Mastering Linux File Search: Powerful find Command Examples and Tips

Find command overview

The find utility recursively searches a directory hierarchy for files and directories that match user‑specified criteria. Its general syntax is: find [path...] [options] [expression] [action] If path is omitted, . (the current directory) is assumed. When no action is given, -print is used by default, printing each matching pathname to standard output.

Common search criteria

Name matching

# Exact name
find /etc -name "ifcfg-eth1"
# Case‑insensitive name
find /etc -iname "ifcfg-eth1"
# Wildcard pattern
find /etc -name "ifcfg-eth*"

Size matching Size is expressed in c (bytes), k (KiB), M (MiB), G (GiB). Prefix + means “greater than”, - means “less than”.

# Larger than 5 MiB
find /etc -size +5M
# Exactly 5 MiB
find /etc -size 5M
# Smaller than 5 MiB
find /etc -size -5M

Type matching

# Regular files
find /dev -type f
# Directories
find /dev -type d
# Symbolic links
find /dev -type l
# Block device
find /dev -type b
# Character device
find /dev -type c
# Socket
find /dev -type s
# FIFO / pipe
find /dev -type p

Time matching Time tests use whole‑day granularity unless the -mmin , -amin or -cmin forms are used.

# Modified more than 7 days ago
find . -mtime +7
# Modified within the last 7 days (including today)
find . -mtime -7
# Modified exactly 7 days ago
find . -mtime 7
# Example: delete backup files older than 7 days
find /backup -name "*.bak" -mtime +7 -delete
# Keep backups for 90 days
find /backup -name "*.bak" -mtime +90 -delete

User and group matching

# Files owned by user jack
find /home -user jack
# Files belonging to group admin
find /home -group admin
# Both user jack and group admin
find /home -user jack -group admin
# Files without a valid owner or group
find /home -nouser -o -nogroup

Permission matching Permission can be expressed as an octal mode or with symbolic prefixes.

# Exact mode 0644
find . -perm 644 -ls
# At least the bits 0444 are set
find . -perm -444 -ls
# Writable by everyone
find . -perm -222 -ls
# Set‑uid files
find /usr/sbin -perm -4000 -ls
# Set‑gid files
find /usr/sbin -perm -2000 -ls
# Sticky‑bit files
find /usr/sbin -perm -1000 -ls

Depth control

# Search at most two directory levels deep
find /etc -maxdepth 2 -type f
# Skip the top level (start at depth 2)
find /etc -mindepth 2 -type f

Path and regex matching

# Exclude a specific subtree
find /etc -path "/etc/ssh" -prune -o -name "*_config" -print
# Full‑path regular expression (POSIX ERE)
find /var -regex ".*/log/.*\.log"

Empty files or directories

# Find empty regular files or directories
find . -empty
# Empty files OR directories
find . -empty -o -type d
# Empty files NOT directories
find . -empty -not -type d

Logical operators

find

supports Boolean operators to combine tests: -a (and) – default conjunction. -o (or). -not or ! (not).

# Files not owned by hdfs
find . -not -user hdfs
# Files owned by hdfs and larger than 300 bytes
find . -type f -user hdfs -size +300c
# Files owned by hdfs OR ending with .xml
find . -type f \( -user hdfs -o -name "*.xml" \)

Action options

After a file matches, find can perform one or more actions. The most frequently used actions are: -print – output the pathname (default). -ls – list the file in ls -l format. -delete – remove the matched file (only empty directories can be removed). -ok – like -exec but prompts the user for confirmation before running the command. -exec – execute an arbitrary command on each match. The command must be terminated with \; or + for batch execution.

# Prompt before deleting files larger than 2 MiB
find . -size +2M -ok rm -rf {} \;
# Delete without prompting
find . -size +2M -exec rm -rf {} \;
# Long‑format listing of matching files
find /etc -name "ifcfg*" -ls
# Remove only empty directories named "tmpdir"
find /tmp -type d -name "tmpdir" -empty -delete

Combining find with xargs

When a downstream command cannot read from standard input or when the argument list would become too long, xargs can batch the results from find and feed them to the next command.

# Create 50 000 empty files efficiently
echo file{1..50000} | xargs touch
# Delete a specific file found by find
find . -name "file.txt" | xargs rm -f
# Copy all files named "file.txt" to /var/tmp preserving the filename
find . -name "file.txt" | xargs -I {} cp -rvf {} /var/tmp

Typical practice tasks

Find files under /tmp that are not owned by root and whose names do not start with f. find /tmp -not -user root -not -name "f*" Find files in /var owned by root and belonging to group mail. find /var -user root -group mail Find files in /var that are not owned by root, lp or gdm.

find /var -not \( -user root -o -user lp -o -user gdm \)

Find files in /var modified in the last 7 days whose owners are neither root nor postfix.

find /var -mtime -7 -not \( -user root -o -user postfix \)

Find regular files in /etc larger than 1 MiB. find /etc -type f -size +1M Copy only the directory hierarchy from /etc to /tmp without copying any files.

cd /etc && find . -type d -exec mkdir -p /tmp/{} \;

Copy /etc to /var/tmp and set all directories to 777 and all regular files to 666.

cp -a /etc /var/tmp && chmod -R 777 /var/tmp/etc && find /var/tmp/etc -type f -exec chmod 666 {} \;

Retain only the last 7 days of logs in /var/log, deleting older ones. find /var/log -type f -mtime +7 -delete Create ten files file1 … file10, keep file9, and delete the rest.

touch file{1..10}
find . -maxdepth 1 -type f -name "file*" -not -name "file9" -delete

Related tools: grep and regular expressions

While not part of find, grep is often used to filter find output or to search file contents.

# Highlight matches
grep --color=auto "pattern" file
# Exclude comment lines
grep -v "^#" file
# Case‑insensitive search
grep -i "error" file
# Show line numbers
grep -n "TODO" file

Common POSIX regular‑expression metacharacters: . – any single character [...] – character class (e.g., [0-9]) [^...] – negated character class * – zero or more repetitions + – one or more repetitions ? – zero or one repetition {n}, {n,}, {,n} – exact, minimum, or maximum repetitions ^ – start of line $ – end of line

These constructs can be combined with find using -regex (full‑path match) or by piping the pathname list to grep for additional pattern filtering.