Master Linux File Search: Powerful find Command Techniques & Examples

Linux File Search with find Command

1. Overview of find

Why file search is needed: you often forget a file’s location and need to locate it.

find can search by name, size, modification time, owner, group, permissions, and more; it is an essential Linux tool.

2. Basic Syntax

find [path...] [options] [expression] [action]

path – directories to search (default current directory)

expression – criteria such as -name, -size, -type, -user, -mtime, etc.

action – what to do with matched files (default -print)

3. Common Options and Examples

3.1 Name search

# create files
touch /etc/sysconfig/network-scripts/{ifcfg-eth1,IFCFG-ETH1}
# find by exact name
find /etc -name "ifcfg-eth1"
# case‑insensitive
find /etc -iname "ifcfg-eth1"
# wildcard
find /etc -name "ifcfg-eth*"
find /etc -iname "ifcfg-eth*"

3.2 Size search

# larger than 5M
find /etc -size +5M
# exactly 5M
find /etc -size 5M
# smaller than 5M
find /etc -size -5M

3.3 Type search

# regular file
find /dev -type f
# directory
find /dev -type d
# symbolic link
find /dev -type l
# block device
find /dev -type b
# character device
find /dev -type c
# socket
find /dev -type s
# pipe
find /dev -type p

3.4 Time search

# create test files
for i in {01..28}; do date -s 201904$i && touch file-$i; done
# files older than 7 days
find ./ -name "file-*" -mtime +7
# files modified within last 7 days
find ./ -name "file-*" -mtime -7
# exactly 7 days old
find ./ -name "file-*" -mtime 7

3.5 Owner / group search

# by user
find /home -user jack
# by group
find /home -group admin
# user and group
find /home -user jack -group admin
# no owner
find /home -nouser
# no group
find /home -nogroup

3.6 Permission search

# exact 644
find . -perm 644 -ls
# any 444 bits
find . -perm -444 -ls
# globally writable
find . -perm -222 -ls
# setuid
find /usr/sbin -perm -4000 -ls
# setgid
find /usr/sbin -perm -2000 -ls
# sticky bit
find /usr/sbin -perm -1000 -ls

3.7 Actions

Default action is -print. Other useful actions: -ls – long‑format listing -delete – remove matched files (only empty directories) -ok – prompt before executing a command -exec – run a command on each match

# delete 2M files with confirmation
find -size 2M -ok rm -rf {} \;
# delete 2M files without prompt
find -size 2M -exec rm -rf {} \;
# print matches
find /etc -name "ifcfg*" -print

3.8 Using xargs

# create many files
echo file{1..50000} | xargs touch
# delete files found by find
find . -name "file.txt" | xargs rm -f
# copy files found by find
find . -name "file.txt" | xargs -I {} cp -rvf {} /var/tmp

3.9 Logical operators

Combine criteria with -a (and), -o (or) and -not (or !).

# not owned by hdfs
find . -not -user hdfs
# owned by hdfs and larger than 300 bytes
find . -type f -a -user hdfs -a -size +300c
# owned by hdfs or ending with .xml
find . -type f -a \( -user hdfs -o -name '*.xml' \)

4. Practice Exercises

Find files in /tmp not owned by root and not starting with “f”.

Find files in /var owned by root and group mail.

Find files in /var not owned by root, lp, or gdm.

Find files in /var modified in the last week whose owner is neither root nor postfix.

Find files in /etc larger than 1 MiB and of type regular file.

Copy only directories from /etc to /tmp preserving the directory structure.

Copy /etc to /var/tmp and set directory permissions to 777 and file permissions to 666.

Keep only the last 7 days of logs in /var/log, delete the rest.

Create ten files, keep file9, delete the others.

Explain the meaning of a series of find commands (examples listed).