Mastering the Linux ‘find’ Command: Operators, Actions, and Advanced Techniques

Introduction

find is a powerful file‑search utility provided by the findutils package; it is often combined with xargs for post‑processing of matched files.

Basic Syntax

find [path...] [expression_list]

Expression Structure

Expressions consist of options, tests, and actions, evaluated from left to right. The order can affect performance because find may reorder tests based on estimated cost.

Operators

Operators control how multiple expressions are combined. Precedence from highest to lowest is: parentheses, ! (negation), -not, implicit and, -a, -and, -o (or), comma.

( expr )          # highest precedence, must be escaped as \( ... \)
! expr            # logical NOT
-not expr         # same as ! expr
expr1 expr2       # implicit AND
expr1 -a expr2    # explicit AND
expr1 -and expr2  # same as -a
expr1 -o expr2    # OR, evaluated only if expr1 is false
expr1 , expr2     # comma, result of expr2 is final

Options (Expression‑Options)

Options always evaluate true and affect subsequent tests. Important options include:

-daystart: calculate time‑based tests from the start of the current day.

-depth: process a directory’s contents before the directory itself.

-maxdepth N: limit recursion depth to N levels.

-mindepth N: apply tests only to entries deeper than N.

-ignore_readdir_race: suppress errors when stat fails.

-warn: suppress warning messages.

Tests (Expression‑Tests)

Tests evaluate file attributes. Common groups:

File type

-type b   # block device
-type c   # character device
-type d   # directory
-type p   # FIFO (named pipe)
-type f   # regular file
-type l   # symbolic link
-type s   # socket

Size and content

-size n[cwbkMG]   # size test; n may be prefixed with + or -

Name and path matching

-name pattern      # match basename
-iname pattern     # case‑insensitive basename
-path pattern      # match whole pathname
-ipath pattern     # case‑insensitive pathname
-regex pattern     # match full path with Emacs regex
-iregex pattern    # case‑insensitive regex

Permissions

-perm mode        # exact permission match
-perm -mode       # at least the bits in mode are set
-perm /mode       # any of the bits in mode are set

Owner and group

-uid n
-user name
-gid n
-group name
-nogroup
-nouser

Timestamp tests

-atime n   # access time in days
-ctime n   # change time in days
-mtime n   # modification time in days
-amin n    # access time in minutes
-cmin n    # change time in minutes
-mmin n    # modification time in minutes
-newer file   # newer than file’s mtime

Link tests

-samefile name   # same inode
-inum n          # inode number
-links n         # number of hard links

Miscellaneous

-true   # always true
-false  # always false

Actions (Expression‑Actions)

Actions perform operations on files that passed previous tests. Important actions:

-print (default): output the full path followed by a newline.

-print0: like -print but terminates each name with a NUL byte.

-delete: remove the file; implicitly adds -depth.

-exec command {} \;: execute a command for each matched file; {} is replaced by the file name.

-ok command {} \;: like -exec but asks for confirmation before execution.

-prune: skip the directory tree that matches the preceding test.

-ls: list file details in ls -dils format.

Action order matters; an action can appear before tests and will be evaluated at that point. For example, placing -print before -type f causes all files to be printed regardless of later tests.

Operator and Action Interaction

The logical operators and default actions determine the final behavior. If no explicit action is present, find appends -print. The precedence of -a over -o means expressions like expr1 -o expr2 -a expr3 are interpreted as expr1 -o (expr2 -a expr3). Debugging with -D rates reveals how find reorders tests for efficiency.

Advanced Usage Examples

Common tasks demonstrate the flexibility of find:

Search only the top‑level of /etc for “*.conf” files: find /etc -maxdepth 1 -type f -name "*.conf" Process directories depth‑first with -depth and list files: find /tmp/tmp -depth Exclude a directory while searching for “*.log” files:

find /tmp -path "/tmp/abc" -prune -o -name "*.log" -print

Combine -prune with -false to suppress the directory name from the output.

Use -maxdepth and -mindepth to limit search depth, or ! -empty to find non‑empty files and directories.

Summary

The find utility offers a flexible, left‑to‑right expression language that can be tuned with options, combined with logical operators, and extended through actions such as -exec or -prune. Understanding operator precedence, default actions, and the impact of options like -depth enables precise and efficient file‑system queries.