Find command examples
The find can be used to find files and directories and perform subsequent operations on them. It supports searching by file, folder, name, creation date, modification date, owner and permissions.
When used with the -exec flag, other UNIX commands can be executed on files or folders found.
Syntax
The basic syntax of the find commands looks like:
find <location> <comparison-criteria> <search-term>
For example:
# find /data -type f -name foo.bar
Basic find commands
| find / -type f -name foo.bar | find file foo.bar in all dirs from root downwards. |
| find / -name foo.bar | find file/dir foo.bar in all dirs |
| find . -name foo.bar | search under current directory |
| find . -name "foo.*" find . -name "*.bar" | search with wildcards |
| find /home/alex -type d -name tmp | search /home/alex for directory tmp |
Search ignoring case
| find . -iname "FooBar" | find foobar FOOBAR fOoBaR fooBAR, etc.. |
| find . -type f -iname "FooBar" | same search but files only |
| find. -type d -iname "FooBar" | same search but directories only |
Inverting the match
To find files that don't match a pattern use the -not switch
| find / -not -iname "FooBar" | find all except foobar FOOBAR fOoBaR fooBAR, etc.. |
| find . -type f -not -name "*.html" | find all files except with .html extn |
Find files by size
Use the -size switch + for greater than or - for lesser than
| find / -type f -size +100M | find files bigger than the given size |
| find . -type f -size -100M | find files smaller than the given size |
| find /data -type f -size 100M | find files that match the exact given size |
Find files with multiple extensions
| find . -type f \( -name "*.htm" -o -name "*.html" \) -print | find all *.htm and *.html files |
| find . -type f \( -name "*.sh" -o -name "*.ksh" -o -name "*.csh" \) -print | find all *.sh, *.ksh and *.csh files |
Find files based on time
You can find files based on following three file time attribute.
- Modification time of the file. Modification time gets updated when the file content modified.
- Access time of the file. Access time gets updated when the file accessed.
- Change time of the file. Change time gets updated when the inode data changes.
| find . -mtime 1 | files modifed within last 24 hours |
| find . -mtime -7 | modified in last 7 days |
| find . -mtime -7 -type f | files modified in last 7 days |
| find . -mtime -15 -type d | directories modified within last 14 days |
Find files modified/accessed/changed after modifying a reference file
| find . -newer /etc/passwd | files modified after |
| find . -anewer /etc/hosts | files accessed after |
| find . -cnewer /etc/fstab | files changed after |
| find . \! -newer filename \! -samefile filename | To avoid matching on the file you are comparing against |
Search only current filesystem
Use -xdev switch to not descend directories on other filesystems
| find / -name "*.log" | will search all file systems from / |
| find / -xdev -name "*.log" | will search only / and not other mount points under / |
Using -exec
Using the find command with -exec allows other UNIX commands to be executed on files or folders found. For example:
| find . -name "*.txt" cp {} {}.bak \; | find and copy all .txt files to .bak |
| find /www-data -name "*.html" -type f -exec chmod 644 {} \; | Change all html files to mode 644 |
| find /www-data/cgi-bin -name "*.cgi" -type f -exec chmod 755 {} \; | Change all cgi files to mode 755 |
| find . -type f -name "*.tmp" -exec rm {} \; | Find and remove all .tmp files |
Finding files that contain text (find + grep)
| find . -type f -exec grep -l hello {} \; -print | list all files containing hello |
| find /www-data/app/ -name "*.php" -exec grep "debug (" {} \; -print | recursively search php files and grep for debug |
Misc find examples
| find -name "*.txt" 2>/dev/null | redirecting errors to /dev/null |
| find . -type f -iname “*.mp3” -exec mv “s/ /_/g” {} \; | substitute space with underscore in the file name |
| find . -perm -g=r -type f -exec ls -l {} \; | display files with group read-only permissions |
| find / -maxdepth 3 -name passwd | Limit search to specific directory level |
| find . -mmin -60 -exec ls -l {} \; | Long list files where were edited within last hour |
| find / \( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \ \( -size +100M -fprintf /root/big.txt '%-10s %p\n' \) | traverse the filesystem just once, listing setuid files and directories into /root/suid.txt and large files into /root/big.txt |
| find ./dir1 ./dir2 ./dir3 -type f -name "*.doc" | search multiple directories together |
| find . -user martin -name "*.odt" | find all openoffice writer documents owned by martin |
To summarise, the find options are endless. Review the find(1) man page for more examples.