Linux find Command with xargs: Search Files by Name, Size, Time and Run Actions

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: cleaning a messy cupboard

Why do we need this?

Shalini cleans her big cupboard before Diwali. She looks for: everything named 'bill', only boxes (not papers), things heavier than 5 kg, things not touched for a year, and things that belong to her brother. Then for each old bill she does the same action: put it in the recycle bag. Her son helps by taking a whole pile at once instead of one by one.

What is it?

Named bill = -name. Only boxes = -type d. Heavier than 5 kg = -size +5G. Not touched for a year = -mtime +365. Brother's = -user. Same action on each = -exec. Son taking a pile = xargs (many items per command).

How to do it (step by step)

2. find by name: -name, -iname, -path

Why do we need this?

You know part of a file name but not where it is.

What is it?

find START -name 'pattern' matches the file name with shell wildcards (* ? [ ]). Always quote the pattern so the shell does not expand it first. -iname ignores case. -path '*/conf.d/*' matches the full path. -regex uses a regex on the whole path. Send errors away with 2>/dev/null.

How to do it (step by step)

1. Find a file by exact name.

find /etc -name 'nginx.conf' 2>/dev/null

Output:

/etc/nginx/nginx.conf

What it means: 2>/dev/null hides Permission denied noise.

2. All .log files under /var/log.

find /var/log -name '*.log' | head -3

Output:

/var/log/dnf.log
/var/log/nginx/access.log
/var/log/nginx/error.log

What it means: Quotes keep *.log for find.

3. Ignore case.

find ~/Downloads -iname '*invoice*'

Output:

/home/ravi/Downloads/Invoice-Oct.pdf
/home/ravi/Downloads/invoice_amazon.pdf

What it means: Matches Invoice and invoice.

4. Match on the path.

find /etc -path '*/conf.d/*.conf'

Output:

/etc/nginx/conf.d/shop.conf
/etc/httpd/conf.d/ssl.conf

What it means: Only .conf files inside any conf.d folder.

5. Several names with OR.

find . \( -name '*.jpg' -o -name '*.png' \) | wc -l

Output:

342

What it means: \( \) groups, -o is OR.

3. find by type: -type f, d, l

Why do we need this?

You want only folders, or only regular files, or only symlinks.

What is it?

-type f regular file, d directory, l symlink, s socket, p named pipe, b/c device files. -xtype l with broken links. -empty finds empty files or folders.

How to do it (step by step)

1. Only folders.

find /srv/app -maxdepth 1 -type d

Output:

/srv/app
/srv/app/releases
/srv/app/shared

What it means: -type d means directory.

2. Only files, counted.

find /etc -type f 2>/dev/null | wc -l

Output:

1874

What it means: Folders and links are skipped.

3. Broken symlinks.

find /srv/app -xtype l

Output:

/srv/app/current

What it means: current points to a deleted release.

4. Empty files and folders.

find /tmp/build -empty

Output:

/tmp/build/out.log
/tmp/build/cache

What it means: Safe to clean.

4. find by size: -size

Why do we need this?

The disk is full. You need the biggest files fast.

What is it?

-size +100M bigger than 100 MiB, -size -1k smaller than 1 KiB, -size 0 empty. Units: c bytes, k KiB, M MiB, G GiB. Stay on one disk with -xdev. Combine with -exec du -h or ls -lh to see sizes.

How to do it (step by step)

1. Files over 500 MB on the root disk.

sudo find / -xdev -type f -size +500M -exec ls -lh {} + 2>/dev/null

Output:

-rw-r----- 1 root root 2.1G /var/log/journal/x/system.journal
-rw-r--r-- 1 app app 900M /srv/app/shared/dump.sql

What it means: -xdev skips /proc and other disks.

2. Top 5 biggest files.

find /var -type f -printf '%s %p\n' 2>/dev/null | sort -nr | head -5

Output:

2254857830 /var/log/journal/x/system.journal
943718400 /var/lib/mysql/ibdata1

What it means: -printf %s is size in bytes, %p the path.

3. Small files under 1 KB.

find ~/notes -type f -size -1k | wc -l

Output:

48

What it means: - means smaller than.

5. find by time: -mtime, -mmin, -newer

Why do we need this?

Delete logs older than 7 days, or see which files changed in the last 10 minutes during an incident.

What is it?

-mtime +7 modified more than 7 days ago, -mtime -1 within the last day, -mmin -10 within 10 minutes. -atime/-amin access time, -ctime/-cmin change of inode (permissions, owner). -newer ref finds files newer than a reference file. -newermt '2026-10-25 10:00' uses a date (GNU).

How to do it (step by step)

1. Logs older than 7 days.

find /var/log/app -name '*.log' -mtime +7

Output:

/var/log/app/app-2026-10-10.log
/var/log/app/app-2026-10-12.log

What it means: Always list before you delete.

2. Changed in the last 10 minutes.

sudo find /etc -mmin -10 -type f

Output:

/etc/nginx/conf.d/shop.conf

What it means: Who changed this right before the outage?

3. Newer than a deploy marker.

find /srv/app -newer /srv/app/.deployed -type f | head -3

Output:

/srv/app/shared/uploads/a.png

What it means: Files written after the deploy.

4. Between two dates.

find /data -newermt '2026-10-01' ! -newermt '2026-10-08' -type f | wc -l

Output:

1204

What it means: ! negates the second test.

6. find by owner and permission: -user, -group, -perm

Why do we need this?

Security audits ask: which files are world-writable, which have SUID, which belong to a deleted user.

What is it?

-user name, -group name, -nouser, -nogroup (orphaned files). -perm 644 exact mode, -perm -o+w at least these bits (world-writable), -perm /u+s any of these bits, -perm -4000 SUID. -readable, -writable, -executable test for the current user.

How to do it (step by step)

1. Files owned by a user.

sudo find /home -user rahul -type f | wc -l

Output:

2310

What it means: Before deleting rahul's account.

2. World-writable files (risky).

sudo find / -xdev -type f -perm -o+w 2>/dev/null

Output:

/srv/app/shared/config.php

What it means: Anyone can change this file. Fix it.

3. SUID programs.

sudo find / -xdev -perm -4000 -type f 2>/dev/null | head -3

Output:

/usr/bin/passwd
/usr/bin/sudo
/usr/bin/mount

What it means: Compare against a known list in audits.

4. Orphaned files.

sudo find / -xdev -nouser 2>/dev/null

Output:

/opt/old/app.jar

What it means: Owner UID no longer exists.

7. Depth, prune and combining tests

Why do we need this?

Searching / or a big repo is slow, and you want to skip .git, node_modules or /proc.

What is it?

-maxdepth N stops going deeper than N levels, -mindepth N skips the top levels (put both first). -prune stops find from entering a folder: find . -path ./node_modules -prune -o -name '*.js' -print. -xdev stays on one file system. Tests join with AND; -o is OR; ! or -not negates; \( \) groups.

How to do it (step by step)

1. Only the top level.

find /var/log -maxdepth 1 -type f -name '*.log'

Output:

/var/log/dnf.log
/var/log/boot.log

What it means: Does not go into sub-folders.

2. Skip node_modules.

find . -path ./node_modules -prune -o -name '*.js' -print | head -3

Output:

./src/app.js
./src/cart.js

What it means: -prune cuts that branch; -print is needed at the end.

3. NOT a pattern.

find . -type f ! -name '*.md' | head -2

Output:

./src/app.js
./Dockerfile

What it means: ! negates -name.

4. Combine: big AND old.

find /backup -type f -size +1G -mtime +30

Output:

/backup/db-2026-09-01.sql.gz

What it means: Both tests must be true.

8. Actions: -exec, -ok, -delete, -printf

Why do we need this?

Finding is half the job. You need to delete, compress, chmod or copy what you found.

What is it?

-exec cmd {} \; runs cmd once per file ({} is the file). -exec cmd {} + passes many files at once (much faster). -ok asks before each run. -delete removes matches (put it last; it implies -depth). -printf formats output: %p path, %s size, %TY-%Tm-%Td date, %u owner. -ls prints like ls -l.

How to do it (step by step)

1. Compress old logs.

find /var/log/app -name '*.log' -mtime +3 -exec gzip {} +

Output:

(no output)

What it means: {} + gives gzip many files per run.

2. Fix folder permissions.

find /srv/www -type d -exec chmod 755 {} + && find /srv/www -type f -exec chmod 644 {} +

Output:

(no output)

What it means: Folders 755, files 644: the classic web fix.

3. Ask before each delete.

find ~/tmp -name '*.bak' -ok rm {} \;

Output:

< rm ... /home/ravi/tmp/a.bak > ? y

What it means: Type y to confirm each one.

4. Delete old temp files (list first!).

find /tmp/build -type f -mtime +7 -print; find /tmp/build -type f -mtime +7 -delete

Output:

/tmp/build/x.o
/tmp/build/y.o

What it means: Same tests, -print first, then -delete.

5. Custom output.

find /srv/app -maxdepth 1 -printf '%TY-%Tm-%Td %u %p\n'

Output:

2026-10-25 deploy /srv/app/releases
2026-10-20 deploy /srv/app/shared

What it means: Like a report.

6. Copy found files.

find ~/Photos -name '*.jpg' -newermt '2026-10-01' -exec cp -t /backup/oct/ {} +

Output:

(no output)

What it means: cp -t puts the target first so {} + works.

9. xargs: turn a list into arguments

Why do we need this?

Many commands (rm, gzip, grep) take file names as arguments, not from stdin. With huge lists you also hit 'Argument list too long'.

What is it?

cmd1 | xargs cmd2 reads items from stdin and runs cmd2 with them, packing as many as fit. -0 reads NUL-separated items (pair with find -print0, safe for spaces and new lines in names). -n N items per run, -P N run N in parallel, -I{} puts each item where {} is (one item per run), -r (GNU) does not run if input is empty, -t prints each command first, -p asks.

How to do it (step by step)

1. Delete found files safely.

find /tmp/cache -name '*.tmp' -print0 | xargs -0 -r rm -f

Output:

(no output)

What it means: Works even with spaces in names; -r skips when nothing found.

2. Why -0 matters.

touch 'my file.txt'; find . -name '*.txt' | xargs ls

Output:

ls: cannot access './my': No such file or directory
ls: cannot access 'file.txt': No such file or directory

What it means: Without -print0/-0 the space split the name.

3. Grep inside found files.

find . -name '*.py' -print0 | xargs -0 grep -l 'boto3'

Output:

./sync/main.py

What it means: xargs gives grep many files at once.

4. Parallel compression.

find /data/logs -name '*.log' -print0 | xargs -0 -n 1 -P 4 gzip

Output:

(no output)

What it means: 4 gzip jobs at the same time on 4 CPUs.

5. Place each item with -I.

cat servers.txt | xargs -I{} ssh {} 'uptime'

Output:

web1  10:40 up 12 days
web2  10:40 up 3 days

What it means: {} becomes each server name.

6. Show and batch.

seq 1 5 | xargs -t -n 2 echo

Output:

echo 1 2
1 2
echo 3 4
3 4
echo 5
5

What it means: -t prints the command, -n 2 groups by two.

7. Fix 'Argument list too long'.

find /var/spool/mail/old -type f -print0 | xargs -0 rm -f

Output:

(no output)

What it means: rm /var/spool/mail/old/* would fail with 200,000 files.

10. locate and updatedb: instant name search

Why do we need this?

find walks the disk every time. For a quick 'where is that file?' a database is faster.

What is it?

locate (plocate/mlocate package) searches a database built by updatedb, usually daily. -i ignore case, -c count, -n 5 limit, -e only existing files. New files appear only after updatedb.

How to do it (step by step)

1. Instant name search.

locate -i nginx.conf

Output:

/etc/nginx/nginx.conf
/usr/share/doc/nginx/nginx.conf.default

What it means: Very fast, from the database.

2. Refresh the database.

sudo updatedb && locate -c '*.log'

Output:

213

What it means: New files appear only after updatedb (runs daily by timer).

11. which: which program will run

Why do we need this?

Two versions of python or java are installed. Which one runs when you type the name?

What is it?

which cmd searches your PATH and prints the first match. -a prints all matches.

How to do it (step by step)

1. Which python runs?

which python3

Output:

/usr/bin/python3

What it means: First match in PATH.

2. All matches.

which -a python3

Output:

/usr/local/bin/python3
/usr/bin/python3

What it means: The first one wins.

12. whereis: binary, source and manual

Why do we need this?

You want to see where a command and its manual page live.

What is it?

whereis cmd lists binary, source and man page paths from standard places. -b binary only, -m man only.

How to do it (step by step)

1. All places of a command.

whereis tar

Output:

tar: /usr/bin/tar /usr/share/man/man1/tar.1.gz

What it means: Binary and manual page.

2. Binary only.

whereis -b nginx

Output:

nginx: /usr/sbin/nginx

What it means: -b hides man pages.

13. type: alias, builtin, function or file

Why do we need this?

A command behaves oddly. Maybe it is an alias or a shell function, not the real program.

What is it?

type is a shell builtin. It says if a name is an alias, keyword, function, builtin or a file on disk. type -a shows all, type -t prints just the kind.

How to do it (step by step)

1. Alias or file?

type ll

Output:

ll is aliased to `ls -l --color=auto'

What it means: type knows shell aliases; which may not.

2. Builtin vs file.

type -a echo

Output:

echo is a shell builtin
echo is /usr/bin/echo

What it means: The builtin runs first.

14. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

15. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

16. Troubleshooting step by step

Why do we need this?

When find returns nothing or too much, build the command one test at a time and always -print before any action.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Start broad and check results exist.

find /var/log -type f | head

2. Add one test at a time.

find /var/log -type f -name '*.log' | head

3. Check the time maths.

find /var/log -type f -name '*.log' -mtime +7 -printf '%TY-%Tm-%Td %p\n' | head

4. Check the count before acting.

find /var/log -type f -name '*.log' -mtime +7 | wc -l

5. Dry-run xargs with echo or -t.

find . -name '*.tmp' -print0 | xargs -0 -r echo rm

6. Then run the real action.

find . -name '*.tmp' -print0 | xargs -0 -r rm -f

17. Lab 1: Free a full disk safely

Why do we need this?

Create test files, find big and old ones, compress and delete safely.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create files of different sizes and ages.

mkdir -p ~/lab12/logs && cd ~/lab12/logs && for i in 1 2 3 4 5; do truncate -s ${i}0M app$i.log; touch -d "$((i*3)) days ago" app$i.log; done; ls -lh

Output:

-rw-r--r-- 1 ravi ravi 10M app1.log ... 50M app5.log

2. Files bigger than 25 MB.

find . -type f -size +25M -printf '%s %p\n' | sort -nr

Output:

52428800 ./app5.log
41943040 ./app4.log
31457280 ./app3.log

3. Files older than 7 days.

find . -name '*.log' -mtime +7

Output:

./app3.log
./app4.log
./app5.log

4. Compress them.

find . -name '*.log' -mtime +7 -exec gzip {} + && ls

Output:

app1.log  app2.log  app3.log.gz  app4.log.gz  app5.log.gz

5. Delete gz files older than 12 days (print first).

find . -name '*.gz' -mtime +12 -print -delete

Output:

./app5.log.gz

18. Lab 2: Names with spaces and xargs

Why do we need this?

See how spaces break pipelines and fix them with -print0 and -0; run jobs in parallel.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Make tricky file names.

mkdir -p ~/lab12/docs && cd ~/lab12/docs && touch 'Oct bill.txt' 'Nov bill.txt' plain.txt

Output:

(no output)

2. Unsafe way.

find . -name '*.txt' | xargs ls 2>&1 | head -2

Output:

ls: cannot access './Oct': No such file or directory
ls: cannot access 'bill.txt': No such file or directory

3. Safe way.

find . -name '*.txt' -print0 | xargs -0 ls

Output:

./Nov bill.txt  ./Oct bill.txt  ./plain.txt

4. Parallel jobs with -P and -I.

find . -name '*.txt' -print0 | xargs -0 -P 3 -I{} sh -c 'echo "done: $1"' _ {}

Output:

done: ./plain.txt
done: ./Oct bill.txt
done: ./Nov bill.txt

5. Fix permissions in one go.

find ~/lab12 -type f -exec chmod 644 {} + && find ~/lab12 -type f ! -perm 644 | wc -l

Output:

0

19. Frequently asked questions

20. Interview questions and answers

Beginner level

Mid level level

Senior level

21. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.