Complete Guide to the find Command in Linux/Unix

Overview of the find Command

The find command is a powerful file search tool in Linux/Unix systems. It can search for files in specified directories and their subdirectories based on various criteria such as filename, permissions, time, size, and more. With its rich set of options and comprehensive functionality, find remains effective even on network file systems (NFS) given appropriate permissions.

When dealing with large file systems (e.g., over 30GB), find may consume significant resources and time, so it is sometimes run in the background.

Basic Syntax of find

The general form of the find command is:

find pathname -options [-print -exec -ok ...]

Parameter Explanation

• pathname: Specifies the starting directory path for the search. For example, . means the current directory, and / means the root directory.
• -print: Outputs the matched file paths to standard output (default behavior, often omitted).
• -exec: Executes a specified shell command on each matched file. The format is 'command' {} ;. Note the space between {} and ;.
• -ok: Similar to -exec, but prompts the user for confirmation before executing each command, making it safer.

Common Options Explained

Search by Name

• -name pattern: Searches by filename pattern. Example: find . -name "*.txt".

Search by Permissions

• -perm mode: Searches for files with exact permission mode. Example: find . -perm 644.
• -perm -mode: File must have all bits in mode set (exact match).
• -perm /mode (or -perm +mode in some systems): File must have at least one of the bits in mode set (partial match).

Search by Type

• -type type: Searches by file type. Common types:
  • f: Regular file
  • d: Directory
  • l: Symbolic link
  • b: Block device file
  • c: Character device file
  • p: Pipe (FIFO)

Search by Time

Time options typically use days (-time) or minutes (-min), combined with -n (within n units) or +n (more than n units ago).

• -mtime n: File data last modified time.
• -atime n: File last accessed time.
• -ctime n: File status (e.g., permissions, owner) last changed time.
• -mmin, -amin, -cmin: Corresponding times in minutes.

Search by Size

• -size n[c]: Searches by file size. n is a number; default unit is blocks (512 bytes). Suffix c means bytes. Example: -size +1M finds files larger than 1MB, -size 100c finds files exactly 100 bytes.

Search by User/Group

• -user username: Searches for files owned by the specified user.
• -group groupname: Searches for files belonging to the specified group.
• -nouser: Finds files whose owner does not exist in /etc/passwd.
• -nogroup: Finds files whose group does not exist in /etc/group.

Other Useful Options

• -prune: Excludes a specified directory from the search. Note: may be ignored if used with -depth.
• -depth: Processes files in a directory before the directory itself.
• -mount (or -xdev): Searches only within the current file system, not crossing mount points.
• -newer file: Finds files newer than the specified file.
• ! (logical NOT): Negates a condition. Example: find . ! -name "*.bak".

Using -exec and -ok to Execute Commands

The -exec option allows executing a command on each found file. Format:

find [path...] [expression] -exec command {} ;

Here, {} is replaced by the current file's path, and ; marks the end of the command.

Example 1: Find and list details of all regular files in the current directory

find . -type f -exec ls -l {} ;

Example 2: Find files in /logs modified more than 5 days ago and delete them (dangerous; verify first)

find /logs -type f -mtime +5 -exec rm {} ;

Safety Tip: Before performing destructive operations like deletion, use -ok instead of -exec, or preview files with ls.

find . -name "*.conf" -mtime +5 -ok rm {} ;

Combining with xargs for Efficiency

When -exec processes a huge number of files, you may encounter an "argument list too long" error, and launching a process per file is inefficient. Use xargs to read arguments from standard input and pass them in batches.

Example 1: Find all regular files and check their type with file

find . -type f -print | xargs file

Example 2: Find all regular files containing "hostname"

find . -type f -print | xargs grep -l "hostname"

Note: If filenames contain spaces or special characters, use -print0 with xargs -0 for safe handling.

find . -type f -print0 | xargs -0 grep -l "hostname"

Practical Examples

1. Find and delete all .bak files in the current directory

find . -name "*.bak" -type f -delete
# Or safer interactive deletion
find . -name "*.bak" -type f -ok rm {} ;

2. Find regular files with permission 644 and list them

find . -type f -perm 644 -exec ls -l {} ;

3. Find and sort all directories

find . -type d | sort

4. Search while ignoring a specific directory

find /usr/sam -path "/usr/sam/dir1" -prune -o -type f -print

5. Find files modified in the last 7 days

find /var/log -type f -mtime -7 -print

6. Find files larger than 10MB

find /home -type f -size +10M -print

7. Find empty files or directories

# Empty files
find . -type f -empty
# Empty directories
find . -type d -empty

Important Notes

• Running a broad find command from the root directory (/) can consume significant system resources; use with caution.
• Always verify targets before using -exec or xargs with commands like rm or mv.
• Understand the difference between -perm - (exact match) and -perm / (partial match).
• For filenames with spaces or special characters, -print0 | xargs -0 is safer.

By flexibly combining its options, find can meet almost any file search requirement, making it an indispensable tool for system administration and daily operations.