How to Use the find Command on Linux with Examples

In this tutorial, you'll learn about How to Use the find Command on Linux with Examples. We cover key concepts, practical examples, and best practices.

The Problem

You need to find files on a Linux system but can't remember where they are. The system has thousands of files across nested directories. The find command searches the filesystem in real time, supporting filters by name, size, modification time, file type, and permissions. Unlike locate (which uses a pre-built database), find always returns current results and can execute actions on matched files.

Quick Fix

1. Find by name

find /var/log -name "*.log"

Expected output:

/var/log/syslog
/var/log/auth.log
/var/log/nginx/access.log

The -name flag uses a case-sensitive glob pattern. Use -iname for case-insensitive search.

2. Find by type (files only or directories only)

# Files only
find /home/user -type f -name "*.txt"

# Directories only
find /etc -type d -name "*nginx*"

# Symbolic links
find /usr/bin -type l -name "python*"

3. Find by size

# Files larger than 100MB
find / -type f -size +100M

# Files smaller than 1KB
find . -type f -size -1k

# Files exactly 1MB
find . -type f -size 1M

Size units: k (kilobytes), M (megabytes), G (gigabytes). Prefix + means greater than, - means less than.

4. Find by modification time

# Files modified in the last 7 days
find /etc -type f -mtime -7

# Files modified more than 30 days ago
find /var/log -type f -mtime +30

# Files accessed in the last hour
find /home -type f -amin -60

-mtime is modification time in days, -amin is access time in minutes.

5. Execute a command on each found file

# Delete files (use with extreme caution)
find /tmp -type f -name "*.tmp" -delete

# Or with exec
find /tmp -type f -name "*.tmp" -exec rm {} \;

The {} is replaced with the matched filename. The \; terminates the command. Use + instead of \; to batch multiple filenames into a single command execution.

6. Combine multiple conditions

# Large log files modified in the last day
find /var/log -type f -size +10M -mtime -1

# OR condition
find /home \( -name "*.jpg" -o -name "*.png" \) -type f

The \( and \) group conditions. The -o is the OR operator. Use -a for AND (implicitly between conditions).

7. Limit search depth

# Search only the current directory (depth 1)
find . -maxdepth 1 -name "*.md"

# Search up to 3 levels deep
find / -maxdepth 3 -type f -name "docker-compose.yml"

8. Find files by permissions

# World-writable files (security risk)
find / -type f -perm -o+w

# Setuid executables
find / -type f -perm -4000

# Files readable by everyone
find /home -type f -perm /o=r

Permission-based searches are useful for security audits and finding misconfigured files.

Prevention

• Always use a restrictive path (. or specific directory) to avoid scanning the entire filesystem
• Use -maxdepth to limit search scope in large directory trees
• Test with -exec echo before running -delete or -exec rm
• Use -type f to exclude directories unless you need them
• Use -mtime with a reasonable window to avoid listing every file
• Combine -perm with -type f for security audits of world-writable files