Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I like to monitor every php file with their size (and if a new file has been added). On my server are more than 200 000 of em so find takes very long.

This is what I do:

ls -1 --size $(find -P . -type f -name "*.php")

This takes hours.

Is there anything I can do to make this monitoring faster? (Except a faster Server) Or is there any trick that give a file list with file size or crc32 ?

In addition I do not know if this would be faster:

find . -P -type f -name "*.php" -exec ls -1 --size \{} \;
share|improve this question
up vote 2 down vote accepted

The find command has a -printf option that can be used to print the size of the file without having to exec ls

find . -name '*.php' -printf "%p %s\n" 

You can use the sha512sum (or md5sum) to take a list of files and produce hashes for them which can later be used to check their integrity

find . -name '*.php' | while read line; do sha512sum "$line"; done

If you capture the output of the command above to a file you can then use sha512sum to check their integrity

sha512sum -c file
share|improve this answer
Will it be faster with additional filter like "-type f" or -P to not follow symlinks? – Mike Pretzlaw Aug 20 '13 at 19:22
@MikePretzlaw: You should be able to test this yourself using time find ... – Iain Aug 21 '13 at 13:51

Use OSSEC for integrity check.

share|improve this answer
You might go into detail about how you would use OSSEC to do an integrity check. – dunxd Aug 20 '13 at 11:08
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – dunxd Aug 20 '13 at 11:08
This is the <only> optimal answer (If you want to solve the problem). If you'll find something better for this - don't forget to inform whole world about the new super-duper integrity check solution. OSSEC is de-facto standard. And the chance that will become unavailable or sold is smaller than will die. If you want to know how to use it - read documentation, it's easier to setup, no need to waste time for writing anything. This site is about answers, not the documentation. Do you still need to check integrity/checksum of files even if file timestamp wasn't changed? – GioMac Aug 20 '13 at 11:16
There are a whole slew of reasons why link only answers aren't valued here. Respect the feedback that others give you. Read – dunxd Aug 20 '13 at 11:38
Link removed. :) – GioMac Aug 20 '13 at 11:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.