7 Powerful Ways to Master the Linux find Command (Including Interview Tips)

The find command is an essential tool for Linux developers and system administrators, frequently appearing in technical interviews.

If your Linux server has a logs directory, how would you delete log files that haven’t been accessed for over a year?

One solution is to change to the target directory and run:

find . -type f -atime +365 -exec rm -rf {} \;

1. Find files by name or regular expression

Search for a specific file name: find . -name test.txt Search for all PDF books using a pattern: find ./yang/books -name "*.pdf" Specifying -type f limits the search to regular files:

find ./yang/books -type f -name "*.pdf"

2. Find different types of files

Search for directories: find . -type d -name "yang*" Search for symbolic links:

find . -type l -name "yang*"

3. Find files by timestamps

Linux tracks three timestamps:

atime : last access time.

mtime : last modification time of file contents.

ctime : last change time of metadata (owner, permissions, etc.).

Find files whose access time is older than one year: find . -type f -atime +365 Find files modified exactly five days ago (no + sign): find . -type f -mtime 5 Find files whose change time is between 5 and 10 days ago:

find . -type f -ctime +5 -ctime -10

4. Find files by size

The -size option accepts units: b: 512‑byte blocks (default) c: bytes w: two‑byte words k: kilobytes M: megabytes G: gigabytes

Use + for “greater than” and - for “less than”. Example: find files between 10 MiB and 1 GiB:

find . -type f -size +10M -size -1G

5. Find files by permissions

Search for files with specific permission bits: find . -type f -perm 777 This returns files that are readable, writable, and executable by everyone.

6. Find files by ownership

Search for files owned by a particular user:

find . -type f -user yang

7. Execute a command on each found file

The -exec action lets you run a command for every matched file. For the interview problem, the command is: find . -type f -atime +365 -exec rm -rf {} \; Here {} is a placeholder for the current file, and the command must end with an escaped semicolon ( \;).

Note: The placeholder {} is crucial; without it, the command would act on all files, not just the ones found.

Compare two commands to see the difference:

find . -type f -atime +5 -exec ls {} \;

find . -type f -atime +5 -exec ls \;

The first lists only the files older than five days; the second lists every file because the placeholder is missing.

Summary

After learning these seven uses of find, the interview question becomes straightforward. The final answer is the command shown above, which deletes files in logs that have not been accessed for more than a year.