Introduction
The find command is one of the most powerful and versatile tools offered by the Linux shell for locating files and directories according to various criteria. Unlike simpler options such as ls or locate, find allows applying filters by name, type, size, modification date, permissions, and much more, in addition to executing actions on the found results.
Basic Syntax
The general form of the command is: find [path] [expression]. The path indicates the starting point of the search; if omitted, find assumes the current directory. The expression consists of tests and actions that are evaluated from left to right. For example, find /home -name ‘*.txt’ searches for all files with a .txt extension within /home and its subdirectories.
Search by Name
One of the most used tests is -name, which accepts a pattern with shell wildcards such as * and ?. To make the search case‑insensitive, use -iname. For example, find /var/log -iname ‘*error*’ locates any file containing the word error regardless of case.
Search by Type
The -type test allows filtering according to file type. The most common values are f for regular files, d for directories, l for symbolic links, b for block devices, and c for character devices. A typical example is find /etc -type d -name ‘*.conf’ to find directories whose name ends in .conf, although directories normally do not have an extension; this example shows the combination of tests.
Search by Size
With -size you can locate files whose size meets a condition. The number can be followed by suffixes: c (bytes), w (two‑byte words), k (kilobytes), M (megabytes), G (gigabytes). The + sign means greater than, – means less than, and no sign means exactly that size. For example, find /home -size +100M finds files larger than 100 megabytes, while find /tmp -size -10k locates those smaller than 10 kilobytes.
Search by Modification Date
The -mtime, -atime, and -ctime tests measure time in days since the last modification, access, or status change, respectively. Using -mtime -7 finds files modified in the last seven days, -mtime +30 those modified more than thirty days ago. You can also use -mmin and -amin to work with minutes instead of days.
Using Logical Operators
Find allows combining tests with the logical operators AND (-a, implicit by default), OR (-o), and NOT (-not or !). For example, find /opt -type f \( -name ‘*.log’ -o -name ‘*.bak’ \) -size +1M locates regular files that are either .log or .bak and exceed one megabyte. Parentheses must be escaped or quoted so the shell does not interpret them.
Executing Actions with -exec
One of the most useful features is the ability to run a command on each result via -exec. The syntax is -exec command {} \; where {} is replaced by the path of the found file and \; terminates the instruction. For example, find . -name ‘*.tmp’ -exec rm {} \; deletes all temporary files in the current directory and its subdirectories. If you prefer to confirm before deleting, you can use -ok instead of -exec.
Combined Examples
Suppose we want to locate all PDF files larger than 5 MB that have been modified in the last ten days and compress them with gzip. The command would be: find /documentos -type f -name ‘*.pdf’ -size +5M -mtime -10 -exec gzip {} \;. Another common situation is searching for broken symbolic links: find / -type l -! -exec test -e {} \; -print.
Tips and Tricks
To prevent find from traversing filesystems you don’t want, you can use -xdev to stay within the same filesystem. When the output is long, redirecting it to a file or paging it with less improves readability: find /usr -type f -name ‘*.conf’ 2>/dev/null | less. Furthermore, combining find with xargs allows processing batches of files more efficiently: find . -type f -name ‘*.csv’ -print0 | xargs -0 wc -l.
Conclusion
Mastering the find command gives system administrators and advanced users precise control over locating and manipulating files in Linux. Its flexibility allows everything from simple searches to complex scripts that automate maintenance, auditing, and backup tasks. Practicing with the various tests and operators is the best way to incorporate this tool into your daily workflow.
This post is also available in ESPAÑOL.