How to Use the “Find” Command on Linux

The “find” command in Linux is more than what meets the eye. On the surface, it’s a simple way to search for files and folders. But once you understand its power, you’ll see that it can be used for more than that. First I’ll show you how to use its basic functionality, and then we’ll see how to use it for more complicated scenarios.

Finding Files with the find Command

If you want to search for files or folders in a certain location, you use a command like this:

find /home/user/Documents -name "myfile.txt"

The above command will search for “myfile.txt” in the location specified – /home/user/Documents. Because we haven’t specified the type of items we’re searching for, it will search for both files and folders. The “-name” parameter is where you specify the name of what you’re searching for. Without this, the command will return a list of all files and folders in the directory and subdirectories.

Here’s a list of the most useful parameters:

-name “filename.txt”

As mentioned above, if you want to search for a specific file or directory, you must use the ‘-name” parameter. By default, “find” will search for an exact match of what you provide. You can however, use wildcards to expand the search. For example, if you want to find all files with the “txt” extension, you can use “*.txt” instead. Or if you want to match a single character, you can use the question mark (?) wildcard.

“-type f” OR “-type d”

The “-type” parameter is used to narrow down your search if you’re looking for only files or directories. “-type f” searches for files, whereas “-type d” searches for folders. If you omit this parameter, the command will search for both.

“-size +100M”

You can search for files above a certain file size using the “find” command. This is a lot

more useful than it looks. When you’re running low on space, you can find and sort files above a certain size, and obtain the maximum bang for your buck by eliminating the biggest files causing problems. This is such a cool functionality, that I’ve written a separate article on finding large files in Linux.

“-mtime 7”

The “-mtime” parameter lets you filter files that have been modified more, less, or exactly equal to a certain number of days. Here’s a breakdown:

-mtime 7 = searches for files modified exactly seven days ago
-mtime +7 = searches for files modified more than seven days ago
-mtime -7 = searches for files modified less than seven days ago

The “mtime” parameter works in 24-hour increments. It’s useful when combined with other parameters. For example, you can search for all log files that were modified in the past day to get a list of all the things that have changed since you last checked in. You can also use it to monitor updates to a project within a certain time frame to get a quick idea of what’s changed if you don’t have access to a version control system.

If you want, you can even mix two conditions. For example:

find /path/to/directory -mtime +2 -mtime -6

This will list all files modified between 3 and 5 days ago.

Where Does “find” Search

Most of the time, it’s only useful to use the “find” command in conjunction with a location in which to search. Without this parameter, the command will search in the current directory and subdirectories.

You can theoretically find all files on the system by specifying the root directory in your command like this:

find / -name "filename"

But this will take a huge amount of time on a large system. Ideally, you want to restrict your “find” command to as narrow a location as possible.

Using “locate” Instead

Since the “find” command conducts searches in real-time, it can take a while for it to find what you want, particularly on large file systems, which is why we recommend that you narrow down your location search as much as possible. However, if you want to search the entire disk because you don’t know where to find something, you can use the “locate” command, instead.

Locate is somewhat similar to “find”, but instead of conducting the search in real-time, it searches a constantly updated index that runs on a period basis, and is much faster since the “searching” has already been done, so to speak. Using locate is easy and looks like this:

locate file.txt

As you can see, just use the name of the file and locate will search its index and give you the results almost immediately, no matter where the file is located. Note that there’s no need to specify the approximate location of the file or folder since it doesn’t matter. If it’s there in the index, locate will show you the result immediately.

The locate command uses the “updatedb” to update the index – usually on a daily basis. You can check and see the frequency by searching the cron folder like this:

ls /etc/cron.daily/

You should see either “plocate” or “mlocate” as shown here:

I’d written an earlier article on how to list the cron jobs in Linux so consult that if you also want to see the cron jobs for weekly monthly periods.

Advantages of “find” Over “locate”

With all the benefits of the locate command, let’s consider why we would ever use the “find” command. There are several reasons.

First of all, the “locate” command is only as good as its index. If the index is out of date, then it won’t find files that have been added since the last update. In other words, if you’re looking for fresh data, then the “find” command is better than “locate”.

Second, “find” has advanced search options that aren’t available with “locate”. As we’ve seen, we can use “find” to obtain files that fit a certain size criteria or files that were modified within a certain time. All these criteria are useful in many situations, whereas with “locate”, you can only search by file or folder name.

“Find” Allows you to Execute Actions

One of the most powerful uses of “find” is its ability to take the output of “find” and pipe it to an “exec” command, letting you perform actions for each file one by one. This is incredibly powerful, and greatly expands the range of uses of the tool. Here’s the syntax:

find /path/to/search -name "pattern" -exec command {} \;

Replace “command” with the command you want to use for each file. Like this:

find /path/to/search -name "*.log" -exec rm {} \;

The above command will delete all files in the search path that have the “log” file extension. Remember that this also applies to files in the subdirectories of the path, showing you how valuable such a tool can be.

Here’s another example:

find /path/to/search -name "*.sh" -exec chmod 755 {} \;

The above example searches for all script files and then changes their permissions so as to make them executable. The use of the find command when combined with the “exec” command expands its utility far beyond mere search tools like “locate”, even though the latter is faster.

Conclusion

While “find” might seem like a very basic command, its power lies in its versatility. With its search parameters allowing you to iterate over files meeting size, modifications, and permissions criteria, as well as the ability to execute commands for each file found, its place in Linux’s repository of tools is sealed, even though other commands like “locate” are faster when it comes to raw search capability.