ELS(1) ELS(1)
September 12, 2001
NAME
els - An Enhanced LS look-alike with many additional features
SYNOPSIS
els [-~aAbcCdFgGilLnopQrRstuU1] [+~dhHlqRtvVwz45]
[+M[M]] [+Z=zonename] [+f char] [+GTN format]
[+IEie pattern] [+F fexpr]
[+S char] [+U] [+W] [+X status] files
DESCRIPTION
ELS is an Extensible LS work-alike with many additional features.
Besides supporting most of what /bin/ls does, ELS also allows you to
specify the output format so that any field can be listed in any
order. In addition to supporting the traditional /bin/ls time format,
ELS allows you to list files with *both* time and year regardless of
age, ISO-8601 format (i.e. YYYYMMDD.hhmmss format), age of file (i.e.
the number of days, weeks, months, years, etc. ago the file was
created), European style, etc. ELS allows you to specify absolute
file paths and names so that the output can be further manipulated by
/bin/sort, etc. ELS has a built-in checksumming ability so that files
can be listed along with their checksums. ELS has a "untouch"
facility which will allow you to recover the modification dates
following a "touch".
Other features of ELS are that it allows you to specify the format of
your output using the generic format (+G), it allows you to specify
the time format (+T), and it allows you to specify the filename format
(+N). ELS also allows you to filter your output using wildcards
and/or boolean expressions to generate listings based on each file's
name, date, size, type, mode, permission, ownership, etc.
ELS will even display the dates of files "created" after Jan 19
03:14:08 2038 GMT (assuming that the future standard will treat the
32-bits used by Unix's present-day file system as unsigned).
The reason that ELS was originally written was so that consistent
dates could be generated and saved into a file and that these dates
could be compared at a later date to determine which files had
changed. /bin/ls is unsuited for this purpose as sometimes it lists
the date/time and other times it lists the date/year depending on the
age of the file. ELS always lists the date/year/time regardless of
when the file was created.
LS: STANDARD OPTIONS
-a List all files including . and ..
-A List all files except . and ..
- 1 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
-b List non-graphic characters using octal notation
-c List time of last status change(SYS5, ELS), List time of last
status change and sort(BSD)
-C List multi-columns (unimplemented)
-d List directories as files, but don't list their contents
-F Mark files
-g List GIDs(BSD), long listing omitting UIDs(SYS5), ignored(ELS)
-G Don't list GIDs(ELS)
-i List inode number
-l Long listing using BSD, SYS5, or ELS semantics
-L List actual file rather than symbolic link
-n Long listing using numeric UIDs and GIDs(SYS5, ELS)
-o Long listing omitting GIDs(SYS5, ELS)
-p Mark directories
-Q List non-graphic characters using double-quotes and C-style
notation
-r Reverse the sort
-R Recursively list contents of all directories
-s List size in KBytes(BSD, ELS) or in blocks(SYS5)
-t Sort files according to time
-u List time of last access
-U List unsorted(ELS)
-1 List single column
~ If a tilde precedes any of the above options then that option is
reset, effectively causing it to be canceled.
Enhanced LS: MISCELLANEOUS
+H Give HELP
- 2 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
+l Mimic /bin/ls behavior
+4 Use BSD semantics
+5 Use SYS5 semantics
+d Don't list directories as files, but list their contents (has the
opposite effect of -d)
+h Allow +X to act upon symbolically linked files
+q Quote unusual and troublesome file names (besides doing a more
thorough job than either -b or -Q, this option also quotes
special and non-graphic characters so that the file name can
subsequently be used as an argument for most Unix commands; thus,
the +q option is automatically implied whenever using the +X
option).
+R Recursively list contents of all directories (same as -R)
+t Traverse mount-points during recursive listings
+v Print els version and information
+V Verbose mode
+w Suppress warnings about unreadable files, etc.
+z List volatile file information as zero (volatile file information
is defined as those values that change whenever a file is listed
or those values that aren't preserved after a hierarchy gets
copied or restored; for example, a directory or a symbolic link
changes its access time whenever being listed; a symbolic link
changes its modification time and/or ownership after being
copied; a directory doesn't always preserve its size after being
copied). Also, since volatile file information can change over
time, this option is particularly useful when stamping a
hierarchy (see +S option), or when comparing the listings of two
very similar hierarchies.
~ If a tilde precedes any of the above options then that option is
reset, effectively causing it to be canceled.
+M Macro 1 for listing ISO8601 modification dates of all files
except directories (i.e. els +GmnL +NF +TI +d). For example, to
list the 30 most recently modified source code files in a
- 3 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
hierarchy:
els +MR +I'*.{c,h,cc,hh}' | sort | tail -30
+MM Macro 2 for listing ISO8601 access dates of all files except
directories and symbolic links (i.e. els +Gan +NF +TI +d
+F'T{~l}'). For example, to list the 100 most recently accessed
executable files under the /usr hierarchy:
els +MMR +F'P{+x}' /usr | sort | tail -100
+Z Specify timezone to be used in place of current TZ setting. The
timezone should be in the form of:
All OSes: STDoffset[DST[offset][,rule]]
Additionally, if your host provides zoneinfo then you can also
use names from the appropriate zoneinfo directory:
SunOS/Solaris: /usr/share/lib/zoneinfo
Linux2, FreeBSD: /usr/share/zoneinfo
OSF1: /etc/zoneinfo
For example:
els -la +Z=EST5EDT +TIZ (Available on all OSes)
els -la +Z=US/Eastern +Tv (Available on OSes with zoneinfo)
Enhanced LS: FORMATTING
+fchar
Field separator character, e.g.: els -la +f: +TI
+Goptions
GENERAL format, e.g.: els +G~tp~lusmnL (same as els -l)
i: inode number
t,T: type of file in alpha, symbolic
p,P,M: permission in alpha, numeric, chmod format
A: ACL indicator
l,L: link count, symlink prefaced by ->
u,U: UID in alpha, numeric
g,G: GID in alpha, numeric
s,S: size in bytes, blocks
m,a,c: time modified, accessed, status changed
(uses +T format)
n,N: file name, full file name (uses +N format)
d,f,F: directory name, file name, full file name
- 4 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
C: 16 bit checksum (performed on regular files
only and access times are preserved)
+Toptions
TIME format, e.g.: els -la +T^rD (give age of file in days)
^a: Modifier for absolute time since the epoch
^d: Modifier for delta time from now (i.e.
difference)
^r: Modifier for relative time from now (i.e.
age)
^A: Modifier for alpha dates instead of numeric
^N: Modifier for numeric dates instead of alpha
^G: Modifier for GMT dates instead of local
^L: Modifier for local dates instead of GMT
^M: Modifier for meridian instead of military
time
I: Iso8601 style (same as +T^N~YMD.hms~)
e: els style (default, same as +TM%_DYt)
l: ls style (same as +TM%_DQ)
d: dos style (same as +T^N%_M-D-y^M%_h:~mp~)
w: windows style
(same as +T"^N%_M/D/y^M%_tP'M'")
v: verbose style (same as +TWM%_DTZY)
Y,M,D,W: year, month, day, weekday
h,m,s: hour, minutes, seconds
t,T: time as h:m, h:m:s
Q: time or year depending on age
p,P: ap, AP depending on meridian (meaningful
only with ^M modifier)
y: year modulo 100
Z: zone name
+Noptions
NAME format, e.g.: els -laR +NF
^q: Modifier for quoting unusual file names
(same as +q)
F: Full file name (same as +Nd/f)
d: Directory name
f: File name
l: Symbolic link target
L: Symbolic link target prefaced by ->
+G, +T, +N format controls
\: Output following character verbatim
~: Toggle spacing off/on
%%: Output a single % character
%D: Output directive 'D' using default width
and default padding
%_D: Pad left side of output with blanks
%0D: Pad left side of output with zeros
%-D: Suppress all padding and use minimum width
- 5 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
%0nD: Output a zero padded field 'n' characters
wide
%_nD: Output a blank padded field 'n' characters
wide
%nD: Output a right justified field 'n'
characters wide
%-nD: Output a left justified field 'n'
characters wide
%+nD: Output a field 'n' characters wide
regardless of ~ spacing
E.g.: els +G%10u%-10gN (print the uid right justified and the gid
left justified in two 10 character fields followed by the file
name)
If a string occurs within an inner set of quotes then the string
is output verbatim (except for any directives within the inner
quotes prefaced by a %). Thus, the following are equivalent:
+T"'DATE: '^N%M/D/Y" # M/D/Y in outer quotes (% optional)
+T'"DATE: "^NM/%D/Y' # M/D/Y in outer quotes (% optional)
+T'"DATE: ^N%M/%D/%Y"' # M/D/Y in INNER quotes (% REQUIRED)
Enhanced LS: FILTERING
+Ipattern
Include specified files, e.g.: els -laR +I"*.{c,h,cc,hh}"
+Epattern
Exclude specified files, e.g.: els -laR +E"*.o"
+ipattern
Include specified directories, e.g.: els -laR +i"[a-m]*"
+epattern
Exclude specified directories, e.g.: els -laR +e"SCCS"
+Ffexpr
A filter expression (fexpr) consists of one or more of the
following filter types separated by Boolean operators:
A{...} -- Access Filter
T{...} -- Type Filter
P{...} -- Permission Filter
Q{...} -- Quantity Filter
U{...} -- Unusual Filter
Each filter type consists of one or more terms separated by
Boolean operators. The following lists each term appropriate for
the associated filter type:
- 6 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
Access Filter Terms:
rwx: read, write, execute access
Type Filter Terms:
rd: regular file, directory
cb: char device, block device
plsD: pipe/fifo, symbolic link, socket, Door
S: Special/device file (same as 'b|c')
Permission Filter Terms:
value: octal value <= 07777
ugo: user field, group field, other field
a: all fields (same as 'ugo')
+: test if indicated field(s) contain any
attribute(s)
-: test if indicated field(s) missing any
attribute(s)
=: test if indicated field(s) match attribute(s)
exactly
rwx: read attribute, write attribute, execute
attribute
s: setuid/setgid attribute (applies to u and/or g
fields)
t: sticky attribute (applies to u field)
l: mandatory lock attribute (applies to g field)
Quantity Filter Terms:
iAl: inode, ACL count, link count
ugs: uid, gid, size
mac: time modified, accessed, status changed
== != ~= : equals, not equals, not equals
> >= : greater than, greater than or equals
< <= : less than, less than or equals
value: positive integer to be compared against
YMWD: Years, Months, Weeks, Days
hms: hours, minutes, seconds
Unusual Filter Terms:
t: unusual type
(i.e. !regular & !directory & !symlink)
p: unusual permissions
(i.e. o+w & !+t & !symlink | setuid | setgid |
mandatory_locking)
P: unusual permissions
(i.e. access(o) > access(g) |
access(o) > access(u) |
access(g) > access(u))
A: ACL_count > 1
l: link_count > 1
u: nobody/noaccess UID
(i.e. UID = 60001, 60002, or 65534)
- 7 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
and/or unassigned UID
(i.e. not listed in /etc/passwd)
g: nobody/noaccess GID
(i.e. GID = 60001, 60002, or 65534)
and/or unassigned GID
(i.e. not listed in /etc/group)
mac: modification, access, change time is in the
future
n: name containing unusual or troublesome
characters
N: full pathname containing unusual or
troublesome characters
L: symbolic link pointing to non-existent file
s: sparse file (i.e. partially filled w/data)
G: General tests
(i.e. perform all the above unusual tests)
S: Security related tests
(i.e. !directory & o+w |
directory & o+w & !+t |
setuid | setgid | device_file)
Boolean operators are as follows:
! or ~ -- Boolean NOT (evaluated first)
& or , -- Boolean AND (evaluated second)
| or : -- Boolean OR (evaluated last)
(The reason for allowing multiple symbols for Boolean operations
is that characters such as '!' have special meaning within the
shell and are awkward to use. Also, characters such as ',' can
improve readability when grouping lists of terms, e.g.: 'u+rw,g-
rw,o-rw' is more readable than 'u+rw&g-rw&o-rw'.)
The syntax for each term is based upon its associated filter
type. In all cases, any filter having multiple terms must use
Boolean operators to separate each of its terms. The 'Access'
and 'Type' Filters are the simplest cases when it comes to
syntax, as each of their terms consists of a single letter.
The syntax for each term of the permission filter is very similar
to Unix's chmod command with the following exceptions: if the
left-hand side of a term is blank then it is taken to mean ANY
instead of ALL fields; the symbol '+' is taken to mean HAS
instead of GIVE; the symbol '-' is taken to mean MISSING instead
of TAKE; and the symbol '=' is taken to mean MATCH EXACTLY
instead of SET EXACTLY. Thus, the filter '+FP{+rw}' means ANY
FIELD HAVING READ-WRITE PERMISSION, while the filter '+FP{a=}'
means ALL FIELDS HAVING EXACTLY NO PERMISSIONS.
The syntax for each term of the quantity filter consists of a
single letter and an integer quantity separated by a comparison
operator. Moreover, if the quantity being compared represents
- 8 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
the file modification, access, or status change time (i.e. one of
'mac'), then the integer quantity must be followed by a qualifier
designating Years, Months, Weeks, Days, hours, minutes, or
seconds (i.e. one of 'YMWDhms').
Enhanced LS: UTILITIES
+Soption
STAMP: The output from this option is used for recording the
state of a hierarchy for future comparison to determine any
changes.
C: Stamp a source code hierarchy excluding
*.[ao], *.ln, *~, and SCCS/RCS/CVS files
c: Same as +SC, except nothing is excluded
O: Stamp an operating system hierarchy (no
files are excluded and more detail given)
o: Same as +SO, except checksumming is also
performed
F: Stamp a file hierarchy (same as +SO except
that UIDs and GIDs are excluded)
f: Same as +SF, except checksumming is also
performed
+U UNTOUCH: Create a script which can be saved into a file for later
recovery of modification dates following a /bin/touch.
+W WATCH: Watch the progress of how many files have been examined.
This option is best used in conjunction with +F filtering when
output is sparse and there are numerous files being examined or
when stdout is being redirected to a file. Additionally, +W will
intercept SIGQUIT (i.e. ^) while listing and display the name of
the directory currently being processed.
+X EXECUTE: The output of the +G format will be executed instead of
listed for each file. If +X is followed by a number then els
will terminate whenever the command returns a status of some
other value, otherwise the return status will be ignored.
Additionally, if +V is specified then each command will be echoed
before being executed.
EXAMPLES
Search for the most recently modified *.c, *.h, *.cc, and *.hh files
in a source-code hierarchy:
els +Gmn +TI +NF +I"*.{[ch],cc,hh}" -R | sort | tail
Search for all files greater than 100K bytes that have not been
- 9 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
accessed within the last 180 days and were modified over 365 days ago:
#!/bin/sh
echo " Size Acc Mod File"
echo " ======= ==== ==== ======"
els +f" " +GsamN +T^rD +d -AR | awk -F" " '
{if ($1 >= 100000 && $2 > 180 && $3 > 365)
{printf "%8d%6d%6d %s0, $1, $2, $3, $4};
}'
Create a stamp of a source code hierarchy excluding *.[ao], *.ln, *~,
and SCCS/RCS files:
els +SC -R /home/myfiles/src
Create a stamp of an operating system hierarchy (no files are excluded
and checksum is performed--note that +z is used to zero volatile
data):
els +So +z -R / /usr /var /opt
Create an "untouch" script which can be saved into a file for later
recovery of modification dates following a "touch":
els +U -R * > untouch # Create untouch script file
/bin/touch * # Clobber modification dates
sh untouch # Recover modification dates
Recursively list regular files in /usr/bin that are setuid/setgid
having a UID/GID of less than 10:
els -laR +F'T{r}&P{u+s|g+s}&A{x}&Q{u<10|g<10}' /usr/bin
Recursively list all non-directory files that share a common inode
(i.e. hard-link) in /etc and /dev:
els +GilN +F'Q{l>1}&T{~d}' -R /etc /dev | sort
Recursively list all files modified on or after April 1, 1999
belonging to either the user 'markb' or the group 'projectx':
els -laR +F'Q{m>=19990401}&Q{u=markb|g=projectx}'
Display all files where g or o have more permission than u:
els -laR +F'P{u-w,+w}|P{u-x,+x}|P{u-r,+r}' +NF
Display all files having 'unusual' types or permissions (e.g., world-
writable or sticky files excluding symlinks, setuid/setgid/locking
- 10 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
files excluding symlinks and dirs, device/pipe/socket/door files):
els -laR +NF +F'P{o+w:+t},T{~l}|P{+s,+x:+l},~T{d:l}|~T{r:d:l}'
List all files greater than 100K bytes that have not been accessed
within the last 180 days and were modified over 365 days ago:
els +GsamN +T^rD +d -AR +F'Q{s>=100000 & a>180D & m>365D}'
List all files having troublesome characters in their name:
els -laR -Q +NF +F'U{N}'
Fix the mode of any .c, .h, .cc, .hh file having 'x' mode set in any
of its fields:
els +F'P{+x}' +I'*.{c,h,cc,hh}' +G'"chmod a-x %N"' +XV -RA
Fix the mode of any file having 'x' mode set in the 'u' field but is
missing from the 'g' or 'o' fields:
els +F'P{u+x,g-x|u+x,o-x}' +G'"chmod go+x %N"' +X0 +V -RA
BUGS
ELS does not yet support the -C option for displaying short listings
using multi-columns, but this is not at issue as the primary reason
for using ELS is to take advantage of ELS's ability to display long
listings in a variety of ways.
There are still a few letters of the alphabet that have not yet been
used as options.
EXIT STATUS
0 Normal completion
1 Usage error
2 One or more errors encountered during listing
ENVIRONMENT
PAGER
Name of pager program for displaying help text
ELS_VER_LEVEL
If defined, ELS will mimic deprecated and/or obsolete behavior of
a previous release. E.g. if ELS_VER_LEVEL is set to 1.43, then
ELS will behave similar to release 1.43 (the current ELS release
can be obtained by executing 'els +v'). Please note that future
- 11 - Formatted: October 28, 2025
ELS(1) ELS(1)
September 12, 2001
ELS releases may or may not continue to support the behavior of
an earlier release.
AUTHORS
Mark Baranowski
markb@elen.utah.edu
James M. Gleason
SEE ALSO
ls(1), chdate(1), edate(1)
- 12 - Formatted: October 28, 2025
