Linux find command is a powerful and flexible search tool that not only every system administrator must master, but also any kind of Linux user. This tutorial will show how to use it to perform almost any type search with this useful command.
For this tutorial, Linux Mint 17.3 and find 4.4.2 have been used.
1. Find by file name
The syntax for find command is the following
find [path] [expression]
1.1. By literal name
To find, for example, README.txt files in home directory, we would type the following:
find /home -name README.txt
The -name expression is case sensitive. The following command will find every README.txt file in the whole disk, not taking into account the case sensitivity:
find / -iname README.txt
1.2. By regular expression
Using regular expressions is useful mostly when we are looking for certain type of files.
For example, to find every .txt file in the home directory, the regular expression would be:
find /home -regextype posix-extended -regex ".*\.txt"
Let’s see it carefully:
- With
-regextypewe are specifying a regular expression type,posix-extended, which is more widely implemented in other systems thanfind‘s default one. - And the regular expression itself:
- The
.is a wild card for searching any character. - The
*is for searching zero or more repetitions. Combined with., will look for every file in the specified directory, because every file will have at least a character, repeated zero or more times. - Once that we have looked for every file, we have to filter the results. In this case, we are finding for every string ending in
.txt. Note that we have escaped the dot character, with\., since it’s a special character for regex.
- The
Regular expressions can be as flexible as we want. We can find every .txt and .log files with the following command:
find /home -regextype posix-extended -regex ".*(\.txt|\.log)"
What we are doing is to tell find to look for every file ending with the .txt substring or with the .log substring. The | character is an or operand. And everything inside round braces, is for matching that exact substring.
We have seen how to match exact substrings. Now, let’s see how to match characters inside a range. For that, we will find files that have numbers in their name:
find /home -regextype posix-extended -regex ".*[0-9]"
The square brackets are for matching specific characters (not strings). And we can define ranges with the hyphen.
To end with this section, let’s see how we would find files that are composed by a date (supposing it in UK format):
find /home -regextype posix-extended -regex ".*[0-9]{2}-[0-9]{2}-[0-9]{4}.*"The curly braces are used for repetitions. So, we are looking for something with *XX-XX-XXXX* format.
Note: for finding files by their extension, there’s a shorter way using -name :
find /home -name "*.txt"
Which is a more appropriate option when we want to make a search specifying an unique file extension.
2. Find by file properties
Apart from the name, we can also find for some specific file properties. In this section we will see for which properties we can make searches, and how.
2.1 Through time
2.1.1 In minutes
There are many cases in which we can be interested in finding by the time they have been modified (as same as when we sort by modification time when using a GUI).
We can look for files that have been modified, for example, in the last 30 minutes:
find /home -mmin -30
Note that we are using a hyphen when specifying the minutes. Without it, find would look for files that have been modificated exactly 30 minutes ago:
find /home -mmin 30
For finding files by access time, is almost the same than for modification time, but with -amin expression instead of -mmin :
find /home -amin -30
There’s another property for finding through the time, that is the change time. Don’t confuse it with modification time. The change time is a status change (for example, permission or owner change).
As you probably have guessed, for finding by status change time, we have to use the -cmin expression:
find /home -cmin -30
2.1.2. In days
We have seen how find files through time, specifying the time in minutes. But we can also make searches specifying the time in days. For that, we have to change the *min suffix of the previous expressions, with *time suffix.
Take into account that the searches made with *time are always truncated. So, if we want to find modified files between the current moment and the previous day, we have to type:
find /home -mtime 0
2.2. By permissions
Finding files by permissions is so simple. We can look for files belonging to a certain user or group:
find /home -user julen find /home -group development
And also by the permissions of the files:
find / -perm 777
The above command would find the files with exactly 777 permissions, which can be useful to find files with permissions that should be fixed.
There is the dash prefix available, /, for finding files that match at least one of the specified permission bits. It’s easier to understand seen in an example:
find / -perm /755
The above command would find files that are readable, writable or executable by the owner; readable or executable by the owner group; or readable or executable by other users. Finds
Of course, we can also use the symbolic notation to find files by permissions:
find / -perm a=rwx
Which would be the equivalent to 777.
2.3. By file type
You may noticed that find also returns folders, for example. By default, find looks for every file that matches with the criteria, regardless its type.
If we are only looking for a certain type of files, we have to specify it with -type:
find / -perm a=rwx -type f
That command would only find the regular files.
find accepts the following values for this option:
- d: directory
- f: regular file
- l: symbolic link
- b: buffered block
- c: unbuffered character
- p: named pipe
- s: socket
2.4. By size
Finding by size is specially useful when we can to free some space in the disk. And is pretty simple:
find /var/log -size +20M
The above command will find files bigger than 20 megabytes in /var/log directory, a typical directory whose size has to be continuously watched by systems administrators.
We have several units to choose:
- b: 512-byte blocks (the one used by default, if no other unit is specified)
- c: bytes
- k: kilobytes
- M: megabytes
- G: gigabytes
3. Using conditions
find allows to use and, not and or boolean conditions.
Let’s see it with an example for each one:
find / -size +10M -and -name "*.txt" find / -perm 777 -not -user root find / -user developer -or -group development
Which, respectively, mean: “find every file bigger than 10MB and with .txt extension“, “find every file with 777 permissions that does not belong to root user“, and “find every file that belongs to developer user or to development group”.
Actually, the -and expression is not necessary to combine expressions with and logic.
find / -size +10M -name "*.txt"
The command shown above would work as same as the previous one with -and.
4. Executing actions with exec
This is the most powerful feature of find. The -exec option allows us to execute commands for every found file.
A very typical use of -exec is for showing file information as we would do with ls command:
find / -size +500M -exec ls -l {} \;Apart from executing the command after -exec option, we have to add {}, where the file returned by find will be placed, like passing a parameter to the specified command. And the \; is to set the command end. We can chain multiple -exec commands after the command end.
5. Useful and recurrent commands
To end with the tutorial, we will see some of the most common find commands.
Delete old and big log files
find / -iname "*.log" -mtime +1 -size +10M -exec rm {} \;Fix 777 permissions
find / -perm 777 -exec chmod 755 {} \;Delete empty folders
find / -type d -empty -exec rm --dir {} \;Find 10 biggest files
find / -type f -exec ls -s {} \; | sort -n -r | head -10Delete broken symbolic links
find / -xtype l -exec rm {} \;6. Conclusion
In this tutorial we have seen how to deal with Linux find command, a very powerful tool for file search, from simple searches, like by name or extension; to more advanced ones, using complex regular expressions or filtering by permissions, and also being able to execute any commands for every search we make.
