Master Linux File Search: Using which, whereis, locate, and find

The which command displays the absolute path of an executable found in the directories listed in the PATH environment variable.

[root@localhost ~]# which bash
/usr/bin/bash

[root@localhost ~]# which ls
alias ls='ls --color=auto'
/usr/bin/ls

The whereis utility locates the binary, source, and manual page files for a given program name. Useful options include -b (binary only), -m (manual only), and -s (source only).

[root@localhost ~]# whereis -b ifconfig
ifconfig: /usr/sbin/ifconfig

[root@localhost ~]# whereis -m ifconfig
ifconfig: /usr/share/man/man8/ifconfig.8.gz

The locate command searches a pre‑built database ( /var/lib/mlocatedb) that contains paths of all files on the system. The database is updated daily, but you can refresh it manually with updatedb, which respects /etc/updatedb.conf.

# yum install -y mlocate
# updatedb
# locate /etc/passwd
/etc/passwd
/etc/passwd-

The find command is the most versatile file‑search tool. Its general syntax is find [path] [expression]. Common expressions include:

-name – match file names (supports wildcards *, ?, []).

-size – filter by file size (units are blocks of 512 bytes; e.g., -size -10k for files smaller than 10 KB).

-user – match files owned by a specific user.

-perm – match files with specific permission bits (e.g., -perm 0644).

-type – filter by file type: f (regular file), d (directory), l (symlink).

-time – filter by timestamps: -mtime (modification), -ctime (status change), -atime (access). Use -mmin, -cmin, -amin for minute granularity.

-inum – match files with a specific i‑node number.

-a / -o – logical AND / OR.

-exec – execute a command on each matched file; the placeholder {} represents the file name, and the expression must end with \;.

Examples:

# Find all ".log" files under /var and list details
find /var/ -name "*.log" -exec ls -l {} \;

# Find files in /etc modified in the last 120 minutes
find /etc/ -mmin -120

# Find files larger than 1 M but smaller than 10 k in /etc
find /etc/ -size +1k -a -size -10k

# Delete all files owned by user "lyshark"
find / -user lyshark -exec rm -r {} \;

When using -exec, remember the required spaces and the escaped semicolon; otherwise the command will not be parsed correctly. The -ok variant works like -exec but prompts for confirmation before executing each command.