Ravindra BagaleCourses & study guides Track your progress

Guides

Linux find Command with Examples: by Name, Size, Date, Owner and Permission

By , AWS & DevOps trainer LinkedIn Published: Last updated:

The find command searches a folder tree live and lists files that match your tests. The pattern is find <where> <tests> <action>. For example, find /var/log -name "*.log" -size +100M lists log files over 100 MB, and find /tmp -type f -mtime +7 -delete deletes files older than 7 days. Always run the command without -delete or -exec first, and check the list.

Quick answer: the 8 most used

find / -name "nginx.conf" 2>/dev/null          # by exact name
find . -iname "*.jpg"                          # by extension, any case
sudo find / -xdev -type f -size +100M          # big files
find /var/www -type f -mtime -1                # changed in last 24 h
find /home -user ravi                          # owned by a user
sudo find / -xdev -perm -4000 -type f          # SUID files (security review)
find /var/log -name "*.gz" -mtime +30 -delete  # cleanup (preview first!)
find . -name "*.php" -exec grep -l "eval(" {} +   # search inside files

A live example first

The disk on a web server is at 92%. We want to see big and old files under /var before cleaning anything.

  1. Big files:
sudo find /var -xdev -type f -size +200M -exec ls -lh {} \;

-rw-r--r-- 1 root  root  1.8G Oct 16 23:50 /var/log/nginx/access.log
-rw-r----- 1 mysql mysql 650M Oct 10 02:00 /var/lib/mysql/binlog.000412
-rw-r--r-- 1 root  root  420M Sep  2 11:20 /var/backups/site-2026-09-02.tar.gz
  1. Old compressed logs, preview first:
sudo find /var/log -name "*.gz" -mtime +30

/var/log/nginx/access.log.14.gz
/var/log/nginx/access.log.15.gz
...
  1. The list is correct, so now delete:
sudo find /var/log -name "*.gz" -mtime +30 -delete

We left the MySQL binlog alone (that is cleaned with PURGE BINARY LOGS, not rm) and moved the old backup to S3. Friends, see the method: find, read, then act.

How does find work?

How find works find walks the folder tree from a start point, applies tests like name, size and time, then prints or runs an action. How find works Start dir/var/wwwWalk treerecursiveTestsname/size/timePreviewprint listAction-exec/-delete you Always preview the list before you add -delete or -exec

find walks the tree, applies tests (name, size, time, perm), then an action. Preview before deleting.

find starts at the folder you give it and goes into every subfolder. For each file it checks your tests from left to right. When all tests are true, it runs the action (the default action is -print). Because it reads the real disk, it is always up to date, unlike locate.

The tests you will use most

Test Meaning Example
-name / -iname Name pattern (quote it!) -name "*.log"
-type f / -type d File or directory -​type d -​name node_​modules
-size +100M bigger, -1k smaller -size +1G
-mtime Modified days ago -mtime -1 (last day), +30 (older)
-mmin Modified minutes ago -mmin -15
-user / -group Owner -user www-data
-perm Permission bits -perm -o+w (world-writable)
-empty Empty file or dir -type f -empty
-xdev Stay on one filesystem skip /proc, other disks
-maxdepth Limit how deep to go -maxdepth 2

Combine them: all tests must match by default. Use -o for "or", and ! for "not":

find . -type f \( -name "*.jpg" -o -name "*.png" \) ! -path "./node_modules/*"

Actions: -exec, -delete and xargs

  1. -exec cmd {} \; runs the command once per file.
  2. -exec cmd {} + passes many files to one command (much faster).
  3. -delete removes matches. Put it last, after the tests.
  4. With spaces in names, use -print0 | xargs -0:
find . -name "*.tmp" -print0 | xargs -0 rm -f

Developer examples, by stack

Stack Task Command
Node.js Remove all node_modules in old projects find ~/​projects -​type d -​name node_​modules -​prune -​exec rm -​rf {} +
Python Remove cache folders find . -​type d -​name __​pycache__ -​exec rm -​rf {} +
Java Find which jar has a class find . -​name "*.​jar" -​exec sh -​c 'unzip -​l "$1" \| grep -​q Logger && echo "$1"' _ {} \;
PHP Files changed in the last 2 days (after a hack) find /​var/​www -​name "*.​php" -​mtime -​2
Git Find big files before committing find . -​type f -​size +50M ! -​path "./.​git/*"
nginx/Apache Find all config files find /​etc/​nginx /​etc/​httpd -​name "*.​conf"

Defensive security checks with find

These checks are for your own servers, as part of a hardening review:

sudo find / -xdev -perm -4000 -type f 2>/dev/null      # SUID programs
sudo find / -xdev -type f -perm -o+w 2>/dev/null       # world-writable files
sudo find / -xdev -nouser -o -nogroup 2>/dev/null      # files with no owner
sudo find /var/www -name "*.php" -newer /var/www/index.php   # recently added PHP
sudo find /tmp /var/tmp /dev/shm -type f -executable    # executables in temp folders

Compare the SUID list with a clean server of the same OS. An unexpected SUID file is a serious warning sign.

Real example: hunting Log4Shell with find

When Log4Shell (CVE-2021-44228) was disclosed in December 2021, many teams had no list of where log4j-core was used. One of the first commands in incident notes from CISA and security teams was a find across servers for the jar:

sudo find / -xdev -name "log4j-core-*.jar" 2>/dev/null

Because jars are often bundled inside other jars, teams also searched inside them. A plain find gave the first answer in minutes, while scanners were still being updated.

Mistakes to avoid

  1. Not quoting patterns. find . -name *.log lets the shell expand * first and breaks the search.
  2. Putting -delete first. find . -delete -name "*.log" deletes everything.
  3. Searching / without -xdev. You walk /proc and mounted network drives.

Summary table

Need Command
By name find DIR -​iname "*.​conf"
Big files find DIR -​xdev -​type f -​size +100M
Recently changed find DIR -​mtime -​1
Old files find DIR -​mtime +30
By owner find DIR -​user NAME
Security review -perm -4000, -perm -o+w, -nouser
Act safely preview → -exec ... {} + / -delete last

Quick quiz: check what you learned

  1. Which option ignores upper and lower case in names?

    1. -iname
    2. -name
    3. -type
    4. -path
    Show answer

    A. -iname matches names case-insensitively.

  2. What does -mtime +30 match?

    1. Files older than 30 days
    2. Files newer than 30 days
    3. Files of exactly 30 MB
    4. Files with 30 links
    Show answer

    A. +30 means modified more than 30 days ago.

  3. What should you do before adding -delete?

    1. Run the find and read it
    2. Run it as the root user
    3. Add the -iname option
    4. Mount the disk read-only
    Show answer

    A. A preview shows exactly what will be removed.

  4. Which command lists SUID files for a security review?

    1. find / -perm -4000
    2. find / -size +4000
    3. find / -mtime -4000
    4. find / -user 4000
    Show answer

    A. -perm -4000 matches files with the SUID bit.

Learn it properly

These pages go deeper, with labs:

Frequently asked questions

How do I find a file by name in Linux?

Run find / -name "nginx.conf" 2>/dev/null. Use -iname to ignore upper and lower case.

How do I find large files?

Run sudo find / -xdev -type f -size +100M -exec ls -lh {} \; to list files over 100 MB on the root filesystem.

How do I find files changed in the last day?

Use find /var/www -type f -mtime -1. -mtime +30 means older than 30 days.

What does 2>/dev/null do?

It hides "Permission denied" error messages so you only see the results.

Is find -delete dangerous?

Yes, if the filter is wrong. Always run the same command without -delete first, and put -delete at the end.

find vs locate?

locate searches a database that is updated daily, so it is fast but can be out of date. find searches the disk live.