Learn to find command with these 14 examples. Find command examples handpicked to help you in your day-to-day operations.
One of the most important, used and helpful command in Linux terminal is ‘find’ command. It will search files depending on your search criteria and bring the list for you! It saves you from going to many directories and wasting time looking out your required files.
In this article we will see a list of different find commands to search files. Normally find command syntax is –
# find <path_to_search> -switch <search_criteria>
Where, path_to_search is a directory location where you want to search and search_criteria is a condition that should be matched to search files. Note here that find command will search all sub-directories of given path_to_search recursively.
Let’s see 14 find command examples that are very helpful for you in your day to day operations on Linux servers like RedHat, Ubuntu, CentOS, Debian, etc.
Find file using name
Using –name switch you can specify the name of files to search in a particular location.
root@kerneltalks # find /tmp -name "*.gz"
You can use wild cards as well while specifying your search criteria. In the above example, we searched /tmp directory for all gun-zipped files.
Find only files
To search specific file type -type switch needs to be defined in find command.
root@kerneltalks # find /tmp -type f -name "*log"
For searching only files, we defined -type as f in the above example. The above command will search /tmp for files whose name ends with a log.
Find only directories
For searching only directories define -type as d.
root@kerneltalks # find /tmp -type d -name "box*"
In the above example, find command will search /tmp for only directories whose name starts with a box.
Find files which are modified in last 7 days
Searching files that are modified in the last X days is helpful for log management. When you don’t have utilities like logrotate configured then you will have to search and house keep files with this command.
root@kerneltalks # find /tmp -mtime 7
-mtime is a switch which takes a number of days as an argument. mtime stands for modification time.
You can combine the same switch two times to get a range of days for your search. For example to search files which are modified between last 10 to 20 days you can use :
root@kerneltalks # find /tmp -mtime -20 -mtime +10
Find files accessed in last 7 days
Another variant of the above search is to find files that are accessed in the last X days. So that decisions can be made for those files who are not accessed for a long period of time and can be zipped/trimmed to save disk space.
root@kerneltalks # find /tmp -atime 7
-atime switch to be used and number of days to be supplied as argument.
You can combine the same switch two times to get a range of days for your search. For example to search files which are accessed between last 10 to 20 days you can use :
root@kerneltalks # find /tmp -atime -20 -atime +10
Find files with particular size
Some times housekeeping is done based on file size too. To search file based on its size you can use -size and supply human-readable size formats like 10M, 2G, etc.
root@kerneltalks # find /tmp -size 5M
Above command will search file with 5MB size.
Find files having size greater than
But, exact size search mostly doesn’t yield expected. It’s always good if you search with a file size range. To find files with size greater than X –
root@kerneltalks # find /tmp -size +10M
This command will search /tmp for files whose size is greater than 10MB.
Find files having size lesser than
Same way files can be searched with size less than specified value like –
root@kerneltalks # find /tmp -size -20M
Using above two option we can even define range of size to search file from.
root@kerneltalks # find /tmp -size +10M -size -20M
This command will search files whose size is greater than 10MB and less than 20MB!
Find hidden files
As you know in Linux/Unix, hidden files name starts with .
So we can search for hidden files using -name switch explained earlier with the wild card as below –
root@kerneltalks # find /tmp -type f -name .*
We specified wild card asterisk with . means search all files whose name starts with .
Find files with particular permission
Searching files with particular permission is one of the tasks while auditing. This will help you to trace down files that might be having un-necessary extra permissions and can pose a security threat to the system.
-perm (permission) the switch can be used with findcommand followed by permissions.
root@kerneltalks # find / -type f -perm 0777
In above command we are searching all files with 777 permission.
Find world readable files
With the above example, we can search world-readable files i.e. everyone has only read access on that file (444 or -r--r--r-- permission)
root@kerneltalks # find / -type f -perm 444
OR
root@kerneltalks # find / -type f -perm /u=r -perm /g=r -perm /o=r
You can see numeric as well as u-g-o (user, group, others) format can be used with this switch.
Find files owner by particular user
If you are suspecting some user is spamming files on the server, you can directly search files with his ownership using -user switch.
root@kerneltalks # find / -type f -user shrikant
This command will search whole root directory for files which are owned by user ‘shrikant’
Find files owned by particular group
Similarly, files owned by a specific group can be searched using find command with -group switch
root@kerneltalks # find / -type f -group dba
In above example we are searching for files owned by group named ‘dba’
Find empty files or directories
Empty files and directories cleanup is crucial when you are hitting your inode limits. Sometimes deleting sources of soft links, left link files empty on server occupying inode. In such a case we can search them with -empty switch to find command.
root@kerneltalks # find / -type f -empty
root@kerneltalks # find / -type d -empty
Defining file type as file or directory will search respective empty entities.