Mastering the Linux ‘find’ Command: Operators, Actions, and Advanced Tricks

Overview of the find command

find is a powerful utility from the findutils package used to search files and directories based on various criteria. It works by scanning the filesystem from a specified start path, not a database.

Basic syntax

find [path...] [expression_list]

Expression components

Expressions consist of options, tests, and actions. They are evaluated left‑to‑right; the order can affect performance.

Operators

Operators control how multiple expressions are combined. The precedence from highest to lowest is: parentheses, ! / -not, implicit and, -a, -or / -o, comma.

Examples illustrate how -a and -o affect which files are printed.

Options

Options such as -daystart, -depth, -maxdepth, -mindepth, -ignore_readdir_race, and -warn modify the behavior of subsequent tests.

Tests

Tests include file type ( -type), size ( -size), name matching ( -name, -iname, -path, -regex), permissions ( -perm), ownership ( -uid, -gid), timestamps ( -atime, -mtime, -cmin, etc.), and link information ( -samefile, -inum, -links).

Actions

Actions perform operations on matched files, e.g., -print, -print0, -delete, -exec … \;, -ok … \;, -prune, -ls. The default action is -print when no other action is specified.

Advanced usage

Using -depth changes the traversal order so directories are processed after their contents. -prune can exclude directories, often combined with -o and -false to suppress output.

Examples demonstrate searching with depth limits, ignoring specific paths, and combining multiple actions.

Debugging

The -D rates option shows how find evaluates each predicate and can help understand performance characteristics.

Reference: Original article