Master Linux File Searches: Powerful find Command Techniques

Why use the find command?

On Linux, find is unrivaled for locating files or directories. It is simple to use yet offers a wealth of options that let you fine‑tune searches, making it indispensable for system administrators and developers.

Table of contents

Find directories

Find hidden files

Find files by size

Search from a file list

Exclude patterns from a list

Control recursion depth

Find empty (zero‑length) files or directories

Locate the largest files or directories

Find setuid files

Find sgid files

List files denied permission

Find recently modified items

Sort results by modification time

Locate vs. find

CPU and I/O impact of

find

Find directories

Search only for directories with a specific name:

find /path/to/search -type d -name "name-of-dir"

Find hidden files

Hidden files and directories start with a dot. Use a pattern that matches a leading dot:

find /path/to/search -name ".*"

Find files by size

Use -size to filter by exact size, larger than, or smaller than a given value.

Files larger than 10 MiB: find /path/to/search -size +10M Files smaller than 10 MiB: find /path/to/search -size -10M Files exactly 10 MiB: find /path/to/search -size 10M Files between 100 MiB and 1 GiB:

find /path/to/search -size +100M -size -1G

Search from a file list

If you have a list of patterns in filelist.txt, combine find with grep -f:

find /path/to/search | grep -f filelist.txt

Exclude patterns from a list

Use grep -v to omit any matches from the same list:

find /path/to/search | grep -v -f filelist.txt

Control recursion depth

The -maxdepth option limits how many sub‑directory levels find will descend.

Search only the current directory: find . -maxdepth 0 -name "myfile.txt" Search the current directory and one level deeper:

find . -maxdepth 1 -name "myfile.txt"

Find empty (zero‑length) files or directories

Empty files: find /path/to/search -type f -empty Empty directories: find /path/to/search -type d -empty Delete empty files automatically:

find /path/to/search -type f -empty -delete

Locate the largest files or directories

Print size and path, sort numerically, and show the biggest entry:

find /path/to/search -type f -printf "%s\t%p
" | sort -n | tail -1

Show the top 5 largest files:

find /path/to/search -type f -printf "%s\t%p
" | sort -n | tail -5

Show the 5 smallest files:

find /path/to/search -type f -printf "%s\t%p
" | sort -n | head -5

For directories, replace -type f with -type d and adjust tail -1 as needed.

Find setuid files

Setuid files allow execution with the file owner’s privileges (often root). Search for them with: find /path/to/search -user root -perm /4000 Show details of each match:

find /path/to/search -user root -perm /4000 -exec ls -l {} \;

Or search for any setuid file regardless of owner:

find /path/to/search -perm /4000

Find sgid files

Replace the permission mask with /2000 for SGID files: find /path/to/search -perm /2000 Both setuid and sgid set (6000):

find /path/to/search -perm /6000

List files denied permission

find

needs read permission on directories it traverses. If it lacks permission, it prints an error but continues.

Suppress permission‑denied messages by redirecting stderr and filtering them out:

find / -name "myfile.txt" 2>1 | grep -v "Permission denied"

Find recently modified items

Use -mtime to filter by modification time (in days).

Modified in the last 30 days: find /path/to/search -type f -mtime -30 Modified more than 30 days ago: find /path/to/search -type f -mtime +30 Exactly 30 days old: find /path/to/search -type f -mtime 30 Show details for each match:

find /path/to/search -type f -mtime -30 -exec ls -l {} \;

Sort results by modification time

Print the modification timestamp and path, then pipe to sort: find /path/to/search -printf "%T+\t%p\n" | sort Reverse order (newest first):

find /path/to/search -printf "%T+\t%p
" | sort -r

Locate vs. find

locate

searches a pre‑built database of all file names, making it faster but less flexible than find. The database is updated with updatedb (usually once a day). Use locate for quick, broad searches and find when you need precise criteria.

CPU and I/O impact of find

Scanning many directories can consume significant CPU and I/O. To lower its priority, combine nice and ionice:

nice -n 19 find /path/to/search -name "myfile.txt"

ionice -c3 -n7 find /path/to/search -name "myfile.txt"

nice -n 19 ionice -c3 -n7 find /path/to/search -name "myfile.txt"

Monitor find 's CPU usage with top if needed.

With these techniques, you can harness the full power of find while keeping system impact under control.