Finding Linux with the find command

The find utility is a versatile and functional way to search in Linux  This article is a cheat sheet with a description and examples of its use.


General Syntax

find <where to look> <options>

<where to search> — the path to the root directory where to start the search. For example, find /home/user – search in the appropriate directory. For the current directory, use the dot “.”.

<options> is a set of rules to search by.

* by default, the search is recursive. To search in a specific directory, you can use the  maxdepth option .

Description of options

Option Description
-name Search by name.
-inameCase insensitive search by name.
-type The type of the search object. Possible options:
  • f – file;
  • d – directory;
  • l – link;
  • p – pipe;
  • s is the socket.
-size The size of the object. Specified in blocks of 512 bytes or simply in bytes (with the character “c”).
-mtime File modification time. Specified in days.
-mmin Change time in minutes.
-atime The time the object was last accessed in days.
-amin Last access time in minutes.
-ctime The last change in the owner or rights to the object in days.
-cmin Last owner or rights change in minutes.
-user Search by owner.
-group By group.
-perm With certain access rights.
-depth The search should not start from the root, but from the most deeply nested directory.
-maxdepth The maximum depth of the directory search. -maxdepth 0 – search only in the current directory. By default, the search is recursive.
-prune Exclude the listed directories.
-mount Don’t move to other file systems.
-regex By name with regular expression.
-regextype <type> The type of the regular expression.
-L or -follow Displays the contents of symbolic links (symlinks).
-empty Search for empty directories.
-delete Delete found.
-ls Output as ls -dgils
-print Show found.
-print0 Path to found objects.
-exec <command> {} \; Run command on found.
-ok Issue a prompt before executing -exec.

Logical operators are also available:

Operator Description
-a Logical AND. Combine several search criteria.
-o Logical OR. Let the find command search based on one of the search criteria.
-not or ! Logical NOT. Inverts the search term.

The full set of actual options can be obtained with the man find command .

Find Usage Examples

Finding a file by name

1. Simple search by name:

find / -name “file.txt”

* this example will search the entire file system for a file named  file.txt starting with the root / .

2. Search for a file by part of the name:

find / -name “*.tmp”

* this command will search for all folders or files in the / root directory ending in .tmp

3. Several conditions. 

a) Logical AND. For example, files that start with sess_ and end with cd :

find. -name “sess_*” -a -name “*cd”

b) Logical OR. For example, files that start with sess_ or end with cd :

find. -name “sess_*” -o -name “*cd”

c) Regular expressions have a more compact form, for example:

find. -regex ‘.*/\(sess_.*cd\)’

find. -regex ‘.*/\(sess_.*\|.*cd\)’

* where in the first search an expression similar to example a) is used, and in the second – b).

4. Find all files except .log:

find. ! -name “*.log”

* in this example, we used the logical operator .

Search by date

1. Search for files that have changed a certain number of days ago:

find. -type f -mtime +60

* this command will find files that have been changed more than 60 days ago.

Or in between:

find. -mmin -20 -mmin +10 -type f

* find all files that have been changed for more than 10 minutes, but no more than 20 minutes .

2. Finding files with newer . This option has been available since version 4.3.3 (you can see it with the find –version command ).

a) date of change:

find. -type f -newermt “2019-11-02 00:00”

* will show all files that have changed since 02.11.2019 00:00.

find. -type f -newermt 2019-10-31 ! -newermt 2019-11-02

* will find all files that changed between 10/31/2019 and 11/01/2019 (inclusive).

b) date of application:

find. -type f -newerat 2019-10-08

* all files accessed since 10/08/2019.

find. -type f -newerat 2019-10-01 ! -newerat 2019-11-01

* all files accessed in October.

c) creation date:

find. -type f -newerct 2019-09-07

* all files created since September 07, 2019.

find. -type f -newerct 2019-09-07 ! -newerct “2019-09-09 07:50:00”

*  files created from 09/07/2019 00:00:00 to 09/09/2019 07:50


Search the current directory and all its subfolders for files only:

find. -type f

f  – search for files only.

Search by permissions

1. We are looking for all the right to read and write:

find / -perm 0666

2. Find files that only the owner has access to:

find / -perm 0600

File search by content

find / -type f -exec grep -i -H “content” {} \;

* in this example, a recursive search is made for all files in the / directory and a list is displayed of those that contain the string  content .

Sorted by modification date

find /data -type f -printf ‘%TY-%Tm-%Td %TT %p\n’ | sort-r

* the command will find all files in the  /data directory , append the modification date to the name, and sort the data by name. As a result, we get that the files will go in the order they were changed.

Limit on the number of output results

The most common example is to output one file that was last modified. We take the sorting example and add the following:

find /data -type f -printf ‘%TY-%Tm-%Td %TT %p\n’ | sort-r | head -n 1

Search with action (exec)

1. Find only files that start with sess_ and delete them:

find. -name “sess_*” -type f -print -exec rm {} \;

*  -print is not required, but it will show everything that will be removed, so this option is useful when the command is executed manually.

2. Rename found files:

find. -name “sess_*” -type f -exec mv {} new_name \;


find. -name “sess_*” -type f | xargs -I ‘{}’ mv {} new_name

3. Move found files:

find. -name “sess_*” -type f -exec mv {} /new/path/ \;

* in this example, we will move all found files to the  /new/path/ directory .

4. Display the number of found files and folders that end in .tmp :

find. -name “*.tmp” | wc -l

5. Change permissions:

find /home/user/* -type d -exec chmod 2700 {} \;

* In this example, we are looking for all directories ( type d ) in the /home/user directory and set their permissions to  2700 .

6. Transfer the found files to the pipeline (pipe):

find /etc -name ‘*.conf’ -follow -type f -exec cat {} \; | grep ‘test’

* in this example, we used find to search for the string test in files that are in the /etc directory and whose names end in .conf . To do this, we passed a list of found files to the grep command , which already performed a search on the contents of these files.

7. Replace files with sed command:

find /opt/project -type f -exec sed -i -e “s/test/production/g” {} \;

* find all files in the  /opt/project directory and change their content from test to production .

Scheduled cleaning

The find command is useful for automatically removing obsolete files.

Open cron jobs for editing:

crontab -e

And add:

0 0 * * * /bin/find /tmp -mtime +14 -exec rm {} \;

* in this example, we delete all files and folders from the /tmp directory that  are older than 14 days. The task runs every day at 00:00 . * we look at the full path to the find executable file with the which find command – it can be located in different places on different UNIX systems.

VPS Linux

VPS hosting with KVM virtualization

Remote access/control

Ready solution

KVM virtualization

24 hours a day support