Linux Find Command: Complete Guide with Practical Examples

The Linux find command is one of the most powerful and frequently used tools in a system administrator’s toolkit. It searches the filesystem recursively based on a flexible combination of criteria — file name, type, size, modification date, permissions, ownership, and more — and can execute actions on every matching file without a separate loop. Most users learn the basic name search and stop there, missing the majority of what find can do. This guide covers the complete command, from basic syntax to advanced combinations.

Basic find Command Syntax

The general structure of a find command follows this pattern:

find [starting_directory] [options] [expression]

Every element is optional. Running find alone searches the current directory recursively. Specifying a starting directory limits the search to that path and its subdirectories. Expressions are the conditions files must meet to appear in results.

Finding Files by Name

The most common use case is searching by filename:

find /home -name "*.txt"
find / -name "config.yaml"

The -name option is case-sensitive. For a case-insensitive match, use -iname:

find /etc -iname "*.conf"

Wildcards work exactly as in shell globbing. The * matches any number of characters, ? matches a single character, and character ranges like [abc] match any of the listed characters.

To search for a filename anywhere on the system, start from /:

find / -name "nginx.conf" 2>/dev/null

The 2>/dev/null suppresses “Permission denied” messages from directories your user cannot read.

Filtering by File Type

The -type option filters results to specific filesystem object types:

Type	Flag	Finds
Regular file	-type f	Text files, binaries, images
Directory	-type d	Folders only
Symbolic link	-type l	Symlinks only
Socket	-type s	Unix domain sockets
Block device	-type b	Hard drives, USB drives

Combining type filtering with name matching produces much more precise results:

find /var -type f -name "*.log"    # Log files only, not log directories
find /etc -type d -name "conf.d"   # Directories named conf.d

Searching by File Size

The -size option uses suffixes to specify units:

c — bytes
k — kilobytes (1024 bytes)
M — megabytes
G — gigabytes

find /var -type f -size +100M      # Files larger than 100 MB
find /tmp -type f -size -1k        # Files smaller than 1 KB
find /home -type f -size +1G       # Files larger than 1 GB

The + prefix means “larger than” and the – prefix means “smaller than.” An exact size (no prefix) matches files of exactly that size.

For disk cleanup purposes, sorting the output of find by size requires a pipeline:

find /var -type f -size +50M -exec du -h {} + | sort -rh

This lists all files over 50 MB with their sizes, sorted largest first. This approach is especially useful when investigating a filesystem that is filling up unexpectedly.

Finding Files by Modification Date

Time-based searching is powerful for incident response, log analysis, and identifying recently changed configuration files.

The -mtime option uses days as the unit:

find /etc -mtime -7              # Modified in the last 7 days
find /var/log -mtime +30        # Not modified in over 30 days
find /home -mtime 0             # Modified today

For minute-based precision, use -mmin:

find /tmp -mmin -60             # Modified in the last 60 minutes

The -newer flag compares modification time relative to another file:

find /etc -newer /etc/passwd    # Files modified more recently than passwd

This is useful after system changes to find every file affected by a configuration management run.

Finding Recently Modified Config Files

A common sysadmin task is identifying what changed after an incident. If the server started behaving oddly this morning:

find /etc /var /opt -type f -mtime -1 2>/dev/null

This searches the most common configuration directories for files modified in the last 24 hours, giving a clear list of candidates to investigate.

If you are managing a Debian server and want to track changes to configuration files as part of a post-installation audit, the Debian server setup guide covers the hardening steps where this kind of file tracking is most valuable.

Searching by Permissions and Ownership

find by Permission

The -perm option matches files with specific permission settings:

find / -perm 777 -type f 2>/dev/null      # World-writable files
find / -perm -4000 -type f 2>/dev/null    # SUID files
find / -perm -2000 -type f 2>/dev/null    # SGID files

The – prefix before the permission value means “at least these permissions.” So -perm -222 finds files where write permission is set for at least one user category.

Finding SUID binaries is an important security audit step — any unexpected SUID executable is a potential privilege escalation vector.

find by Owner

find /home -user alice           # Files owned by alice
find /tmp -group www-data        # Files owned by the www-data group
find / -nouser 2>/dev/null       # Files with no matching user in /etc/passwd

The -nouser and -nogroup flags identify orphaned files — useful after deleting a user account to clean up their files across the system.

Executing Commands on Found Files

The -exec option is what makes find genuinely powerful. It runs a command on every file that matches the search criteria:

find /tmp -type f -mtime +7 -exec rm {} \;

The {} is a placeholder for the matched filename. The ; terminates the -exec expression. This deletes every file in /tmp older than seven days.

For better performance with large numbers of files, use + instead of ; to pass multiple files to the command at once:

find /var/log -name "*.gz" -exec ls -lh {} +

This runs ls once with all matching files as arguments, rather than spawning a new ls process for each file.

Combining find with grep

The combination of find and grep locates files containing specific text strings — a task the grep -r flag also handles, but with less flexibility for filtering which files to search:

find /etc -type f -name "*.conf" -exec grep -l "max_connections" {} +

This searches only .conf files in /etc for the string “max_connections” and prints the filenames of matching files. This approach for how to find text in files is more targeted than a recursive grep across an entire directory tree.

The LEMP stack server environment benefits significantly from targeted configuration searches — the LEMP stack installation guide highlights several configuration files that are commonly edited during setup and where find combined with grep helps verify settings.

grep, sed, and locate: How They Compare to find

Understanding when to use find versus related tools prevents overcomplicating simple tasks.

The locate command is faster than find for simple name searches because it queries a pre-built database rather than scanning the filesystem in real time:

locate nginx.conf

The database updates nightly via updatedb. Files created since the last update will not appear in locate results. For current filesystem state, find is authoritative.

grep searches file contents, not names or attributes. The -r flag makes it recursive:

grep -r "ServerName" /etc/apache2

grep is faster than find + exec grep for simple content searches. find + exec grep is better when you need to filter by file attributes before searching contents.

The sed command in Linux is a stream editor for transforming file content, not for finding files. It reads input line by line and applies text transformations:

find /etc -name "*.conf" -exec sed -i 's/old_value/new_value/g' {} +

This combination — find to locate target files, sed to modify their contents — is a powerful pattern for bulk configuration changes across a server.

Practical find Command Examples Reference

The most useful one-liners collected in one place:

find /var -type f -size +100M — large files
find /etc -mtime -1 -type f — recent changes
find / -perm -4000 -type f 2>/dev/null — SUID binaries
find /home -name “.bash_history” — user history files
find /tmp -type f -mtime +7 -delete — clean old temp files
find / -nouser -o -nogroup 2>/dev/null — orphaned files
find /var/log -name “*.log” -size +500M — oversized logs

The best 32-bit Linux distros guide mentions that disk management and file organization are even more critical on hardware with limited storage — the find command’s ability to locate large files and clean up orphaned data makes it especially valuable on resource-constrained systems.

find is one of those commands that rewards investment in learning. The more options you know, the more precisely you can express what you are looking for — and the less time you spend manually navigating directory trees or writing loops to process files one at a time.