0

is it possible to search file in the linux OS that have particular extended attribute as this: ---S--l---

---S--l---  1  root    root          0 Mar  1004:25/opt/csTuner/iba/wys/tuer_lolk

What is S in the permissions:

S - the changes are written synchronously on the disk; this is equivalent to the `sync' mount option applied to a subset of the files.

My goal is to search a files that are written synchronously on the disk.

  • Are you sure about the meaning of S flag? As far as i read linux permissions documentation this is SUID flag – Romeo Ninov Jun 11 '15 at 12:53
  • yes I want to search only this kind of files , – maihabunash Jun 11 '15 at 12:54
7

find can't search for file attributes (this is something else then permissions!) on it's own.

One way:

find /location -type f  -print0 | xargs -0 lsattr | grep '^...S'

On my system, the S is in the third column of the lsattr output, so to make it more flexible, we can use a more complicated regular expression:

find /location -type f  -print0 | xargs -0 lsattr | grep '^[^ S]*S[^ S]* '

where grep '^[^ S]*S[^ S]* ' is supposed to find anything that has an S in the first column.

  • I learnt about the -exec command {} + syntax while writing up my answer. It seems to be equivalent to xargs + pipe chaining – tucuxi Jun 11 '15 at 13:50
  • 2
    @tucuxi: xargs is much more effective if you have a large number of results, as -exec will spawn a new process for every file found, while xargs handles them in bulk. While this doesn't work for every possible command you might want to execute, it can make a dramatic difference in most cases when you get thousands of results. – Sven Jun 11 '15 at 13:53
  • It may be slower, but it should be safer: if the number of results is large (as in over ARG_MAX), then xargs will not be able to pass the full output of find to lsattr, and you will lose results. I have not tested this; going by stackoverflow.com/questions/19354870/… – tucuxi Jun 11 '15 at 16:09
  • 2
    @tucuxi Nice catch, but naturally xargs knows about this issue and spawns multiple processes if the command line would get too long. You still end up with a dramatically reduced number of forked processes. – Sven Jun 11 '15 at 16:12
  • 1
    Be sure to add -print0 to your find command and -0 to your xargs command so that you don't run into issues with files containing spaces in their names. – sa289 Jun 11 '15 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.