Mastering the Linux find Command: Syntax, Tests, Actions, and Advanced Options

Introduction

The find command is a versatile tool for locating files and directories on Linux systems. Understanding its syntax and expression types enables powerful one‑liner searches and batch operations.

Command Syntax

A typical find invocation consists of three parts: the command itself, one or more start paths, and an expression that defines what to match. find /etc -name 'passwd' Multiple start paths can be supplied:

find /etc /var /usr -name 'passwd'

Expression Types

Expressions are divided into four categories:

Tests : conditions based on file attributes (name, size, time, permissions, etc.).

Actions : operations performed on matched files (e.g., -print, -delete, -exec).

Global options : limits that affect the whole search (e.g., -maxdepth, -mindepth).

Positional options : options that influence how paths are interpreted.

Tests

Common test forms include: -name pattern – match file name (use quotes if the pattern contains * or ?). -iname pattern – case‑insensitive name match. -mtime n, -ctime n, -atime n – match modification, change, or access time in days. Prefix + means “greater than”, - means “less than”. -mmin n, -cmin n, -amin n – same as above but in minutes. -size n[ckwbMG] – match file size; suffix selects unit (c=bytes, k=KB, M=MiB, G=GiB, w=words, b=blocks of 512 B). -uid n, -gid n, -user name, -group name – match ownership. -perm mode – match exact permission bits; prefixes / or - make the test less strict. -type c – match file type (d=directory, f=regular file, l=symlink, p=pipe, s=socket, b=block device, c=character device).

Actions

Actions tell find what to do with each match: -print (default) – display the path. -ls – long‑format listing. -exec command {} \; – run command once per file; {} is replaced by the file name. -exec command {} + – build a single command line with many file names (more efficient). -execdir – like -exec but runs the command from the file’s directory, reducing race‑condition risk. -ok and -okdir – same as -exec / -execdir but ask for user confirmation before each execution. -delete – remove matched files (use with caution).

# Example: list files named passwd and delete them after confirmation
find /etc -name 'passwd' -ok rm {} \;

Operators

Operators combine multiple tests: -a or -and – logical AND (default when tests are adjacent). -o or -or – logical OR. ! or -not – logical NOT.

Parentheses ( … ) (escaped as \( and \)) control precedence.

# Find files named passwd OR shadow
find / -type f \( -name 'passwd' -o -name 'shadow' \)

Practical Examples

Time‑based search for files modified exactly seven days ago: find / -mtime 7 -ls Files modified within the last seven days, sorted by modification time: find / -mtime -7 -exec ls -tld {} + Search for files newer than /etc/passwd ’s change time: find /etc -newermc /etc/passwd Copy all files changed in the last week to /tmp/back using the efficient {} + form:

find /etc -mtime -7 -type f -exec cp -t /tmp/back {} +

Prevent find from descending into a directory while still matching its name:

find /etc -name 'pass*' -prune

Additional Options

Common global options include: -depth – process a directory’s contents before the directory itself. -maxdepth n – limit recursion depth. -mindepth n – require a minimum depth.

For a complete list, consult man find.