Master Linux ‘find’: Essential Syntax, Tests, Actions, and Operators Explained

Preface

The find command is a frequently used Linux utility; mastering it can make many tasks much more efficient. This article addresses common questions about its format, the meaning of + and - signs, differences between -exec ... \; and -exec ... +, and why -exec must end with \;.

Command Basics

The basic find syntax consists of three parts: the find keyword, one or more search paths, and an expression. Examples: find /etc -name 'passwd' Multiple paths can be specified: find /etc /var /usr -name 'passwd' The expression determines which files are matched and can include actions such as deletion.

The expression types are:

Tests – conditions based on file attributes.

Actions – operations performed on matched files.

Global options – constraints like maximum depth.

Positional options – location‑based constraints.

Tests

Tests examine file attributes such as time, owner, permissions, and name. Numeric prefixes +n, -n, and n mean greater than, less than, or equal to n respectively.

Time‑based tests

Examples:

# Find files modified exactly 7 days ago

find / -mtime 7 -ls

-mtime +7

finds files modified more than 7 days ago; -mtime -7 finds files modified within the last 7 days. Similar options exist for change time ( -ctime), access time ( -atime), and minute‑level variants ( -mmin, -amin, -cmin).

Files can also be compared to another file’s timestamps, e.g.: find /etc -anewer /etc/passwd Other time‑related tests include -newerXY, where X and Y specify which timestamps to compare (a = access, c = change, m = modify).

User‑based tests

-uid n      # uid equals n

-user name  # username equals name

-gid n      # gid equals n

-group name # group name equals name

-nogroup   # no group

-nouser    # no owner

Permission tests

-executable   # executable files

-readable     # readable files

-writable     # writable files

-perm mode    # exact permission mode (numeric or symbolic)

Prefix / or - makes the test less strict, matching files that contain at least the specified bits.

Path‑based tests

-name pattern   # filename matches pattern

-iname pattern  # case‑insensitive name

-lname pattern  # symbolic link name

-path pattern   # full path matches pattern

-regex pattern  # regular‑expression match

Other tests

-empty          # empty file or directory

-size n[ckbwMG] # file size with unit

-inum n         # inode number

-links n        # number of hard links

-samefile name # hard‑linked to name

-type c        # file type (b, c, d, p, f, l, s)

Actions

Actions perform operations on matched files. Common actions include: -ls – long listing (default display) -fls file – write listing to

file

-print

– print file name (default) -print0 – null‑terminated output -fprint file – write output to

file

-delete

– delete matched files -printf format – custom formatted output -prune – do not descend into matching directories -quit – stop after first match

Executing commands

The -exec and -execdir actions run external commands. The syntax with a semicolon is: -exec command {} \; Using {} inserts the current file name. A trailing backslash escapes the semicolon from the shell. The + form groups all matches into a single command invocation:

-exec command {} +

-execdir

runs the command from the directory containing the matched file, which is safer against race conditions.

For safety, -ok and -okdir behave like -exec but ask for confirmation before each execution.

Operators

Operators combine multiple expressions and define their logical relationship: -a or -and – logical AND (default) -o or -or – logical OR ! or -not – logical NOT

Parentheses ( ... ) – group expressions and control precedence

Example of combined expressions:

find / \( -name 'passwd' -a -type f \) -o \( -name 'shadow' -a -type f \)

Additional Useful Options

Other frequently used options include: -depth – process contents before the directory itself -maxdepth n – limit search depth -mindepth n – set minimum search depth

For a complete list, consult man find. This guide aims to help readers gain a deep understanding of the find command.