Home » Shell Scripting » BASH » Linux Find Command Tutorial

About Toni

Linux Find Command Tutorial

Linux find command is a powerful and flexible search tool that not only every system administrator must master, but also any kind of Linux user. This tutorial will show how to use it to perform almost any type search with this useful command.

For this tutorial, Linux Mint 17.3 and find 4.4.2 have been used.

1. Find by file name

The syntax for find command is the following

find [path] [expression]

1.1. By literal name

To find, for example, README.txt files in home directory, we would type the following:

find /home -name README.txt

The -name expression is case sensitive. The following command will find every README.txt file in the whole disk, not taking into account the case sensitivity:

find / -iname README.txt

1.2. By regular expression

Using regular expressions is useful mostly when we are looking for certain type of files.

For example, to find every .txt file in the home directory, the regular expression would be:

find /home -regextype posix-extended -regex ".*\.txt"

Let’s see it carefully:

  • With -regextype we are specifying a regular expression type, posix-extended, which is more widely implemented in other systems than find ‘s default one.
  • And the regular expression itself:
    • The . is a wild card for searching any character.
    • The * is for searching zero or more repetitions. Combined with .,  will look for every file in the specified directory, because every file will have at least a character, repeated zero or more times.
    • Once that we have looked for every file, we have to filter the results. In this case, we are finding for every string ending in .txt. Note that we have escaped the dot character, with \., since it’s a special character for regex.

Regular expressions can be as flexible as we want. We can find every .txt and .log files with the following command:

find /home -regextype posix-extended -regex ".*(\.txt|\.log)"

What we are doing is to tell find to look for every file ending with the .txt substring or with the .log substring. The | character is an or operand. And everything inside round braces, is for matching that exact substring.

We have seen how to match exact substrings. Now, let’s see how to match characters inside a range. For that, we will find files that have numbers in their name:

find /home -regextype posix-extended -regex ".*[0-9]"

The square brackets are for matching specific characters (not strings). And we can define ranges with the hyphen.

To end with this section, let’s see how we would find files that are composed by a date (supposing it in UK format):

find /home -regextype posix-extended -regex ".*[0-9]{2}-[0-9]{2}-[0-9]{4}.*"

The curly braces are used for repetitions. So, we are looking for something with *XX-XX-XXXX* format.

Note: for finding files by their extension, there’s a shorter way using -name :

find /home -name "*.txt"

Which is a more appropriate option when we want to make a search specifying an unique file extension.

2. Find by file properties

Apart from the name, we can also find for some specific file properties. In this section we will see for which properties we can make searches, and how.

2.1 Through time

2.1.1 In minutes

There are many cases in which we can be interested in finding by the time they have been modified (as same as when we sort by modification time when using a GUI).

We can look for files that have been modified, for example, in the last 30 minutes:

find /home -mmin -30

Note that we are using a hyphen when specifying the minutes. Without it, find would look for files that have been modificated exactly 30 minutes ago:

find /home -mmin 30

For finding files by access time, is almost the same than for modification time, but with -amin expression instead of -mmin :

find /home -amin -30

There’s another property for finding through the time, that is the change time. Don’t confuse it with modification time. The change time is a status change (for example, permission or owner change).

As you probably have guessed, for finding by status change time, we have to use the -cmin expression:

find /home -cmin -30

2.1.2. In days

We have seen how find files through time, specifying the time in minutes. But we can also make searches specifying the time in days. For that, we have to change the *min suffix of the previous expressions, with *time suffix.

Take into account that the searches made with *time are always truncated. So, if we want to find modified files between the current moment and the previous day, we have to type:

find /home -mtime 0

2.2. By permissions

Finding files by permissions is so simple. We can look for files belonging to a certain user or group:

find /home -user julen
find /home -group development

And also by the permissions of the files:

find / -perm 777

The above command would find the files with exactly 777 permissions, which can be useful to find files with permissions that should be fixed.

There is the dash prefix available, /, for finding files that match at least one of the specified permission bits. It’s easier to understand seen in an example:

find / -perm /755

The above command would find files that are readable, writable or executable by the owner; readable or executable by the owner group; or readable or executable by other users. Finds

Of course, we can also use the symbolic notation to find files by permissions:

find / -perm a=rwx

Which would be the equivalent to 777.

2.3. By file type

You may noticed that find also returns folders, for example. By default, find looks for every file that matches with the criteria, regardless its type.

If we are only looking for a certain type of files, we have to specify it with -type:

find / -perm a=rwx -type f

That command would only find the regular files.

find accepts the following values for this option:

  • d: directory
  • f: regular file
  • l: symbolic link
  • b: buffered block
  • c: unbuffered character
  • p: named pipe
  • s: socket

2.4. By size

Finding by size is specially useful when we can to free some space in the disk. And is pretty simple:

find /var/log -size +20M

The above command will find files bigger than 20 megabytes in /var/log  directory, a typical directory whose size has to be continuously watched by systems administrators.

We have several units to choose:

  • b: 512-byte blocks (the one used by default, if no other unit is specified)
  • c: bytes
  • k: kilobytes
  • M: megabytes
  • G: gigabytes

3. Using conditions

find allows to use and, not and or boolean conditions.

Let’s see it with an example for each one:

find / -size +10M -and -name "*.txt"
find / -perm 777 -not -user root
find / -user developer -or -group development

Which, respectively, mean: “find every file bigger than 10MB and with .txt extension“, “find every file with 777 permissions that does not belong to root user“, and “find every file that belongs to developer user or to development group”.

Actually, the -and expression is not necessary to combine expressions with and logic.

find / -size +10M -name "*.txt"

The command shown above would work as same as the previous one with -and.

4. Executing actions with exec

This is the most powerful feature of find. The -exec option allows us to execute commands for every found file.

A very typical use of -exec is for showing file information as we would do with ls command:

find / -size +500M -exec ls -l {} \;

Apart from executing the command after -exec option, we have to add {}, where the file returned by find will be placed, like passing a parameter to the specified command. And the \; is to set the command end. We can chain multiple -exec commands after the command end.

5. Useful and recurrent commands

To end with the tutorial, we will see some of the most common find commands.

Delete old and big log files

find / -iname "*.log" -mtime +1 -size +10M -exec rm {} \;

Fix 777 permissions

find / -perm 777 -exec chmod 755 {} \;

Delete empty folders

find / -type d -empty -exec rm --dir {} \;

Find 10 biggest files

find / -type f -exec ls -s {} \; | sort -n -r | head -10

Delete broken symbolic links

find / -xtype l -exec rm {} \;

6. Conclusion

In this tutorial we have seen how to deal with Linux find command, a very powerful tool for file search, from simple searches, like by name or extension; to more advanced ones, using complex regular expressions or filtering by permissions, and also being able to execute any commands for every search we make.

Do you want to know how to develop your skillset to become a sysadmin Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!

 

1. Introduction to NGINX

2. Apache HTTP Server Cookbook

3. VirtualBox Essentials

4. Nagios Monitoring Cookbook

5. Linux BASH Programming Cookbook

6. Postgresql Database Tutorial

 

and many more ....

 

I have read and agree to the terms & conditions

 

Subscribe
Notify of
guest

This site uses Akismet to reduce spam. Learn how your comment data is processed.

0 Comments
Inline Feedbacks
View all comments