find /var -user root -group mail
find /usr -not -user root -a -not -user bin -a -not -user student find /usr -not \( -user root -o -user bin -o -user student \)
find /etc -mtime -7 -a -not \( -user root -o -user student \) -exec stat {} \;
4、查找当前系统上没有属主或属组且最近1天内曾被访问过的文件，并将其属主属组均修改为root；
find / \(-nouser -o -nogroup \) -a -atime -1 -exec chown root.root {} \;
find /etc -size +1M -exec echo {} >> /tmp/etc.largefiles \;
find /etc -not -perm /222 -ls