Linux find command basic tutorial

The Linux find command is perhaps the most powerful command for finding files in the Linux system. However, it is quite complicated. For a Linux beginner, first they need to understand the command's expressions before they can properly use the command. This tutorial will help a new Linux user to understand the basic expressions through simple examples.

Here are some important basic Linux find command's expressions that a Linux beginner should notes:

  • -print - Produce output.
  • -name - Matches filename based on the pattern provided.
  • -perm - Find files with certain permission.
  • -type - Find files with special file type.
  • -size - Find files based on file size.
  • -atime, ctime, mtime - Find files based on file times.
  • -exec - Executing command.

Linux find command's expressions example

Originally, the find command does not produce output by itself. You need to include the '-print' expression to creates output or print output to the screen. For example, the command 'find . -print' will create output of the current directory's files and folders paths to the screen. But now you can get the same output by just invoking the 'find' command alone. It's because if no expression is given, the expression -print is used.

The '-name' expression is used to find file matches the pattern that we provide as an argument to the expression. A simple example is to provide the name of the file as an argument such as 'find . -name tutorial', where the tutorial is the argument. We can also use wildcard with ordinary characters to find files easier. Here are the wildcard patterns explanation:

  • ? - Matches any single character.
  • * - Matches multiple characters.
  • [] - Matches any single character in the bracket.

Here is an example of Linux find command with -name expression:

kkcjlab@kkcjlab-server:~$ find . -name *[Aai]dm?n

The Linux find command above will print all files that have 'Admxn', 'admxn' or 'idmxn' characters in the pattern mentioned (the [Aai] did this). The 'x' character can be any ordinary character because we used the '?' wildcard which will matches any single character. The asterisk(*) means to accept any characters match before the pattern.

The Linux find's -perm expression is used to find files with certain permission. For example, we can find all world writable files using the following syntax:

kkcjlab@kkcjlab-server:~$ find /home/kkcjlab/backup -perm -0002

Another important Linux find's expression is the -type expression which can be used to find files with special file type. Here is an example of -type expression's usage:

kkcjlab@kkcjlab-server:~$ find /home/kkcjlab -type d -perm -0002

The -type d flag represents directory. If you want to search for files, use f flag.

The next Linux find command's expression is the -size expression. The -size expression is useful when we want to find files with specific size. What we have to do is give a size file number in k, M or G after the -size expression. See an example below:

kkcjlab@kkcjlab-server:~$ find Documents/basicconfig/ -size +100k


‘k’ - for Kilobytes (units of 1024 bytes)
‘M’ - for Megabytes (units of 1048576 bytes)
‘G’ - for Gigabytes (units of 1073741824 bytes)

Basiccally, there are three expressions that you can use with Linux find command to check timestamps stored in a file. Those expressions are -atime, -ctime and -mtime.

-atime n
File was last accessed n*24 hours ago. When find figures out
how many 24-hour periods ago the file was last accessed, any
fractional part is ignored, so to match -atime +1, a file has to
have been accessed at least two days ago.

-ctime n
File’s status was last changed n*24 hours ago. See the comments
for -atime to understand how rounding affects the interpretation
of file status change times.

-mtime n
File’s data was last modified n*24 hours ago. See the comments
for -atime to understand how rounding affects the interpretation
of file modification times.

Here are examples of Linux find command's syntax using -atime, -ctime and -mtime expression to search for files based on time:

kkcjlab@kkcjlab-server:~$ find Documents/basicconfig/ -atime +364

The Linux find command above shows files that haven't been accessed more than a year in the basicconfig directory.

kkcjlab@kkcjlab-server:~$ find Documents/basicconfig -ctime -7

The Linux find command above shows files in the given directory that had status change in one week.

kkcjlab@kkcjlab-server:~$ find Documents/basicconfig -name linux* -mtime -3

The Linux find command above shows how to find files older than 3 days.

Now the final Linux find command's expression that we are going learn is the -exec expression. The -exec expression is used to run or execute a Linux command. For example, we want the Linux find command to search for some backup files that no longer needed and delete them when each file is found.

kkcjlab@kkcjlab-server:~$ find Documents/basicconfig -name linux*.php~ -mtime -7 -exec rm {} \;

That's all. All examples and expressions above are some basic Linux find command's usage. There are so many things that you can do with the command. This tutorial is just an introduction to the Linux find command. With the basic knowledge, you can read find command's manual to learn other expressions and what else the command can do.



How would I use the find command to search for a directory with Myth II as the directory name?

Add new comment