Linux

Locate files with the find tool


The find tool is another Linux gem that allows you to search for files based on a number of criteria including name, file size, modification date, etc. Using find will help you locate files that would otherwise take time to locate manually.

In its most basic form, find can print every file on the system:

$ find /

 

This would print out a list of every file. To search for a particular file name, use:

$ find / -name passwd
/usr/bin/passwd
/usr/sbin/passwd
...

To search for files named passwd that have mode 0700 permissions:

$ find / -name passwd -perm 0700
/usr/sbin/passwd

If you wanted to find all files that were setuid root, you would use:

$ find /usr -perm 4755 -user root

If you wanted to clean all files from /tmp, but leave directories intact, you could use:

# find /tmp -type f -exec rm -f {} \;

This command looks for files of type f (regular file) and executes the command rm -f on each file (noted by {}). The command passed to -exec must be terminated with backslash, semicolon (\;). If, however, you wanted to find and delete only your files:

$ find /tmp -type f -user `whoami` -exec rm -f {} \;

This will only delete files belonging to the user executing the command.

If you want to search in the current directory and below, use a period (.) for the path. If you want to look for a file that was created after another file, use:

$ find . -cnewer somefile.txt

This will find and print out a list of all files created after somefile.txt.

Finally, if you want to search the current directory and below for any files changed in the last 30 days but that do not contain the string .svn and list the files:

$ find . -type f -ctime -30 -not -regex '.*svn.*' -exec ls {} -al \;

Here, a number of things are specified: any files that are of type f, that have a creation time of 30 days or less, but do not match the regular expression .*svn.* are then fed to ls as ls [file_match] -al. This also illustrates that the match characters ({}) do not have to be at the end of the command. Or, you could use the -print option instead of calling ls:

$ find . -type f -ctime -40 -not -regex '.*svn.*' -print

The find command is very powerful and there are a number of options and tests that can be performed to find certain types of files that match any number of specified criteria.

Delivered each Tuesday, TechRepublic's free Linux NetNote provides tips, articles, and other resources to help you hone your Linux skills. Automatically sign up today!

About

Vincent Danen works on the Red Hat Security Response Team and lives in Canada. He has been writing about and developing on Linux for over 10 years and is a veteran Mac user.

12 comments
javabuddy
javabuddy

I recently found good examples of unix find commands , easy to use and explained with clear example. something I have been looking for unix find in last few days. Some of example of find command is bit old but they are still effective.

bluesrenegade
bluesrenegade

I use the find command a LOT! The temptation of new Linux users is to use Search via a GUI file manager, which I've found to be painfully slow compared to the find command. A few tips to add here: 1) Always surround the search text between single quotes (NOT double quotes!). 2) An often overlooked option is -ls as the last option, instead of -print (the default). Finding files without knowing where they're located is many times useless, so use -ls to see the complete path, the permissions and more. The -ls option gives a long listing; the same as you'd see with the ls -l command.

DanLM
DanLM

You can find files created after a specific date/time. Ie: Age of file since either creation or modification. You can find files over a specific size. Looking for files that has filled a partition or blew out a user quota all of a sudden? This would be a perfect example of using the find. You can find directories.(use this alot in the freebsd ports collection when I can't remember where the port is at). You demonstrated executing specific commands with the find once a file has been found. combining the time with lookup (modification date) and the execution of other commands(rm), you can keep your /tmp files cleaned up. Like I said, find is one of my favorite commands. Dan

qqr
qqr

Being a bit new to this I probably doing something wrong, this is also on Solaris rather than Linux, but I assume it should be similar. I was trying to use find and grep the other day to look for a word in all files within a directory and sub directories. But had trouble getting it to work. Command was grep -li management `find . -type f` > /tmp/latfile.lst Result is ksh: /bin/grep: arg list too long Any help would be appreciated, thanks.

DanLM
DanLM

find . -exec grep "www.athabasca" '{}' \; -print This is an example from here: http://www.athabascau.ca/html/depts/compserv/webunit/HOWTO/find.htm In your case, I would try something like: find . -type f -exec grep "management" '{}' \; This should search all files in current directory, grep those files for the word management and print them. Dan

qqr
qqr

Exactly what I needed.

DanLM
DanLM

Sorry, missed that when I was doing the man last night on the grep. It's cleaner then what I got too. Dan

Styopa
Styopa

find . -type f -exec grep -l management {} \;

qqr
qqr

Now my brain is spinning! The -H option is not valid on this OS. It will list the count fine. I will have a bit of a play with it over the next day or so. Thanks again for your help.

DanLM
DanLM

find . -type f -exec grep -Hc "idiot" '{}' \; | grep -v ":0" This was performed in a high level script directory where I developed a firewall script called idiotblocker. This is what it listed off. ./CVS/Repository:1 ./CVS/Entries:2 ./ChangeLog:5 ./README:14 ./check.txt:3 ./idiotblocker.sh:34 ./ManualUpdate.sh:5 ./FTP-idiotblocker.pl:6 ./FTP-idiotblocker.pl-bk20061030:2 ./BruteForceCheck.sh:5 ./PerlVersion/idiotblocker.pl:8 ./PerlVersion/idiotconfig.pl:1 ./PerlVersion/test.pl:2 ./PerlVersion/idiotblocker_20070822Works.pl:8 ./PerlVersion/idiotblockerbkup.pl:4 ./ExternalBlacklist.sh:2 ./idiotblocker_non.sh:34 What your seeing is the path with a number on the end showing the number of times the verb appears in the file. What is occurring is. 1). Find is actually listing off all files, but it is showing a numeric at the end showing the number of occurrences of the text specified in the find grep option. Lots of 0 counts appeared. 2). This output is then directed to another grep which via the -v option prints every line from the previous command that does not have :0 Will this work? Dan

qqr
qqr

Thanks Dan for taking the time to reply, that worked fine. I didn't however explain very well what I was looking for. Rather than returning the actual text with the word searched for, how would I just get the file name that contains the search criteria? I thought the -name switch with find would give me the answer, but again I am struggling to get the syntax right.

Editor's Picks