chmod, find, locate, grep & sed

📌 What's covered in this session

• chmod — symbolic and numeric permissions (full coverage)
• User management basics — /etc/passwd, creating users
• find — searching files by name, type, size, owner, and executing actions
• locate vs find — when to use which
• grep — searching inside files, pipes, counting, log analysis
• sed — find & replace, delete lines, insert lines, in-place editing

01 — chmod (Deeper Coverage)

We covered numeric permissions in Session 3. Session 4 adds symbolic permissions — a more readable way to set permissions without calculating numbers.

Symbolic Permission Syntax

chmod  [who][operator][permission]  file

Symbolic chmod Examples

Numeric chmod (Recap + Examples)

r = 4,  w = 2,  x = 1

☁️ DevOps Context — Access Control

In real server environments, permissions are part of Access Control. Think of it like this: a temporary contractor employee joins the project. You give them access to only the files they need — with an expiry. When they leave, you remove access.

• Temporary user → create user, add to group, set password expiry
• Specific access → set file permissions for that group

- Access removed → delete user or remove from group

02 — User Management Basics

/etc/passwd — Reading User Info

cat /etc/passwd

Each line in /etc/passwd has 7 fields separated by ::

username:password:UID:GID:comment:home_dir:shell

# Example:
tejas:x:1001:1001:Tejas:/home/tejas:/bin/bash
root:x:0:0:root:/root:/bin/bash
nginx:x:110:118::/var/lib/nginx:/usr/sbin/nologin

Creating a New User

sudo useradd new_user          # create the user
sudo passwd new_user           # set a password for the user

After running passwd, it prompts you to enter and confirm the new password.

What Ctrl+Z does in Background

# Example:
tail -f /var/log/syslog    # running in foreground
# press Ctrl+Z             → process is suspended
bg                         # resume it in background
fg                         # bring it back to foreground

💡 Useful when you start a long-running command and need your terminal back without killing it.

03 — find

find searches live inside the filesystem — it scans directories in real time. Slower than locate but always accurate and highly flexible.

Basic Syntax

find  [where to search]  [what to search by]  [condition]

Find by Name

Find by Type

Find by Size

Size units: c=bytes, k=kilobytes, M=megabytes, G=gigabytes

Find by Owner

Find + Action (One-liners)

This is where find gets powerful — you can act on results directly.

# How find searches recursively:
find /home -name "prakhar.txt"
# → checks /home
# → checks /home/1/
# → checks /home/2/
# → checks /home/3/
# → checks /home/4/
# → checks /home/5/   → prakhar.txt found → it prints the path

☁️ DevOps Context — Disk Cleanup & Auditing

find is essential for server maintenance:

# Find files larger than 500MB (disk space investigation)
find / -size +500M -type f

# Find and delete all tmp files older than 7 days
find /tmp -type f -mtime +7 -delete

# Find files with dangerous open permissions
find / -type f -perm 777

# Find all .pem key files (security audit)
find /home -name "*.pem"

04 — locate

locate searches a pre-built database of file paths — it does not scan the filesystem live.

find vs locate — Side by Side

The "New File Problem" with locate

touch newfile.txt
locate newfile.txt    # ← won't find it yet — DB is stale

sudo updatedb         # ← update the database manually
locate newfile.txt    # ← now it finds it

The database updates automatically on a schedule (daily cron job), but if you just created a file, run sudo updatedb first.

locate Commands

05 — grep

grep searches inside files for a pattern and prints matching lines. One of the most used commands in DevOps for log analysis.

Basic grep

⚠️ grep -c counts lines, not occurrences. If "has" appears 3 times on one line, it still counts as 1.

grep with Pipe

cat file.txt | grep "has"    # same result as grep "has" file.txt, less efficient

Prefer grep "has" file.txt directly — no need for cat when grep can read the file itself.

grep + wc (Word Count)

wc counts lines, words, or characters. Combined with grep it becomes powerful:

grep for Log Analysis — DevOps Use Case

# Search for errors in syslog
grep "error" /var/log/syslog

# Case insensitive error search
grep -i "error" /var/log/syslog

# Show line numbers alongside errors
grep -n "error" /var/log/syslog

# Count how many error lines exist
grep -c "error" /var/log/syslog

# Live log + filter errors simultaneously
tail -f /var/log/syslog | grep "error"

# Search for errors across multiple log files
grep -r "ERROR" /var/log/nginx/

☁️ DevOps Context — Log Analysis

grep is the fastest way to triage incidents on a Linux server without any extra tools:

# Is nginx throwing 502 errors?
grep "502" /var/log/nginx/access.log

# How many errors in the last deploy?
grep -c "ERROR" /var/log/app/deploy.log

# Find which IP is causing most errors
grep "400" /var/log/nginx/access.log | wc -l

In production, you'd use tools like CloudWatch, Datadog, or ELK stack — but when you SSH into a box at 2am during an incident, grep is what saves you.

06 — sed (Stream Editor)

sed edits text in a stream or file — find and replace, delete lines, insert lines. It doesn't open the file in an editor; it processes it line by line.

sed Syntax

sed  '[line/pattern][command]'  file.txt

Find and Replace

⚠️ Without -i, sed only prints the result to terminal — the original file is NOT changed. Add -i to edit in place.

Delete Lines

Print Specific Lines

Insert and Append Lines

☁️ DevOps Context — Config File Automation

sed -i is used extensively in automation scripts to modify config files without opening an editor:

# Change port in nginx config
sed -i 's/listen 80/listen 8080/g' /etc/nginx/nginx.conf

# Replace DB host in app config during deployment
sed -i 's/localhost/prod-db.internal/g' /opt/app/config.yaml

# Comment out a line in a config file
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# Remove all blank lines from a file
sed -i '/^$/d' config.txt

This is how Ansible shell tasks and deployment scripts modify configs on servers without human intervention.

⚡ Quick Revision

🎯 Interview Points

Q: What is the difference between symbolic and numeric chmod?

Both change file permissions. Numeric (chmod 755) uses octal numbers — you set the complete permission for all three entities at once. Symbolic (chmod u+x) is more readable — you target a specific entity (u/g/o/a) and add or remove a specific permission. Symbolic is useful when you want to change one permission without affecting others.

Q: What is the difference between find and locate?

find scans the live filesystem in real time — always accurate but slower. locate queries a pre-built database — much faster but can be outdated. If you create a file and immediately run locate, it won't appear until sudo updatedb is run. Use find for accuracy, locate for quick path lookups of stable files.

Q: How would you find and delete all .tmp files on a server?

find / -name "*.tmp" -delete. Or safer: first run find / -name "*.tmp" to preview, then add -delete. For temporary files older than N days: find /tmp -type f -mtime +7 -delete.

Q: What does grep -c count — lines or occurrences?

Lines. If a pattern appears 5 times on one line, grep -c counts it as 1. Use grep -o "pattern" file | wc -l if you need to count every individual occurrence.

Q: What is the difference between sed 's/old/new/' and sed 's/old/new/g'?

Without g, sed replaces only the first occurrence on each line. With g (global flag), it replaces every occurrence on every line. Without -i, the original file is not modified — output goes to terminal only. Add -i to edit the file in place.

Q: How would you use grep to investigate an incident on a production server?

grep -i "error" /var/log/app/app.log to find error lines. grep -c "ERROR" /var/log/app/app.log to count them. tail -f /var/log/app/app.log | grep "ERROR" to watch live. grep -n "500" /var/log/nginx/access.log to find the line numbers of 500 errors in nginx.

Q: What does sed -i do and why is it important in automation?

-i tells sed to edit the file in place — the original file is modified permanently. Without it, changes only print to stdout. In DevOps automation scripts and Ansible tasks, sed -i is used to modify config files on servers without opening an editor, enabling fully automated configuration management.

📋 Knowledge Base — Quick Reference

# ── chmod symbolic ─────────────────────────────────────
chmod u+x file.sh             # add execute to owner
chmod g-w file.txt            # remove write from group
chmod o+r file.txt            # add read to others
chmod a+rwx file.txt          # give everyone full access
chmod ugo+rwx file.txt        # same as above

# ── chmod numeric ──────────────────────────────────────
chmod 600 key.pem             # owner rw only (secrets, SSH keys)
chmod 644 file.txt            # owner rw, others r (config files)
chmod 755 script.sh           # owner rwx, others rx (scripts)
chmod 741 file.txt            # owner full, group r, others x

# ── User management basics ─────────────────────────────
cat /etc/passwd               # view user accounts
sudo useradd username         # create new user
sudo passwd username          # set password for user

# ── find ───────────────────────────────────────────────
find /home -name "file.txt"   # find by name (case sensitive)
find /home -iname "file.txt"  # case insensitive
find . -name "*.log"          # find by extension
find /var -type f             # files only
find /var -type d             # directories only
find /home -size +10M         # files > 10MB
find /home -size -1k          # files < 1KB
find /home -user tejas        # files owned by user
find . -name "*.tmp" -delete  # find and delete

# ── locate ─────────────────────────────────────────────
locate file.txt               # fast path lookup
locate -i file.txt            # case insensitive
locate -c passwd              # count matches only
sudo updatedb                 # refresh database

# ── grep ───────────────────────────────────────────────
grep "error" file.txt         # search in file
grep -i "error" file.txt      # case insensitive
grep -n "error" file.txt      # show line numbers
grep -c "error" file.txt      # count matching lines
grep -o "error" file.txt      # print only match, not full line
grep "error" /var/log/syslog  # log error search ⭐
tail -f app.log | grep "ERROR" # live error stream ⭐
grep "error" file.txt | wc -l # count via pipe
grep "error" file.txt | wc -w # word count of matched lines

# ── sed ────────────────────────────────────────────────
sed 's/old/new/' file.txt        # replace first match per line
sed 's/old/new/g' file.txt       # replace all (global)
sed 's/old/new/gI' file.txt      # global, case insensitive
sed -i 's/old/new/g' file.txt    # replace in file permanently ⭐
sed '2s/old/new/g' file.txt      # replace on line 2 only
sed '2,5s/old/new/g' file.txt    # replace in line range
sed '3d' file.txt                # delete line 3
sed '3,5d' file.txt              # delete lines 3-5
sed '/pattern/d' file.txt        # delete lines matching pattern
sed -n '5p' file.txt             # print only line 5
sed -n '2,6p' file.txt           # print line range
sed -n '/pattern/p' file.txt     # print lines matching pattern
sed '2i new line here' file.txt  # insert before line 2
sed '2a new line here' file.txt  # append after line 2
sed '4c replacement line' file.txt # replace entire line 4

💡 Takeaway

Session 4 introduced the tools DevOps engineers use every single day — not just on their own machines but on remote servers at 2am during incidents. grep and sed in particular are the difference between an engineer who can work effectively on any Linux server with zero extra tools, and one who needs a GUI or a full observability stack before they can do anything. These commands are small, composable, and when chained with pipes they become genuinely powerful. The pattern of find → grep → sed — locate the files, search inside them, modify them — is at the core of most server automation tasks.

💬 Learning Linux for DevOps & Cloud. Drop a comment if you have questions or spot something — always open to feedback.