1、查找/var目录下属主为root,且属组为mail的所有文件
[root@centos7 root2018-07-31]#find /var -user root -group mail -ls
67252038 0 drwxrwxr-x 2 root mail 262 Jul 31 16:32 /var/spool/mail
68032024 4 -rw------- 1 root mail 1572 Jul 24 15:54 /var/spool/mail/root
2、查找/var目录下不属于root、 lp、 gdm的所有文件
[root@centos7 root2018-07-31]#find /var -not \( -user root -o -user lp -o -user gdm \) -ls
36042205 0 drwxr-xr-x 2 abrt abrt 6 Jul 21 17:35 /var/tmp/abrt
36171749 4 -rw-rw---- 1 tomcat apps 595 Jul 21 17:21 /var/tmp/fstab
67631186 0 drwx------ 2 sssd sssd 6 Apr 13 03:48 /var/lib/sss/db
558573 0 drwxr-xr-x 2 sssd sssd 6 Apr 13 03:48 /var/lib/sss/gpo_cache
34440951 0 drwxr-xr-x 2 sssd sssd 6 Apr 13 03:48 /var/lib/sss/mc
67631187 0 drwxr-xr-x 3 sssd sssd 21 Jul 21 17:23 /var/lib/sss/pipes
101489471 0 drwxr-x--- 2 sssd root 6 Apr 13 03:48 /var/lib/sss/pipes/private
558574 0 drwxr-xr-x 3 sssd sssd 28 Jul 21 17:23 /var/lib/sss/pubconf
558575 0 drwxr-xr-x 2 sssd sssd 6 Apr 13 03:48 /var/lib/sss/pubconf/krb5.include.d
640178 0 drwx------ 2 sssd sssd 6 Apr 13 03:48 /var/lib/sss/keytabs
613030 0 drwx------ 2 rpc rpc 6 Apr 11 13:13 /var/lib/rpcbind
34525180 0 drwxr-xr-x 4 colord colord 67 Jul 21 17:35 /var/lib/colord
3、查找/var目录下最近一周内其内容修改过,同时属主不为root,也不是postfix的文件
[root@centos7 root2018-07-31]#find /var -not \( -user root -o -name postfix \) -a -ctime -7 -ls
36042205 0 drwxr-xr-x 2 abrt abrt 6 Jul 21 17:35 /var/tmp/abrt
36171749 4 -rw-rw---- 1 tomcat apps 595 Jul 21 17:21 /var/tmp/fstab
34525180 0 drwxr-xr-x 4 colord colord 67 Jul 21 17:35 /var/lib/colord
67673985 0 drwxr-xr-x 2 colord colord 6 Aug 6 2017 /var/lib/colord/icc
1784076 8 -rw------- 1 setroubleshoot setroubleshoot 5793 Jul 31 10:16 /var/lib/setroubleshoot/setroubleshoot_database.xml
1784077 0 -rw------- 1 setroubleshoot setroubleshoot 0 Jul 21 17:43 /var/lib/setroubleshoot/email_alert_recipients
67801349 0 drwxr-x--x 8 qemu qemu 85 Jul 21 17:35 /var/lib/libvirt/qemu
36052943 0 drwxr-xr-x 2 qemu qemu 6 Jul 21 17:35 /var/lib/libvirt/qemu/save
68729043 0 drwxr-xr-x 2 qemu qemu 6 Jul 21 17:35 /var/lib/libvirt/qemu/snapshot
100663393 0 drwxr-xr-x 2 qemu qemu 6 Jul 21 17:35 /var/lib/libvirt/qemu/dump
1784068 0 drwxr-xr-x 3 qemu qemu 20 Jul 21 17:35 /var/lib/libvirt/qemu/channel
36052944 0 drwxr-xr-x 2 qemu qemu 6 Jul 21 17:35 /var/lib/libvirt/qemu/channel/target
4、查找当前系统上没有属主或属组,且最近一个周内曾被访问过的文件
[root@centos7 root2018-07-31]#find / \( -nogroup -o -nouser \) -a -atime -7 -ls
50388904 0 -rw-r--r-- 1 root 2015 0 Jul 31 16:02 /data/root2018-07-31/file3.conf
50388905 0 -rw-r--r-- 1 2013 root 0 Jul 31 16:02 /data/root2018-07-31/file4.conf
50388906 0 -rw-r--r-- 1 2013 2015 0 Jul 31 16:02 /data/root2018-07-31/file5.conf
50388909 0 -rw-r--r-- 1 root 2015 0 Jul 31 16:10 /data/root2018-07-31/file3.conf.orig
50388910 0 -rw-r--r-- 1 2013 root 0 Jul 31 16:10 /data/root2018-07-31/file4.conf.orig
50388911 0 -rw-r--r-- 1 2013 2015 0 Jul 31 16:10 /data/root2018-07-31/file5.conf.orig
5、查找/etc目录下大于1M且类型为普通文件的所有文件
[root@centos7 root2018-07-31]#find /etc -type f -size +1M -ls
102195522 3664 -rw------- 1 root root 3750215 Apr 12 02:41 /etc/selinux/targeted/active/policy.kern
68596585 1328 -rw-r--r-- 1 root root 1357405 Apr 12 03:29 /etc/selinux/targeted/contexts/files/file_contexts.bin
35710090 3664 -rw-r--r-- 1 root root 3750215 Apr 12 02:41 /etc/selinux/targeted/policy/policy.31
68637578 7732 -r--r--r-- 1 root root 7916435 Jul 21 17:35 /etc/udev/hwdb.bin
718786 1336 -rw-r--r-- 1 root root 1367395 Apr 11 09:32 /etc/brltty/zh-tw.ctb
6、查找/etc目录下所有用户都没有写权限的文件
[root@centos7 root2018-07-31]#find /etc/ -not -perm /222 -ls
67256073 160 -r--r--r-- 1 root root 160286 Jul 21 17:22 /etc/pki/ca-trust/extracted/java/cacerts
100880088 260 -r--r--r-- 1 root root 264921 Jul 21 17:22 /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
52625 216 -r--r--r-- 1 root root 219895 Jul 21 17:22 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
52626 176 -r--r--r-- 1 root root 179176 Jul 21 17:22 /etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
52627 0 -r--r--r-- 1 root root 0 Jul 21 17:22 /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
7、查找/etc目录下至少有一类用户没有执行权限的文件
[root@centos7 root2018-07-31]#find /etc/ -not -perm -111 -ls |more
67158946 4 -rw-r--r-- 1 root root 595 Jul 21 17:21 /etc/fstab
67158947 0 -rw------- 1 root root 0 Jul 21 17:21 /etc/crypttab
68834012 4 -rw-r--r-- 1 root root 82 Jul 31 10:17 /etc/resolv.conf
67811295 4 -rw-r--r-- 1 root root 1160 Feb 24 2017 /etc/fonts/conf.d/25-no-bitmap-fedora.conf
67811308 4 -rw-r--r-- 1 root root 978 Aug 31 2013 /etc/fonts/conf.d/README
34740059 8 -rw-r--r-- 1 root root 5582 Aug 2 2017 /etc/fonts/fonts.conf
112 0 drwx------ 2 root root 182 Jul 21 17:31 /etc/grub.d
613222 4 -rw-r--r-- 1 root root 483 Oct 21 2017 /etc/grub.d/README
8、查找/etc/init.d目录下,所有用户都有执行权限,且其它用户有写权限的文件
[root@centos7 root2018-07-31]#find /etc/init.d/ -perm -113 -ls
36231423 0 -rwxr-xrwx 1 root root 0 Jul 31 17:26 /etc/init.d/test1.txt