Using the find Command

find

The find command, unlike locate, performs a live search of your file system. It is very versatile, and can search by filename, owner, last modified time, and other criteria. Its syntax is:

find starting_directory –criteria search_string

The starting directory can be any location, with a relative or absolute path. In other words, /etc will get you to /etc, ../ will take you up one directory, mydirectory/ is a subdirectory, . is the current directory, and so forth, exactly as you’re accustomed to doing.

Criteria can be a user’s name, the file name, and more:

find Criteria
Criteria	Description	Usage
-name	Search for files by their file name Note that wildcards can be used	find . -name *txt
-user	Search for files by their owner’s name or UID	find . -user root find . -user 0
-group	Search for files owned by group	find . -group games find . -group 60
-type	Search for files of type: b block c character d directory p named pipe f regular l symlink s sockets	find . -type b
-size x -size -x -size +x	Search for files of size Search for files smaller than size x Search for files larger than size x Size can be in k, M or G (among others) k is assumed	find . -size 512 find . -size -512k find . -size +512M
-amin +x -amin -x	Search for files accessed more than x minutes ago Search for files accessed less than x minutes ago	find . -amin -5 find . -amin +10
-atime +x -atime -x	Search for files accessed more than x days ago Search for files accessed less than x days ago	find . -atime -5
-mmin +x -mmin -x	Search for files modified more than x minutes ago Search for files modified less than x minutes ago	find . -mmin +5
-mtime +x -mtime -x	Search for files modified more than x days ago Search for files modified less than x days ago	find . -mtime +5
-empty	Search for empty files and directories	find . -empty
-regexp	Search for files using regular expressions rather than filename wildcards	find . -regexp [Aa]dmin
-remove-files	Removes files after tarring them; use with caution!

For example:

Find owned by a particular user:
find /var -user root
Will find every file under the directory /var owned by the user root.

find /bin -name *.sh
Will find every file under the directory /bin ending in “.sh”.

find /var/spool -mtime +10
Will find every file in /var/spool last modified more than 10 days ago.

 

Now’s a good time to take a look at the idea of Order of Operations. You’re going to need it to understand something about using wildcards with the find command. Newer versions of find have no trouble with:

find /etc -name host*

Older versions, however, will hiccup over the wildcard, because the shell will “get to” the wildcard, and interpret it, before the find command is run. You have to quote the wildcard for things to work right:

find /etc -name “host*”

 

Finally: never be reluctant to run man find.