Master Linux File Search: Powerful find Command Techniques

Linux File Search

1. Overview of find

The find command lets you locate files you have forgotten, using criteria such as name, size, modification time, owner, group, permissions, and more.

2. Basic syntax

find [path...] [options] [expression] [action]

3. Common examples

3.1 Find by name

# create files
touch /etc/sysconfig/network-scripts/{ifcfg-eth1,IFCFG-ETH1}
# exact name
find /etc -name "ifcfg-eth1"
# case‑insensitive
find /etc -iname "ifcfg-eth1"
# wildcard
find /etc -name "ifcfg-eth*"
find /etc -iname "ifcfg-eth*"

3.2 Find by size

# larger than 5M
find /etc -size +5M
# exactly 5M
find /etc -size 5M
# smaller than 5M
find /etc -size -5M

3.3 Find by type

# regular files
find /dev -type f
# directories
find /dev -type d
# symbolic links
find /dev -type l
# block devices
find /dev -type b
# character devices
find /dev -type c
# sockets
find /dev -type s
# pipes
find /dev -type p

3.4 Find by time

# create test files (example)
for i in {01..28}; do date -s 201904$i && touch file-$i; done
# files older than 7 days
find ./ -iname "file-*" -mtime +7
# files modified within last 7 days
find ./ -iname "file-*" -mtime -7
# exactly 7 days old
find ./ -iname "file-*" -mtime 7
# keep recent backups, delete older
find /backup/ -iname "*.bak" -mtime +7 -delete
find /backup/ -iname "*.bak" -mtime +90 -delete

3.5 Find by user/group

# by owner
find /home -user jack
# by group
find /home -group admin
# both owner and group
find /home -user jack -group admin
# logical AND
find /home -user jack -a -group admin
# logical OR
find /home -user jack -o -group admin
# files without owner
find /home -nouser
# files without group
find /home -nogroup
# neither owner nor group
find /home -nouser -o -nogroup

3.6 Find by permissions

# exact 644
find . -perm 644 -ls
# any 444 bits
find . -perm -444 -ls
# globally writable
find . -perm -222 -ls
# setuid
find /usr/sbin -perm -4000 -ls
# setgid
find /usr/sbin -perm -2000 -ls
# sticky bit
find /usr/sbin -perm -1000 -ls

4. Search conditions

Name: -name, -iname, -links n, -regex (matches full path)

Depth: -maxdepth n, -mindepth n

Owner/group: -user, -group, -uid, -gid, -nouser, -nogroup

Type: -type f|d|l|s|b|c|p

Empty: -empty

Logical operators: -a (and), -o (or), -not or !

5. Actions

-print (default)

-ls (long listing)

-delete (remove empty directories)

-ok (prompt before executing a command)

-exec (execute a command without prompting)

# print (default)
find /etc -name "ifcfg*" -print
# long list
find /etc -name "ifcfg*" -ls
# delete (only empty dirs)
find /etc -name "ifcfg*" -delete
# copy with prompt
find /etc -name "ifcfg*" -ok cp -rvf {} /tmp \;
# copy and delete
find /etc -name "ifcfg*" -exec cp -rvf {} /tmp \;
find /etc -name "ifcfg*" -exec rm -f {} \;

5.1 Using xargs

When a command does not accept piped input or the argument list is too long, xargs feeds each line to the next command.

# create many files
echo file{1..50000} | xargs touch
# delete a file found by find
find . -name "file.txt" | xargs rm -f
# copy files found by find
find . -name "file.txt" | xargs -I {} cp -rvf {} /var/tmp

5.2 Logical expressions

# not owned by hdfs
find . -not -user hdfs
# owned by hdfs and larger than 300 bytes
find . -type f -a -user hdfs -a -size +300c
# owned by hdfs or .xml files
find . -type f -a \( -user hdfs -o -name '*.xml' \)

5.3 Practice exercises

Find files in /tmp not owned by root and not starting with “f”.

Find files in /var owned by root and group mail.

Find files in /var not owned by root, lp, or gdm.

Find files in /var modified in the last week whose owner is not root nor postfix.

Find regular files in /etc larger than 1 M.

Copy only directories from /etc to /tmp preserving structure.

Copy /etc to /var/tmp with directories 777 and files 666 permissions.

Retain logs in /var/log from the last 7 days, delete others.

Create ten files file1…file10, keep file9, delete the rest.

Explain the meaning of sample find commands (examples omitted for brevity).