find Command in Linux — Search Files with 10 Examples

The find command searches for files and directories in a directory hierarchy based on name, type, size, modification time, permissions, and more. Unlike grep (which searches file contents), find searches file metadata.

What You’ll Learn

By the end of this tutorial, you’ll know how to search files by name, type, size, modification time, and permissions; execute commands on found files; combine multiple conditions; prune directories; and limit search depth.

Why find Matters

Every system administrator needs to locate files — configuration files, log files older than 30 days, files larger than 1GB, world-writable files with security implications. Durga Antivirus Pro uses find to scan for suspicious files by size and modification time, and DodaZIP uses it to batch-compress files older than a threshold.

find Learning Path

    flowchart LR
  A[grep Command] --> B[awk Command]
  B --> C[find Command<br/>You are here]
  C --> D[xargs Command]
  D --> E[Shell Scripting]
  style C fill:#f90,color:#fff
  

Syntax Overview

find [path...] [options] [expression]

10 Practical Examples

1. Search by Name

Find all .log files in /var/log:

find /var/log -name "*.log" -type f | head -5

/var/log/syslog
/var/log/kern.log
/var/log/auth.log
/var/log/bootstrap.log
/var/log/dpkg.log

Case-insensitive search:

find /home -iname "readme.*" -type f

/home/alice/README.md
/home/bob/Readme.txt
/home/charlie/readme.rst

2. Search by Type

Find only directories:

find /etc -type d | head -5

/etc
/etc/ssl
/etc/ssl/certs
/etc/ssl/private
/etc/apt

Find symbolic links:

find /usr/bin -type l -name "python*"

/usr/bin/python3
/usr/bin/python

3. Search by Size

Find files larger than 100 MB:

find /var -type f -size +100M -exec ls -lh {} \; | head -5

-rw-r----- 1 syslog adm 234M Jun 20 06:00 /var/log/syslog
-rw-r----- 1 root   adm 156M Jun 19 23:59 /var/log/kern.log

Find files smaller than 1 KB:

find /home -type f -size -1k | head -3

/home/alice/.bashrc
/home/alice/.profile
/home/bob/.gitconfig

Find files between 10 MB and 50 MB:

find /var -type f -size +10M -size -50M | head -5

4. Search by Modification Time

Find files modified within the last 24 hours:

find /etc -type f -mtime 0 | head -5

/etc/apt/sources.list
/etc/hostname
/etc/hosts

Find files modified more than 30 days ago:

find /var/log -type f -mtime +30 -name "*.gz"

/var/log/syslog.2.gz
/var/log/kern.log.3.gz
/var/log/auth.log.4.gz

File access time (-atime) and change time (-ctime) work the same way.

5. Search by Permissions

Find world-writable files (security risk):

find / -type f -perm -o+w -ls 2>/dev/null | head -5

1976041    0 -rwxrw-rw-   1 root     root            0 Jun 20 06:00 /tmp/test.sh

Find SUID binaries (run as owner regardless of who executes):

find /usr -type f -perm -4000 -ls

 32770 56 -rwsr-xr-x 1 root root 55552 May 15  2025 /usr/bin/passwd
 32820 40 -rwsr-xr-x 1 root root 39144 May 15  2025 /usr/bin/newgrp
 32784 60 -rwsr-xr-x 1 root root 59640 May 15  2025 /usr/bin/su
 32782 36 -rwsr-xr-x 1 root root 35000 May 15  2025 /usr/bin/sudo

6. Execute Actions with -exec

Remove all .bak files:

find /tmp -name "*.bak" -type f -exec rm {} \;

Count lines in all Python files:

find /home/projects -name "*.py" -type f -exec wc -l {} +

  125 /home/projects/src/main.py
   42 /home/projects/src/utils.py
   15 /home/projects/tests/test_main.py
  182 total

The + variant batches files together (like xargs), \; runs the command once per file.

7. Combining Conditions with -a (AND) and -o (OR)

Find large log files modified recently:

find /var/log -type f -name "*.log" -size +10M -mtime -7

/var/log/syslog
/var/log/kern.log

Find files that are either directories OR symlinks:

find /usr -type d -o -type l | head -5

/usr
/usr/bin
/usr/bin/python3
/usr/bin/python -> /usr/bin/python3

8. Prune Directories

Search for configuration files but skip .git and node_modules:

find /home/projects -type f -name "*.json" \
     -not -path "*/node_modules/*" \
     -not -path "*/.git/*" | head -5

/home/projects/package.json
/home/projects/tsconfig.json
/home/projects/.vscode/settings.json

9. Limit Search Depth

Search only the top level (no recursion):

find /etc -maxdepth 1 -name "*.conf"

/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf
/etc/ld.so.conf
/etc/logrotate.conf

Search exactly 2 levels deep:

find /home -maxdepth 2 -type d -name "Projects"

10. Find and Delete with Interactive Prompt

Find and interactively delete .tmp files:

find /tmp -name "*.tmp" -type f -ok rm {} \;

The -ok variant prompts before each action:

< rm ... /tmp/abc.tmp > ? y
< rm ... /tmp/xyz.tmp > ? n

Common Use Cases

Find and Compress Old Logs

find /var/log -name "*.log" -mtime +7 -exec gzip {} \;

Find Empty Files and Directories

find /home -empty -type f
find /home -empty -type d

Find Files with Most Recent Changes

find /home/projects -type f -printf '%T@ %p\n' | sort -rn | head -10

Find All Files Owned by a Specific User

find / -user alice -type f 2>/dev/null | head -10

Common Mistakes

1. Forgetting to Quote Wildcards

find . -name *.txt expands *.txt in the current shell before passing to find. Always quote: find . -name "*.txt".

2. Not Redirecting Error Output

Finding in system directories generates many “Permission denied” errors. Redirect: find / -type f 2>/dev/null.

3. Using -exec Without Terminating

-exec commands must end with \; (escaped semicolon) or +. Forgetting either causes a syntax error.

4. Confusing -mtime, -atime, -ctime

• -mtime: modification time (content changed)
• -atime: access time (file was read)
• -ctime: change time (metadata changed)

Practice Questions

1. How do you find all .jpg files larger than 5 MB?

find / -name "*.jpg" -type f -size +5M 2>/dev/null

2. What does find . -type f -empty do?

It finds all empty files (0 bytes) in the current directory and subdirectories.

3. How do you find files modified exactly 7 days ago?

find . -type f -mtime 7

4. What’s the difference between -exec {} \; and -exec {} +?

\; runs the command once per file. + batches files and runs the command once (like xargs), which is much faster for large numbers of files.

5. Challenge: Write a find command that deletes all .log files older than 90 days.

find /var/log -name "*.log" -type f -mtime +90 -exec rm {} \;

Mini Project: Disk Usage Cleanup Script

#!/bin/bash
# cleanup.sh — Find and summarize large files
# Usage: ./cleanup.sh /path/to/scan

SCAN_DIR="${1:-/home}"

echo "=== Disk Usage Analysis ==="
echo "Scanning: $SCAN_DIR"
echo ""

echo "Top 10 largest files:"
find "$SCAN_DIR" -type f -exec ls -lh {} \; 2>/dev/null \
    | awk '{print $5, $9}' \
    | sort -rh \
    | head -10

echo ""
echo "Files larger than 500MB:"
count=$(find "$SCAN_DIR" -type f -size +500M 2>/dev/null | wc -l)
echo "  Count: $count"

echo ""
echo "Temporary files older than 7 days:"
find "$SCAN_DIR" -type f \( -name "*.tmp" -o -name "*.bak" -o -name "*~" \) \
    -mtime +7 -size +1M 2>/dev/null | head -10

Expected output:

=== Disk Usage Analysis ===
Scanning: /home

Top 10 largest files:
1.2G /home/alice/videos/demo.mp4
890M /home/projects/data/dataset.csv
450M /home/alice/backup.tar.gz

Files larger than 500MB:
  Count: 2

Temporary files older than 7 days:
/home/alice/temp/output.tmp

FAQ

What’s Next

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.