Linux · navigation

find

where is that file

find starts at a directory and visits everything beneath it, printing each entry that passes every test you list. Tests are joined by "and" unless you say otherwise, and a match can be handed straight to another command with -exec.

find answers by what a file is like, not only by what it is called.

Shape

find WHERE TESTS

start point first, then tests

Searches

The live tree

no index, always current

Quote patterns

'*.log'

or the shell expands them first

Act on matches

-exec

or -delete, with care

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashfindutils

$ find /var/log -name '*.log' -mtime -1 -size +1M

1/var/log/nginx/access.log

2/var/log/app/worker.log

3find: '/var/log/private': Permission denied

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Every match is printed as a path

The path begins with the starting point you gave, so results can be pasted straight into another command.

All three tests had to pass

The name ends in .log, the content changed within the last day, and the file is larger than one mebibyte. Tests are "and" by default.

Errors arrive mixed in

find could not enter a directory it has no rights to. Add 2>/dev/null to hide these, or run it with sudo to search there too.

Switches

A switch changes how the command behaves. These are the ones used day to day; man find lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-name PATTERN: Match the file name against a pattern such as "*.log". Case-sensitive.
-iname PATTERN: The same, ignoring upper and lower case.
-type f: Only regular files. Use d for directories, l for symbolic links.
-size +100M: Only files larger than 100 MB. A minus sign means smaller than.
-mtime -7: Only files modified within the last 7 days. +7 means more than 7 days ago.
-maxdepth N: Descend at most N levels below the starting directory.
-exec CMD {} \;: Run a command on each match; {} is replaced by the file’s path.
-delete: Delete each match. Run the search without it first to see what would go.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

find . -type d -name node_modules

Only directories with that exact name, starting from here.

find . -name '*.tmp' -delete

Deletes every match. Run it once without -delete first and read the list.

find . -name '*.sh' -exec chmod +x {} +

Runs a command on the matches; {} is replaced by the file names.

find /home -user asha -newer /tmp/mark

Files owned by one user that changed after a reference file did.

In cybersecurity

find is the standard audit tool for a filesystem: it can list every file with a dangerous permission in a single line.

Set-uid programs

"find / -perm -4000 -type f" lists every program that runs as its owner. Each one outside the usual set deserves an explanation.

World-writable files

"find / -xdev -perm -0002 -type f" finds files any user may modify — a common route to privilege escalation.

-delete and -exec are final

A wrong test deletes the wrong thousand files. Always print first, then add the action.

Filed under

Navigation

Read alongside

lsLists the contents of a directory — names, and with -l the type, permissions, owner, size and date of each entry.rmRemoves files, and with -r whole directory trees. There is no recycle bin: what it removes is gone.