The find command is a powerful utility for locating files and directories in a filesystem hierarchy. (GNU findutils 4.9.0, as of late 2025)

Core Syntax

The fundamental structure of find involves a starting directory, followed by expressions that define search criteria and actions.

find . -name "myfile.txt" # Search current directory for a file named "myfile.txt"
find /var/log -type f     # Find all regular files within /var/log
find /home -type d        # Find all directories within /home

Essential Patterns

Locating files based on common attributes like name (case-insensitive), modification time, or size are frequent operations.

# Find files with a specific name, ignoring case
find . -iname "report.pdf" # -iname performs a case-insensitive search

# Find files modified in the last 7 days
find /data -mtime -7       # -mtime N: files modified N*24 hours ago. -N for less than N, +N for more than N.

# Find files larger than 100MB
find /tmp -size +100M      # +100M for >100MB, -100M for <100MB, 100M for exactly 100MB. K, M, G suffixes.

Common Use Cases

Beyond simple searches, find excels at combining criteria and executing actions on the found items.

# Find all .log files in /var/log and delete them (use with extreme caution!)
find /var/log -name "*.log" -type f -delete # -delete is a GNU find extension, efficient but irreversible.

# Find all empty directories in /tmp and remove them
find /tmp -type d -empty -delete # -empty finds empty files or directories.

# Find all Python files in the current directory and change their permissions to 644
find . -name "*.py" -type f -exec chmod 644 {} \; # -exec runs a command for each found item. {} is a placeholder for the filename, \; terminates the command.

# Find files owned by user 'olduser' and change ownership to 'newuser'
find /srv/data -user olduser -exec chown newuser {} + # Using + passes multiple arguments to -exec for efficiency.

Gotchas & Best Practices

Incorrect quoting or handling of special characters can lead to unexpected results. Always consider security and performance.

# CORRECT: Quoting wildcards prevents shell expansion, letting find handle them
find . -name "*.txt" # Shell passes "*.txt" literally to find.

# INCORRECT: Shell expands "*.txt" before find sees it if matching files exist
# find . -name *.txt # If "a.txt" and "b.txt" exist, find sees "find . -name a.txt b.txt"

# Handling filenames with spaces or special characters safely
# Use -print0 with xargs -0 to handle null-terminated strings
find /path/to/files -name "*.bak" -print0 | xargs -0 rm # Safely deletes files even with spaces/newlines.

# Avoid searching root (/) unless necessary; specify a narrower path for performance
find /var/www -name "index.html" # Good: focused search
# find / -name "index.html" # Bad: scans entire filesystem, slow.

Advanced Techniques

For complex scenarios, find offers sophisticated options for logical operations, permissions, and depth control.

# Find files not owned by 'root' AND not modified in the last 30 days
find /var/www \( ! -user root -a ! -mtime -30 \) -type f # \( \) for grouping, -a for AND (default), ! for NOT.

# Find files with execute permission for 'other' (o+x)
find . -perm /o+x -type f # /mode checks if ANY of the bits in mode are set. -perm mode for EXACT match.

# Find files larger than 1GB OR modified within the last day
find /mnt/backup \( -size +1G -o -mtime -1 \) -type f # -o for OR.

# Limit search depth: only current directory (depth 1)
find . -maxdepth 1 -type f -name "*.conf" # -maxdepth N: don't descend more than N levels.
find . -mindepth 2 -type d -name "cache" # -mindepth N: start processing at N levels down.

Quick Reference

  • find [path] [expression]: Basic syntax.
  • -name "pattern": Search by filename (case-sensitive).
  • -iname "pattern": Search by filename (case-insensitive).
  • -type [f|d|l]: Search by type (file, directory, symlink).
  • -mtime [+/-]N: Modified time (N*24h ago). -N (less than N), +N (more than N).
  • -size [+/-]NC: File size (C=b, c, w, k, M, G). +N (larger), -N (smaller).
  • -user USER: Files owned by USER.
  • -group GROUP: Files owned by GROUP.
  • -perm MODE: Files with specific permissions (e.g., 644, /u+x).
  • -empty: Empty files or directories.
  • -delete: Delete found files/directories (GNU extension, use with caution).
  • -exec CMD {} \;: Execute CMD for each result.
  • -exec CMD {} +: Execute CMD with multiple results (more efficient).
  • -print0: Print results null-terminated (for xargs -0).
  • -maxdepth N: Limit search depth.
  • -mindepth N: Start search at depth N.
  • \( expr1 -a expr2 \): Group expressions with AND (default).
  • expr1 -o expr2: OR operator.
  • ! expr: NOT operator.

References

  1. GNU findutils Manual
  2. Oracle: Guide to Linux Find Command Mastery
  3. Baeldung: Guide to the Linux find Command
  4. Red Hat: 10 ways to use the Linux find command

This page is AI-assisted. References official documentation.