7 Powerful Ways to Use Linux’s find Command (Including Interview Tricks)

The find command is a must‑know tool for Linux backend developers and system administrators, and it frequently appears in technical interviews.

If your Linux server has a directory named logs , how would you delete log files that haven’t been accessed for over a year?

First, change to the target directory with cd, then run: find . -type f -atime +365 -exec rm -rf {} \; If you are not yet comfortable with the command above, this article introduces seven practical uses of find that will help you master it.

0. Find by name or regular expression

Search for files by exact name: find . -name test.txt Search for all PDF books using a pattern: find ./yang/books -name "*.pdf" Specify the file type to make the search clearer:

find ./yang/books -type f -name "*.pdf"

1. Find different types of files

Search for directories: find . -type d -name "yang*" Search for symbolic links:

find . -type l -name "yang*"

2. Find files by timestamps

atime : last access time.

mtime : last modification time.

ctime : last metadata change time.

Find files whose access time is older than one year: find . -type f -atime +365 Find files modified exactly 5 days ago (without the “+” operator): find . -type f -mtime 5 Find files whose change time is between 5 and 10 days ago:

find . -type f -ctime +5 -ctime -10

3. Find files by size

The -size option lets you specify units: b: 512‑byte blocks (default) c: bytes w: two‑byte words k: kilobytes M: megabytes G: gigabytes

Find files between 10 MB and 1 GB:

find . -type f -size +10M -size -1G

4. Find files by permissions

Search for files with permission 777 (read, write, execute for everyone):

find . -type f -perm 777

5. Find files by ownership

Search for files owned by a specific user, e.g., yang:

find -type f -user yang

6. Execute a command on found files

Use -exec to run actions such as deletion after a match is found: find . -type f -atime +365 -exec rm -rf {} \; The placeholder {} represents each file found, and the command must end with an escaped semicolon \;.

Note: Omitting {} would cause the command to act on all files, not just the matched ones.

Compare the effect of using the placeholder versus not using it:

find . -type f -atime +5 -exec ls {} \;

find . -type f -atime +5 -exec ls \;

In Linux, the backslash \ is the escape character that neutralizes the special meaning of the following character, such as the semicolon.

Summary

After reviewing the seven uses of the find command, the interview question at the beginning becomes straightforward. You can now write the answer confidently and understand each part of the command. find . -type f -atime +365 -exec rm -rf {} \; Thank you for reading. If you found this helpful, feel free to follow me!