Master Linux File Search: locate and find Commands Explained

Common File Search Tools

locate : A fast alternative to find -name that queries the pre‑built database /var/lib/locatedb. The database is created automatically and updated daily; run updatedb manually if you need the very latest file list.

find : Traverses the specified directories in real time, matching files against attributes, glob patterns, or regular expressions. It works directly on the filesystem without a database.

Parameters and Usage

locate

Usage format:

locate [OPTION]… PATTERN…

-i

: ignore case.

Example – filter files under /etc that start with sh:

# locate /etc/sh
/etc/shadow
/etc/shadow-
/etc/shells

find

General syntax:

find [OPTIONS] [search_path] [search_conditions] [actions]

Search Path

If omitted, the current directory is used. Any absolute or relative path can be supplied, but using the root directory / is discouraged for performance reasons.

Search Conditions

-name "pattern"

: match file names using globbing (e.g., *, ?, [a‑z]). -iname "pattern": case‑insensitive name match. -user USER: files owned by USER. -group GROUP: files belonging to GROUP. -uid UID / -gid GID: match by numeric user or group ID. -nouser / -nogroup: files without an owner or group (useful after account deletions). -type TYPE: file type, where f =regular file, d =directory, l =symlink, b =block device, c =character device, p =named pipe, s =socket. -size [+|-]#UNIT: size filter; units are k (kilobytes), M (megabytes), G (gigabytes). Example: -size +1M (larger than 1 MiB), -size -500k (smaller than 500 kB). -atime / -mtime / -ctime [+|-]#: access, modification, or change time in days. Prefix + means older than, - means newer than. -amin / -mmin / -cmin [+|-]#: same as above but measured in minutes. -perm [+|-]MODE: permission filter. -perm -MODE requires all bits, -perm +MODE matches any of the bits, -perm MODE requires an exact match.

Combining Conditions

-a

(AND): all listed conditions must be true. -o (OR): any condition may be true. -not or !: negate a condition.

Example – find files in /etc that are not owned by root or hadoop and were modified within the last 7 days: # find /etc -not ( -user root -o -user hadoop ) -a -mtime -7 Example – locate files without an owner or group that were accessed within the last 3 days:

# find / -nouser -nogroup -atime -3

Actions

-print

: default action, prints the path. -ls: lists detailed file attributes (similar to ls -l). -exec COMMAND {} \;: executes COMMAND on each matched file. -ok COMMAND {} \;: like -exec but prompts for confirmation before each execution.

Example – list matching yum logs and then display long format details:

# find /tmp -iname "*yum*" -type f -ls
# find /tmp -iname "*yum*" -type f -exec ls -l {} \;

Example – append each matched file name to /tmp/test.file using -exec and -ok:

# find /tmp -iname "*yum*" -type f -exec echo {} >>/tmp/test.file \;
# find /tmp -iname "*yum*" -type f -ok echo {} >>/tmp/test.file \;