find Command: Tutorial & Examples

Search for files and directories based on various criteria

The find command is a versatile and powerful tool used in Linux and other Unix-like operating-systems to search for files and directories in a directory hierarchy. It allows users to locate files that match specific conditions such as name patterns, file types, sizes, timestamps, permissions, and more. This article provides a detailed reference to understanding and using the find command effectively.

How find Works

The find command traverses the directory tree starting from one or more specified directories (or the current directory if none is given). It evaluates each file or directory against the criteria provided via options and expressions. Files that satisfy the criteria are then printed or acted upon.

The command walks through all subdirectories recursively by default, examining every file system object (file, directory, symbolic link, etc.) encountered. This exhaustive search makes find extremely powerful but potentially resource-intensive on large file systems.

What find Does

Searches directories recursively for files and directories.
Matches files based on criteria such as:
- Name or pattern (-name, -iname)
- File type (-type)
- Size (-size)
- Modification, access, or change time (-mtime, -atime, -ctime)
- Permissions (-perm)
- Ownership (-user, -group)
- Number of links (-links)
- And many others
Executes commands on matched files using -exec, -ok, or piping results.
Prints the matched file paths to standard output by default.

Why find Is Important

find is essential for system administration and shell scripting because:

It helps locate files quickly in large or complex directory trees.
It allows bulk operations on files meeting specific conditions, such as cleanup, backups, or auditing.
It integrates with other commands to automate file management tasks.
It can be used to diagnose disk-full or permission-issue problems by finding large or inaccessible files.

How To Use find

The general syntax is:

find [path...] [expression]

path specifies where to start searching. If omitted, find uses the current directory (.).
expression includes options, tests, and actions to determine which files to select and what to do with them.

Basic Usage Examples

Find all .txt files in the current directory and subdirectories:

find . -name "*.txt"

Find all directories named backup starting from /var:

find /var -type d -name "backup"

Find all regular files larger than 100 megabytes:

find . -type f -size +100M

Find all files modified in the last 7 days:

find . -mtime -7

Using -exec to Run Commands on Found Files

To calculate the md5sum of all regular files in the current directory and below, and save the output to md5sum.txt:

find . -type f -exec md5sum '{}' \; > md5sum.txt

Explanation:

-type f restricts the search to regular files.
-exec runs the command that follows on each found file, where {} is replaced by the file name.
The command must end with \; to terminate the -exec expression.

Common Command Line Parameters

-name pattern: Match file name with shell pattern (case-sensitive).
-iname pattern: Case-insensitive name matching.
-type c: Match file type; c can be:
- f regular file
- d directory
- l symbolic link
- c character device
- b block device
- s socket
- p named pipe (FIFO)
-size n[cwbkMG]: Match file size. Prefix + means greater than, - less than.
-mtime n: Match files modified n days ago. Prefix - means less than n days.
-user name: Match files owned by user.
-group name: Match files owned by group.
-perm mode: Match files with specific permissions.
-maxdepth n: Limit search to n levels of subdirectories.
-mindepth n: Do not match files less than n levels deep.
-exec command {} \;: Execute command on each matched file.
-print: Print matched file paths (default action).

Practical Examples Using find

Find all symbolic links in /usr:

find /usr -type l -print
Find files larger than 500MB and delete them interactively:

find . -type f -size +500M -ok rm '{}' \;
Find files not accessed in over a year (365 days):

find /home -type f -atime +365
Find files with permission 777 (world-writable):

find / -type f -perm 0777
Find empty directories:

find . -type d -empty
Find all .log files and compress them with gzip:

find /var/log -type f -name "*.log" -exec gzip '{}' \;

Common Errors And Troubleshooting

Permission Denied: When searching system directories, you might see "Permission denied" errors. Use sudo to run find with elevated privileges if appropriate:
```
sudo find /root -name "*.conf"
```
Too Many Arguments: Using -exec incorrectly can cause errors. Always terminate -exec commands with \;.
Slow Performance: Searching entire file systems can be slow. Use -maxdepth to limit search depth or narrow your search path.
Unexpected Results: Remember that -name is case-sensitive; use -iname for case-insensitive matching.
Special Characters in File Names: Use -print0 with xargs -0 to handle files with spaces or newlines.

Performance Considerations

Limit the scope of searches with starting paths and -maxdepth.
Use specific tests to reduce the number of files processed.
Avoid running expensive commands inside -exec for each file; consider using -exec ... + or xargs for batching.
Consider using locate for quick filename searches if file database is updated.

Security Considerations

Be cautious when running commands via -exec or -ok, especially as root.
Avoid running destructive commands without confirmation (-ok prompts before each execution).
Beware of symlink attacks when running find on directories writable by untrusted users.

Possible Alternatives Or Related Commands

locate: Fast filename search using a database.
grep: Search file contents.
xargs: Efficiently build and execute command lines from input.
ls: List directory contents.
stat: Display detailed file information.

Cheatsheet

Find files by name:

find . -name "file.txt"
Find directories by name:

find /path -type d -name "dir"
Find files by size (> 10MB):

find . -type f -size +10M
Find files modified in last 3 days:

find . -mtime -3
Delete files interactively:

find . -type f -name "*.tmp" -ok rm '{}' \;
Execute command on files:

find . -type f -name "*.log" -exec gzip '{}' \;