7 Essential Find Command Techniques Every Linux User Should Master

Why Learn the find Command?

The find utility is a fundamental tool for Linux backend and system administrators, and it frequently appears in technical interviews. For example, an interview question asks how to delete log files in a logs directory that haven’t been accessed for over a year.

Solution: change to the target directory and run the following command: find . -type f -atime +365 -exec rm -rf {} \; If the above command is unclear, the article proceeds to present seven common find usages that together cover most real‑world scenarios.

1. Find Files by Name or Regular Expression

Search by exact name: find . -name test.txt Search for all PDF books using a pattern: find ./yang/books -name "*.pdf" Specifying -type f makes the intent explicit:

find ./yang/books -type f -name "*.pdf"

2. Find Different Types of Files

Search for directories: find . -type d -name "yang*" Search for symbolic links:

find . -type l -name "yang*"

3. Find Files by Timestamp

Linux tracks three timestamps:

atime : last time the file was read.

mtime : last time the file’s contents were modified.

ctime : last time the file’s metadata (owner, permissions, etc.) changed.

Examples: find . -type f -atime +365 Find files whose mtime is exactly five days ago (no + because that means “greater than”): find . -type f -mtime 5 Search for files with ctime between five and ten days ago:

find . -type f -ctime +5 -ctime -10

4. Find Files by Size

The -size option accepts units:

b: 512‑byte blocks (default)
c: bytes
w: two‑byte words
k: kilobytes
M: megabytes
G: gigabytes

Use + for “greater than” and - for “less than”. Example – find files between 10 MiB and 1 GiB:

find . -type f -size +10M -size -1G

5. Find Files by Permission

Search for files with specific permission bits, e.g., fully open (777): find . -type f -perm 777 This matches files where owner, group, and others all have read, write, and execute rights.

6. Find Files by Ownership

Use -user to filter by file owner:

find . -type f -user yang

7. Execute a Command on Found Files

The -exec action runs a specified command for each matched file. The placeholder {} represents the current file, and the command must end with an escaped semicolon ( \;).

Interview example – delete files not accessed for over a year: find . -type f -atime +365 -exec rm -rf {} \; Demonstration of the placeholder importance: find . -type f -atime +5 -exec ls {} \; Without {}, the command would run on every file in the directory tree, not just the matched ones.

Conclusion

After reviewing these seven find usages, the original interview question becomes straightforward, and readers can confidently write and explain the required command.