Linux · navigation

locate

find by name, fast

locate looks a name up in a database of every path on the system, rebuilt once a day. That makes it far quicker than find, and also means it does not know about files created since the last update.

find walks the disk now; locate reads yesterday’s list — fast, but possibly out of date.

Searches

An index

not the disk itself

Matches

Anywhere in the path

not just the file name

Refresh

sudo updatedb

otherwise daily

Speed

Near instant

even across the whole system

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashplocate

$ locate sshd_config

1/etc/ssh/sshd_config

/usr/share/man/man5/sshd_config.5.gz

2$ locate -c "*.conf"

412

3$ touch new-report.txt && locate new-report.txt

4$ sudo updatedb && locate new-report.txt

/home/user/new-report.txt

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Every path containing the text

Both the configuration file and its manual page match, because the name appears in each path.

-c counts instead of listing

A pattern with a wildcard must be quoted, or the shell expands it first.

A new file is not found

The file exists, but the index was built before it did. locate prints nothing.

updatedb rebuilds the index

After a refresh the file appears. On most systems a timer runs updatedb once a day.

Switches

A switch changes how the command behaves. These are the ones used day to day; man locate lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-i: Ignore case.
-c: Count the matches instead of listing them.
-n NUM: Stop after NUM results.
-b: Match against the file name only, not the whole path.
-e: List only entries that still exist.
-r REGEX: Match a regular expression.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

locate -i readme

Ignores upper and lower case.

locate -b "\hosts"

Matches the file name exactly, not any path containing the word.

locate -n 10 ".log"

Stops after the first ten results.

locate -e report.txt

Lists only the entries that still exist on disk.

In cybersecurity

The index is a map of the whole filesystem, so who may read it matters.

Results respect permissions

Modern locate shows a user only the paths they could reach themselves, so the index does not leak the names of other users’ files.

A quick way to find secrets

Searching for id_rsa, .env or .kdbx across a machine takes a second. It is worth doing on your own systems first.

Stale by design

A file deleted today may still be listed, and one planted today will not be. Use find when the answer has to be current.

Filed under

Navigation

Read alongside

findWalks a directory tree and prints every entry that passes the tests you give it — by name, age, size, owner or permissions.whichPrints the full path of the program that a command name would run.