Master Linux File Searches: Powerful find Command Examples and Tips

Linux administrators often need to locate files that meet specific criteria—such as size over 200 MiB, recent modifications, or executable permissions—and the find command provides a flexible solution for all these tasks.

Case Practice

(1) Search by file name

Find all Go source files in the current directory: $ find . -name "*.go" Find txt files in /etc that start with an uppercase letter: $ find /etc -name "[A-Z]*.txt" -print Exclude files whose name starts with out and list the remaining txt files:

$ find . -name "out*" -prune -o -name "*.txt" -print

Skip the git subdirectory when searching for txt files:

$ find . -path "./git" -prune -o -name "*.txt" -print

Show all hard links of a file using ls -i and then search by inode number:

$ ls -i 1.txt
138956 1.txt
$ find . -inum 138956

Case‑insensitive name search uses -iname.

(2) Search by file type

Find symbolic links: $ find . -type l -print Find regular files ending with .log: $ find . -type f -name "*.log" (3) Search by file size

Files smaller than 64 kB: $ find . -size -64k -print Files larger than 200 MiB: $ find . -size +200M -type f -print (4) Search by time

Modified within the last 2 days: $ find . -mtime -2 -type f -print Modified more than 2 days ago: $ find . -mtime +2 -type f -print Accessed within the last day: $ find . -atime -1 -type f -print Metadata changed within the last day: $ find . -ctime -1 -type f -print Newer than a reference file chopin.txt (or older using ! -newer):

$ find . -newer "chopin.txt" -type f -print
$ find . ! -newer "chopin.txt" -type f -print

(5) Search by permissions

Files with exact mode 644: $ find . -type f -perm 644 Files in /etc where at least one user has write permission: $ find /etc -type f -perm /222 Files where all users have execute permission (mode 111): $ find /etc -perm -111 -ls (6) Combine conditions

Ordinary files owned by user chopin (the -a operator can be omitted): $ find . -type f -user chopin -print Files larger than 2 MiB or modified more than 2 days ago: $ find . -size +2M -o -mtime +2 -print Non‑regular files:

$ find . -not -type f
$ find . ! -type f

Non‑empty files: $ find . ! -empty (7) Actions after a match -print (default, can be omitted).

$ find . -name "*.log" -print

-ls

prints a long ls style listing.

$ find . -name "*.txt" -ls

-delete

removes the matched files.

$ find . -size +100M -delete

-exec

passes each match to an arbitrary command, e.g. ls -lh.

$ find . -name "*.txt" -exec ls -lh {} \;

-ok

works like -exec but asks for confirmation before each execution.

(8) Classic example – deleting a file with a garbled name

When a filename contains unreadable characters, locate its inode number first and then delete it by inode:

$ ls -i
138957 a.txt 138959 T.txt 132395 �?.txt
$ find . -inum 132395 -exec rm {} \;

Summary

The find command is one of the most powerful Linux utilities. Mastering the common options shown above—search by name, type, size, time, permissions, combined expressions, and actions—covers the majority of everyday administrative needs.

Typical syntax: find path -option [-exec ...] Key options include: -name / -iname – exact or case‑insensitive name match. -type – file type (f, d, l, s, p, b, c). -size – size tests (e.g., -size +5M). -atime, -mtime, -ctime, -newer – time‑based tests. -perm – permission tests (exact, / for any, - for all).

Logical operators -a, -o, -not / ! to combine tests.

Actions: -print, -ls, -delete, -exec, -ok.

For very large searches, consider the indexed tool locate, which is faster but may miss newly created files until the database is updated with updatedb.

When using find on production systems, avoid scanning the entire filesystem ( /) unless necessary, as it can consume significant CPU resources and affect running services.