How to Use the find Command in Linux

One of the most effective tools for locating files and directories according to a number of criteria is the Linux find command. Learning how to use this tool can save a lot of time and effort, whether you're a system administrator resolving file system problems or a casual Linux user attempting to search for lost files.

You will learn all about find in this tutorial, from its fundamental syntax to its extensive application cases. By the end, you'll be able to use this tool effectively and confidently.

Why Use the find Command?

Copy link

Utilizing a number of characteristics, such as permissions, modification date, size, kind, and name, the find program assists you in locating files and folders. It provides unprecedented control and accuracy in contrast to graphical search tools.

Here’s what makes it special:

• Works recursively within directories.
• Supports complex filtering options.
• Executes actions on found files (like deleting, moving, or editing them).
• Handles large datasets efficiently.

Let’s dive into its practical applications.

Basics of find

Copy link

This is how the general syntax for find looks:

find [starting_point] [expression]

• [starting_point]: The directory where the search starts. Use . to represent the current directory, / for the entire filesystem, or specify a particular path.

• [expression]: Defines what to search for. This can include file names, types, permissions, sizes, and other attributes.

A Simple Example

To find a file named notes.txt in your current directory and its subdirectories, run:

find . -name "notes.txt"

Let’s break this down:

• .: Search starts within the current directory.

• -name: Search based on file name.

• "notes.txt": The target file.

Searching by File Name

Copy link

You can search for files using -name or -iname (case-insensitive).

• Case-Sensitive Search

find /home -name "project.txt"

• Case-Insensitive Search

find /home -iname "project.txt"

• Partial Matches

Use wildcards (*) to find files containing specific text:

find /var/log -name "*.log"

This command locates all .log files in /var/log.

Exploring File Types

Copy link

Linux treats everything as a file, but find lets you filter by type using the -type option:

• Regular Files: -type f
• Directories: -type d
• Symbolic Links: -type l
• Sockets: -type s
• Character Devices: -type c
• Block Devices: -type b

Example: Finding Directories Only

find /etc -type d

Filtering by Time

Copy link

Your search can be narrowed down based on when files were accessed, modified, or created.

• Modified Time (-mtime)

Identify which files were changed in the past 7 days:

find . -mtime -7

Files modified exactly 7 days ago:

find . -mtime 7

• Access Time (-atime)

Locate files accessed in the last 3 days:

find /tmp -atime -3

• Change Time (-ctime) 

Use -ctime to find files whose metadata changed, such as permissions or ownership.

find /var/www -ctime 5

Searching by Size

Copy link

The -size flag allows you to search for files of a specific size.

Units of size:

• k: Kilobytes
• M: Megabytes
• G: Gigabytes

• Exact Size

Find files that are 1 MB:

find /var -size 1M

• Greater or Smaller Files

Larger than 100MB:

find /home -size +100M

Smaller than 500KB:

find /data -size -500k

Combining Conditions

Copy link

Utilize logical operators to combine several search criteria:

• AND (-a): Default behavior.

• OR (-o): Specify explicitly.

• NOT (!): Exclude matches.

To find .txt files larger than 1 MB:

find . -name "*.txt" -a -size +1M

To exclude directories named backup:

find /data -type d ! -name "backup"

Taking Action on Located Files

Copy link

Find can do more than just search; it can also apply operations on the found files. To do this, use the -exec or -ok flags.

• Delete Files

find /tmp -name "*.tmp" -exec rm {} \;

• {}: Placeholder for the located file.

• \;: End of the -exec command.

For safer deletion, prompt for confirmation:

find /tmp -name "*.tmp" -ok rm {} \;

• Move or Copy Files

find /home/user/docs -name "*.pdf" -exec mv {} /home/user/backup/ \;

• Run Custom Commands 

You can run virtually any command on the located files. For instance, compress all .log files:

find /var/log -name "*.log" -exec gzip {} \;

Working with Permissions

Copy link

Use these options to search files by ownership or permissions:

• File Permissions (-perm)

Find files with exact permissions:

find /etc -perm 644

Locate files writable by others:

find /data -perm -o=w

• User and Group Ownership

Files owned by root:

find / -user root

Files owned by group admin:

find / -group admin

Avoiding Errors and Boosting Efficiency

Copy link

• Ignoring Errors

If you lack permissions for certain directories, suppress errors using 2>/dev/null:

find / -name "config.yaml" 2>/dev/null

• Optimizing Searches

To improve performance, limit your search depth using -maxdepth:

find . -maxdepth 2 -name "*.sh"

Use -mindepth to start searching from a certain depth.

find . -mindepth 2 -name "*.txt"

Real-World Use Cases

Copy link

• Housekeeping Logs

find /var/log -name "*.log" -mtime +30 -exec rm {} \;

• Archiving Old Files

Move files unused for over a year to an archive directory:

find /projects -atime +365 -exec mv {} /archive/ \;

• Security Audits

Find world-writable files, which may pose security risks:

find / -perm -o=w

• Backup Automation

Copy all .docx files to a backup directory:

find /documents -name "*.docx" -exec cp {} /backup/ \;

Combining find with Logical Operators

Copy link

Logical operators such as -and, -or, and -not can be used to build more complex search expressions. These operators allow to search for files that fulfill various conditions concurrently.

• Find Files with Specific Extensions

find . \( -name "*.jpg" -or -name "*.png" \)

This searches for files that are either .jpg or .png.

• Exclude Certain Files

find /var/log -type f -not -name "*.gz"

This excludes .gz files from the search results.

• Find Files Modified in the Last Week and Owned by a User

find . -mtime -7 -and -user alice

Using find for Security Audits

Copy link

The find command can be a valuable tool for identifying security vulnerabilities, such as world-writable files or files with unsafe permissions.

• Find World-Writable Files

find / -type f -perm /o=w

This identifies files that are writable by any user.

• Locate SUID/SGID Files

find / -perm /4000 -o -perm /2000

This finds files with the SUID or SGID bit set, which can sometimes pose security risks.

Managing Large Data Sets

Copy link

When managing large file systems, searching efficiently is key. Here are a few tips for optimizing find usage:

• Limit Results with -print and head

find /data -type f -name "*.csv" -print | head -n 10

This command quickly previews the first 10 results.

• Search in Parallel

Use find with xargs for parallel processing:

find /large_dir -type f -print0 | xargs -0 -P4 -I{} echo "Processing {}"

This processes files in parallel using four threads (-P4).

Managing Special File Name Characters

Copy link

Files with spaces, newlines, or other special characters in their names can cause issues when using find. To avoid problems, use -print0 with xargs or other commands.

• Delete Files Containing Special Characters Safely

find . -name "*.bak" -print0 | xargs -0 rm

Conclusion

Copy link

One useful utility that can revolutionize your Linux system interaction is the find command. It gives you the ability to handle files with accuracy and originality, from basic searches to intricate workflows. You will soon be able to utilize this program to its fullest extent if you practice the instructions provided here and try out various settings. No matter your level of experience as an administrator, find is a crucial tool for your Linux toolbox.

And if you’re looking for a reliable, high-performance, and budget-friendly solution for your workflows, Hostman has you covered with Linux VPS Hosting options, including Debian VPS, Ubuntu VPS, and VPS CentOS.