Syntax

find [search_path] [expression_options] [target_criteria]

Common Search Criteria

Searching by Name

The -name flag allows pattern matching. Enclose patterns in quotes to prevent shell expansion.

# Locate all text files inside /var/www
find /var/www -name "*.txt"

# Find files starting with a capital letter in /etc
find /etc -name "[A-Z]*"

# Find files prefixed with 'config'
find /opt -name "config*"

Searching by Size

Adjust the search using + (greater than) or - (less than) prefixes.

# Files strictly larger than 10 Megabytes
find /var/log -size +10M

# Files exactly 1 Megabyte (rarely used alone)
find /tmp -size 1M

# Files smaller than 100 Kilobytes
find ~/Downloads -size -100k

Searching by Owner

Combine user and group ownership checks.

# Find files owned by 'alice' in her home folder
find /home/alice -user alice

# Find files owned by 'bob' belonging to 'developers' group
find /srv/project -user bob -group developers

Filtering by File Type

Common types include f (regular file) and d (directory).

# List all directories under /boot
find /boot -type d

# List only directories in /usr/share
find /usr/share -type d

# List everything *except* directories
find /usr/share ! -type d

# Find symbolic links
find /usr/bin -type l

Applying Actions with xargs

Standard tools like chmod do not read from standard input (stdin). Use xargs to convert piped input into command arguments.

# Set directories to 755 and files to 644
find /srv/app -type d -print0 | xargs -0 chmod 755
find /srv/app -type f -print0 | xargs -0 chmod 644

The -print0 and -0 flags handle filenames with spaces or special characters by using null characters as delimiters.

Combining Conditions

Logical operators determine how criteria interact:

• -a (AND): Both conditions must be true (default behavior).
• -o (OR): Atleast one condition must be true.
• ! (NOT): Inverts the match.

Precedence: AND binds tighter than OR.

# Files owned by root AND larger than 5MB
find /mnt -user root -a -size +5M

# Files owned by root OR larger than 5MB
find /mnt -user root -o -size +5M

# Files NOT owned by root
find /tmp ! -user root

Special Cnoditions

• -empty: Matches empty files or directories.
• -perm: Matches permission sets.
  • -perm 644: Exact match.
  • -perm -644: At least these permissions (e.g., 755 also matches).

Time-Based Filtering

Linux tracks three main timestamps:

1. atime (Access Time): Last time file content was read.
2. mtime (Modification Time): Last time file content was written to.
3. ctime (Change Time): Last time metadata (permissions/owner) changed.

Use -min for minutes or -time for 24-hour periods.

# Files accessed within the last 10 minutes
find /tmp -amin -10

# Files modified more than 2 days (48 hours) ago
find /var/log -mtime +2

Executing Commands on Results

Use -exec to run commands directly on found items. The {} is a placeholder for the filename, and \; terminates the command.

# Remove all .tmp files found in the current tree
find . -name "*.tmp" -exec rm {} \;

# Search for 'error' string inside all found config files
find /etc -name "*.conf" -exec grep "error" {} \;

Production Examples

# Purge old log files older than 5 days
find /backups/ -type f -name "*.log" -mtime +5 -exec rm {} \;

# Clean up core dumps
find /var/crash/ -type f -name "core.*" -exec rm -f {} \;