Linux Find Command: Searching Directories Explained

The find command in the Linux operating system is a powerful utility designed to walk directory hierarchies recursively, searching for files and folders that match specific, user-defined criteria. This article explains the primary functions of the find command, details how it evaluates directory trees in real-time, highlights its most common filtering criteria—such as file names, sizes, permissions, and timestamps—and demonstrates how to execute automated actions on the search results.

Real-Time Directory Traversal

Unlike indexing utilities such as locate, which query a pre-built database, find dynamically scans the live filesystem starting from a designated directory. It descends through subdirectories recursively, evaluating every file system object it encounters against the conditions supplied in the command line.

Basic Syntax

The standard structure for executing the find command is:

find [starting_point] [options] [search_criteria] [action]

• Starting point: The path where the search begins (e.g., /home, /var/log, or . for the current directory).
• Options: Flags that govern how directories are read, such as handling symbolic links or limiting directory depth.
• Search criteria: Tests used to match files (e.g., name, size, type).
• Action: What to do with the matches (default is -print, which displays the path to the screen).

Core Search Functions

1. Searching by Name and Type

The command allows users to isolate items based on their names or filesystem type.

• Filter by name: Use -name (case-sensitive) or -iname (case-insensitive).

  find /var/www -name "index.html"

• Filter by file type: Use -type to separate directories (d), regular files (f), or symbolic links (l).

  find /etc -type d

2. Searching by File Size

You can locate files based on storage thresholds using -size with units like k (kilobytes), M (megabytes), or G (gigabytes). Prefixes like + (greater than) and - (less than) define the range.

find /home -type f -size +100M

3. Searching by Timestamps

The find command tracks three timestamps: access time (-atime), modification time (-mtime), and metadata change time (-ctime).

• To locate files modified within the last 7 days:

  find /var/log -type f -mtime -7

• To locate files modified more than 30 days ago:

  find /tmp -type f -mtime +30

4. Searching by Permissions and Ownership

Systems administrators frequently use find to detect security misconfigurations by evaluating ownership and access modes.

• By owner: -user username
• By permissions: -perm 777 (exact match) or -perm -644 (has at least these permissions).

  find /home -user john -perm 644

Controlling Search Depth

To prevent long execution times or excessive resource usage on large storage volumes, the search depth can be bounded:

• -maxdepth N: Specifies the maximum number of directory levels to descend.
• -mindepth N: Ignores matches above the specified level.

find / -maxdepth 2 -name "*.conf"

Performing Actions on Discovered Files

Beyond locating directories and files, find can manipulate the results directly:

• Delete matches: The -delete flag removes matched files automatically.
• Execute commands: The -exec flag runs an arbitrary Linux command on each result. The syntax {} represents the current file path, and \; terminates the command.

find /tmp -type f -name "*.tmp" -exec rm -f {} \;