Core Syntax and Parameters

The find utility traverses directory trees to locate files and directories based on specified conditions. It allows complex filtering and can execute actions on the matched results.

find [starting_path] [expression] [action]

Expressions consist of options and tests, while actions determine what happens to the matches (e.g., -print, -exec, -ok, or piping to xargs).

Commonly Used Criteria

• -name pattern: Matches file names.
• -perm mode: Matches specific permission bits.
• -user uname: Matches files owned by a specific user.
• -group gname: Matches files belonging to a specific group.
• -mtime +/-n: Filters by modification time. -n means less than n days ago, +n means more than n days ago.
• -atime +/-n: Filters by access time (same day logic).
• -ctime +/-n: Filters by status change time (same day logic).
• -nouser: Finds files with an owner not listed in /etc/passwd.
• -nogroup: Finds files with a group not listed in /etc/group.
• -type b/d/c/p/l/f: Matches by object type (block device, directory, character device, pipe, symlink, regular file).
• -size n[c]: Matches files of size n blocks (or n bytes if c is appended).
• -mount: Restricts the search to the current filesystem.
• -follow: Dereferences symbolic links during traversal.
• -prune: Excludes specified directories from the search.

Narrowing Search Scope

Searching the entire root filesystem is computationally expensive. Restricting the starting path to a specific directory, such as /etc, significantly improves performance.

# Search entire root (slow)
find / -type f -name "chrony.conf"

# Restrict to /etc (fast)
find /etc/ -type f -name "chrony.conf"
/etc/chrony.conf

Utilizing Wildcards for Partial Matches

When the exact filename is unknown, pattern matching using the asterisk (*) wildcard allows searching by prefixes or extensions.

Matching by Extension

To retrieve all configuration files ending in .conf within /etc:

find /etc/ -type f -name "*.conf"
/etc/resolv.conf
/etc/dracut.conf
/etc/sysctl.conf
...

Matching by Prefix

To retrieve all files starting with sys within /etc:

find /etc/ -type f -name "sys*"
/etc/sysconfig/network
/etc/sysctl.conf

Processing Results with Exec

The -exec flag enables executing a command on each matched file. The {} symbol represents the current match, and the sequence \; terminates the command. A mandatory space must separate {} and \; to avoid syntax errors.

Removing Obsolete Backup Files

Consider a scenario where backup files (.bak) older than 5 days need to be purged from /tmp.

First, create a test file with a specific modification timestamp:

touch -m -d "2023-10-01 00:00" /tmp/archive.bak

Verify the files present in the directory:

ls -l /tmp/*.bak
-rw-r--r--. 1 root root 0 Oct  1 00:00 archive.bak
-rw-r--r--. 1 root root 0 Nov  5 10:00 recent.bak

Locate the files older than 5 days:

find /tmp/ -type f -name "*.bak" -mtime +5
/tmp/archive.bak

Attempting to delete without the required space will trigger an error:

find /tmp/ -type f -name "*.bak" -mtime +5 -exec rm -f {}\;
find: missing argument to '-exec'

Applying the correct spacing successfully executes the deletion:

find /tmp/ -type f -name "*.bak" -mtime +5 -exec rm -f {} \;