Mastering the Linux ‘find’ Command: Tips, Syntax, and Powerful Examples

Introduction

find command is a commonly used Linux command that can greatly improve efficiency when searching files. This article addresses common questions about find.

Command Basics

The basic syntax of find consists of three parts: the command itself, the search path(s), and the expression.

<code>find /etc -name 'passwd'</code>

Multiple paths can be specified:

<code>find /etc /var /usr -name 'passwd'</code>

The expression part determines which files are matched and can include tests, actions, global options, and positional options.

Expression Types

Four main expression types:

Tests – conditions based on file attributes.

Actions – operations performed on matched files.

Global options – overall search constraints such as depth.

Positional options – conditions related to the location of the search.

Tests

Tests filter files by attributes such as time, user, permissions, and path.

Time‑based tests

+n means greater than n, -n means less than n, n means equal to n.

Examples:

<code># find / -mtime 7 -ls</code>

Find files modified exactly 7 days ago.

<code># find / -mtime -7 -exec ls -tld {} \+</code>

Find files modified within the last 7 days.

Other time tests: -ctime, -atime, -mmin, -amin, -cmin.

File‑to‑file time comparison:

<code># find /etc -anewer /etc/passwd</code>

User and group tests

<code>-uid n
-user name
-gid n
-group name
-nogroup
-nouser</code>

Permission tests

<code>-executable
-readable
-writable
-perm mode</code>

Path tests

<code>-name pattern
-iname pattern
-lname pattern
-ilname pattern
-path pattern
-ipath pattern
-regex pattern
-iregex pattern</code>

Other tests

<code>-empty
-size n[cwbkMG]
-inum n
-links n
-samefile name
-type c</code>

Actions

Actions perform operations on matched files.

<code>-ls
-fls file
-print
-print0
-fprint file
-fprint0 file
-delete
-printf '%p '
-prune
-quit</code>

Executing commands

The -exec and -execdir options run external commands on each matched file.

<code># find /etc -name 'passwd' -exec echo {} \;</code>

Use {} as a placeholder for the file name. The + form groups files:

<code># find /etc -name 'passwd' -exec echo {} +</code>

Safer alternatives -ok and -okdir ask for confirmation before executing.

Operators

Operators combine multiple expressions.

<code># find /etc -name 'pass*' -type f   # logical AND (default)
# find /etc -name 'pass*' -o -type f   # logical OR</code>

Negation with ! or -not, grouping with parentheses.

Additional useful options

-depth

-maxdepth n

-mindepth n

Refer to the man page for more parameters.