// Locate. Filter. Execute.
KNOW WHERE YOUR FILES ARE.
On a Linux system with millions of files, find is your GPS. It locates anything instantly by name, type, size, date, or any criteria you specify.
SEARCH LIKE A PRO.
Whether finding a config file buried deep in /etc or locating large log files eating up disk space—find handles it all with ease.
Click a lesson to begin
What is find? Basic syntax and usage.
BeginnerFind files using -name and -iname.
BeginnerFind files, directories, symlinks, and more.
BeginnerFind files by size with -size option.
BeginnerFind by modification, access, change time.
BeginnerFind files by permission modes.
IntermediateFind by user and group ownership.
IntermediateUse -and, -or, -not to combine conditions.
Intermediate-exec and -ok to run commands on results.
IntermediateSafely delete files matching criteria.
AdvancedUse find in bash for automation.
AdvancedChain find results with xargs.
AdvancedThe find command searches for files and directories in a directory hierarchy based on criteria you specify. It's one of the most powerful and essential commands on Linux.
find [path] [options] [expression]
# Find all files in current directory find . # Find all files in /home find /home # Find specific file by name find / -name "myfile.txt"
1. What does the find command do?
# Find file named exactly "error.log" find /var/log -name "error.log" # Find all .conf files find /etc -name "*.conf" # Find file regardless of case find /home -iname "readme.txt"
* Matches any characters ? Matches any single character # Find files starting with "backup" find / -name "backup*" # Find files ending with ".log" find /var/log -name "*.log" # Find files with exactly 4 character name find /home -name "????.txt"
1. Which option makes find case-insensitive?
f Regular file d Directory l Symbolic link c Character device b Block device p Named pipe (FIFO) s Socket
# Find all directories find /home -type d # Find all regular files find /var/log -type f # Find all symbolic links find /usr/local -type l # Find all block devices find /dev -type b
1. What type denotes a directory?
c Bytes k Kilobytes (1024 bytes) M Megabytes G Gigabytes b 512-byte blocks (default)
# Files exactly 100MB find / -size 100M # Files larger than 1GB find / -size +1G # Files smaller than 10KB find /tmp -size -10k # Files between 100MB and 500MB find /var -size +100M -size -500M
# Find files larger than 100MB in /var
find /var -type f -size +100M -exec ls -lh {} \;
1. How do you find files larger than 1GB?
-mtime Modified time (content change) -atime Access time (last read) -ctime Change time (metadata/sermissions change) -mmin Modified time in minutes -amin Access time in minutes -cmin Change time in minutes
# Files modified in last 24 hours find /var/log -mtime -1 # Files accessed more than 30 days ago find /home -atime +30 # Files modified in last hour find /var/log -mmin -60 # Files changed in last 7 days find /etc -ctime -7
# Find recently modified config files find /etc -name "*.conf" -mtime -7 # Find all files accessed today find /home -atime 0
1. Which time option checks when file content was modified?
-perm Exact permission match -perm - At least these permissions (AND) -perm / Any of these permissions (OR)
# Files with exactly 644 permissions find /home -perm 644 # Files readable by everyone find /home -perm -444 # Files writable by owner find /home -perm -200 # Files with execute permission find /home -perm -111 # SUID files (security risk!) find / -perm -4000 2>/dev/null
1. How do you find SUID files?
-user USERNAME Files owned by USERNAME -group GROUPNAME Files owned by GROUPNAME -nouser Files with no valid owner -nogroup Files with no valid group
# Files owned by root find / -user root # Files owned by www-data find /var/www -user www-data # Files owned by a specific group find /home -group developers # Files with no valid owner (orphaned) find /home -nouser
# Large files owned by root find / -user root -size +100M
1. How do you find files with no valid owner?
-a AND (default between conditions) -o OR -not or ! NOT
# Files owned by www-data AND .log files find /var/www -user www-data -name "*.log" # .conf OR .ini files find /etc -name "*.conf" -o -name "*.ini" # Files NOT modified in last 30 days find /var/log -not -mtime -30 # Files that are 0 bytes OR .tmp files find /tmp -size 0 -o -name "*.tmp"
# Must escape parenthesis \( \) find /var \( -name "*.log" -o -name "*.tmp" \) -mtime +7
1. What operator combines conditions with OR?
# Execute command on each result
find /path -name "*.log" -exec rm {} \;
# {} is replaced with the filename
# \; terminates the command
# List details of all .conf files
find /etc -name "*.conf" -exec ls -lh {} \;
# Change permissions on results
find /var/www -name "*.php" -exec chmod 644 {} \;
# Copy all .txt files to backup
find /home -name "*.txt" -exec cp {} /backup/ \;
# Like -exec but asks for confirmation
find / -name "core" -ok rm {} \;
# Answer y for yes, n for no
1. What does {} represent in -exec?
# First test with -ok (asks confirmation)
find /tmp -name "*.tmp" -ok rm {} \;
# Then use -delete directly
find /tmp -name "*.tmp" -delete
# Delete core dumps older than 7 days find / -name "core.*" -mtime +7 -delete # Delete empty files find /tmp -type f -empty -delete # Delete .pyc files find . -name "*.pyc" -delete # Delete files owned by deleted user find /home -nouser -delete
Always test with ls first before deleting:
# Test first (list files) find /tmp -name "*.tmp" -ls # Then delete when confirmed find /tmp -name "*.tmp" -delete
1. What should you do before deleting files?
#!/bin/bash # Clean old log files LOGDIR="/var/log/myapp" DAYS=30 # Find and delete old .log files find "$LOGDIR" -name "*.log" -mtime +$DAYS -type f -delete echo "Cleaned log files older than $DAYS days"
#!/bin/bash
# Backup all .sql files
find /var/www -name "*.sql" -type f | while read -r file; do
backup_file="${file}.bak.$(date +%Y%m%d)"
cp "$file" "$backup_file"
echo "Backed up: $file"
done
#!/bin/bash # Find largest directories du -sh /var/* 2>/dev/null | sort -rh | head -10
1. What does the -delete option do?
xargs takes input from stdin and converts it into arguments for a command. Combined with find, it efficiently processes many files.
# Instead of -exec which runs per file:
find . -name "*.txt" -exec rm {} \;
# xargs can batch process:
find . -name "*.txt" | xargs rm
# More efficient (fewer process spawns) # Better handling of filenames with spaces # Can control number of args per command # Limit to 10 files per command find / -name "*.log" | xargs -n 10 rm # Use null delimiter for safe filenames find . -name "*.txt" -print0 | xargs -0 rm # Show commands without executing find . -name "*.txt" | xargs -p rm
You've mastered find! You now understand:
find is the most powerful file search tool on Linux. It can locate any file based on any criteria you can imagine.
Master find and you'll never waste time hunting for files again. Combined with -exec and xargs, it becomes an automation powerhouse.
Locate. Filter. Execute. Automate.