full
Option Meaning Try
-c Count the matching lines instead of printing them grep -c ERROR dev/bus-app/logs/server.log → 3
-n Show the line number Lines 2, 4 and 6
-v The lines that do not match grep -v INFO dev/bus-app/logs/server.log → 4 lines
-i Ignore capitals grep -ri todo . also finds todo in small letters
-r Search every file under a directory grep -r TODO . → 2 lines
-l Print only the names of the files that match grep -rl "Hotel Ponent" . → 7 files

The number one exam error

grep looks for text inside files. To look for a file by its name, use find. Mixing them up is the most common mistake in this unit.

The pipe: join two commands

Also 1973: Doug McIlroy had asked for years for a way to connect programs "like a garden hose". Thompson built it in one night.

The pipe | sends what the left command prints into the right command as its input.

student@deb-lab:~/tramuntana-share$ grep -rl "Hotel Ponent" . | wc -l
7
student@deb-lab:~/tramuntana-share$ ls /usr/bin | grep zip
gunzip
gzip
  • wc -l counts lines. So find . -type f | wc -l answers "how many files are here?" → 32.
  • | less lets you read a long answer page by page.

On the Spanish keyboard, | is AltGr+1.

flowchart LR
    A["<b>grep -rl 'Hotel Ponent' .</b><br>prints 7 file names"] -->|"the pipe<br>output becomes input"| B["<b>wc -l</b><br>counts the lines"]
    B --> C["<b>7</b><br>on the screen"]

Small tools, each good at one thing, joined with pipes: that is the Unix way.

locate: last night's list

find walks the disk every time: always exact, but slow on a big disk. locate reads a list of every path prepared in advance: instant, but only as fresh as the list. On Debian 13 the package is plocate, and it is not installed by default.

student@deb-lab:~$ sudo apt install plocate
student@deb-lab:~$ sudo updatedb
student@deb-lab:~$ locate invoice-2026-005
/home/student/tramuntana-share/admin/invoices/2026/invoice-2026-005.txt
student@deb-lab:~$ touch ~/brand-new-file.txt
student@deb-lab:~$ locate brand-new-file
student@deb-lab:~$ find ~ -name "brand-new-file*"
/home/student/brand-new-file.txt

locate answers nothing: the file is younger than the list. find sees it. After sudo updatedb refreshes the list, locate finds it too. The system refreshes the list by itself once a day.

In the app Files, open tramuntana-share, press the magnifier (or just start typing) and search logo. It finds the folder logos and every file with logo in its name, in every subfolder. Handy — but compare what each tool is good at:

Tool Good at Weak at
File manager search One file, by a piece of its name, with the mouse Exact questions (size, age), counting, servers with no desktop
find Any question about name, type, size, date; always up to date Slow on a whole disk; does not look inside files
grep Text inside files Useless for images, video, programs
locate Instant search by name on the whole system Stale list; names only

Practical 4.2 · The help desk

Eight tickets arrived this morning from the people of Tramuntana Apps — Marta (dev), Joan (design), Aina (admin), Pau (intern) and Security. Each one is answered with one command (a pipe counts as one) run from ~/tramuntana-share. The tickets are on the Practical 4.2 sheet; you hand in practical-4.2-surname.md on Classroom.

A hidden file is not a protected file

A name that starts with a dot is only hidden from ls. ls -a and find see it. One of the tickets is about exactly that.

Key takeaways

  • Wildcards (*, ?, [1-3]) are expanded by the shell, and only in the directory you point at.
  • find WHERE TEST reads the labels: -name, -iname, -type, -size, -mtime, -empty. Quote the pattern.
  • grep opens the jars: it prints matching lines. -r searches a tree, -i ignores capitals, -l lists files, -c counts, -n numbers, -v inverts.
  • The pipe | turns one command's output into the next one's input; | wc -l counts.
  • locate reads a list made in advance: instant but possibly stale (sudo updatedb). find is always up to date.

Quick check

1. Which command searches for text inside files?
  • ls
  • find
  • grep
  • locate

grep opens the jars: it prints the lines that contain a text. find and locate work with names and labels only.

2. What does ls *.txt list?
  • The names ending in .txt in this directory
  • Every text file on the whole disk
  • The single file called *.txt
  • The files that contain the word txt

The shell expands *.txt to the matching names in the current directory only, before ls runs. Searching a whole tree is the job of find.

3. In find . -iname '*.jpg', what does the i change?
  • It searches inside the files
  • It also searches hidden directories
  • It searches only image files
  • It ignores capital and small letters

-iname is -name without caring about capitals, so Team-Photo.JPG matches too. Without the i, .JPG and .jpg are different.

4. What does ls /usr/bin | wc -l print?
  • The list of /usr/bin, then a file called wc
  • How many names ls printed
  • Nothing: it writes the list into a file
  • The list without the long names

The pipe sends the output of ls into wc -l, which counts lines. One name per line, so the number is how many commands are in /usr/bin.

5. locate does not find a file you created one minute ago. Why?
  • Its list of paths is older than the file
  • It only searches your home directory
  • It cannot see .txt files
  • New files stay hidden for one hour

locate reads a list prepared in advance. A file newer than the list is invisible to it until sudo updatedb runs (the system does it once a day). find would see it at once.

6. Why do you write the pattern in quotes in find . -name '*.py'?
  • So the shell does not expand the * before find gets it
  • So that find also searches inside the files
  • Because find only accepts text between quotes
  • So that hidden files are included in the search

Without quotes, the shell would replace *.py by the matching names in the current directory, and find would receive the wrong pattern. The quotes pass the pattern untouched.

7. find / -name os-release fills the screen with messages. What are they, and what removes them?
  • Permission denied errors, removed by adding 2>/dev/null
  • Permission denied errors, removed by adding -iname
  • Duplicate results, removed by adding | wc -l
  • Hidden files, removed by adding -type f

A normal user may not read every directory, so find complains about each one. 2>/dev/null throws the complaints away and keeps the real answers.

8. Aina asks how many files in the share mention the client Hotel Ponent. Select the two that are true.
  • grep -rl "Hotel Ponent" . | wc -l gives the number in one command
  • The search must look inside the files, so grep is the right tool
  • find . -name "Hotel Ponent" gives the number
  • locate "Hotel Ponent" gives the number

The client's name is inside the invoices, not in their file names, so only grep can see it. -r searches the tree, -l prints each matching file once, and | wc -l counts them: 7.

You can now find anything on a disk. But where do disks come from, and how do you prepare a new one? Next: Partitions: MBR and GPT.