Mastering the Find Command on Linux

Quick answer: common find command examples

# Find files by name
find . -name "*.log"

# Find files case-insensitively
find . -iname "*.log"

# Find only files
find . -type f

# Find only directories
find . -type d

# Find files larger than 100MB
find . -type f -size +100M

# Find files modified in the last day
find . -type f -mtime -1

# Find files owned by a user
find . -type f -user root

# Find files with specific permissions
find . -type f -perm 644

# Run a command on each result
find . -name "*.log" -exec ls -lh {} \;

If you want to build these interactively, use the Find Command Builder. To practise, try the Find Command Quiz.

Basic find command syntax

The basic structure is:

find [path] [conditions] [actions]

Example:

find . -type f -name "*.log"

• . means start searching in the current directory.
• -type f means only show files.
• -name "*.log" means match files ending in .log.

You can replace . with another path, such as /var/log, /home/user or /home/user/public_html.

Find files by name

Use -name to search for an exact name or pattern.

find . -name "error.log"

Find all log files:

find . -name "*.log"

Find all PHP files:

find . -name "*.php"

Quote wildcard patterns like "*.log". Without quotes, your shell may expand the pattern before find receives it.

Find files case-insensitively

-name is case-sensitive. Use -iname when you want to match different capitalisation.

find . -iname "*.jpg"

This can match:

• image.jpg
• image.JPG
• image.Jpg

Find only files or only directories

Use -type f for files:

find . -type f

Use -type d for directories:

find . -type d

Combine this with name searches:

find . -type f -name "*.log"
find . -type d -name "cache"

Find files by size

Finding large files is useful when investigating disk usage.

# Files larger than 100MB
find . -type f -size +100M

# Files larger than 1GB
find . -type f -size +1G

# Files smaller than 10KB
find . -type f -size -10k

To show file sizes in a readable format, combine find with ls -lh:

find . -type f -size +100M -exec ls -lh {} \;

Want this without remembering the syntax? Use the Find Command Builder.

Find files modified recently

Use -mtime to search by modification time in days.

# Modified in the last day
find . -type f -mtime -1

# Modified more than 7 days ago
find . -type f -mtime +7

# Modified exactly 1 day ago
find . -type f -mtime 1

Common examples:

# Find recently changed PHP files
find . -type f -name "*.php" -mtime -1

# Find logs changed today
find . -type f -name "*.log" -mtime -1

Find files by minutes instead of days

Use -mmin when you need a smaller time window.

# Modified in the last 30 minutes
find . -type f -mmin -30

# Modified more than 60 minutes ago
find . -type f -mmin +60

This is useful when troubleshooting recent changes or checking what a script has just written.

Find files by owner

Use -user to find files owned by a specific user.

find . -type f -user root

For web hosting troubleshooting, this can help identify files owned by the wrong user.

find /home/user/public_html -user root

Be careful before changing ownership recursively. Preview the results first.

Find files by permissions

Find files with exact permissions:

find . -type f -perm 644

Find world-writable files:

find . -type f -perm -002

Find directories with 777 permissions:

find . -type d -perm 777

World-writable files and directories can be a security concern. For more, read Understanding Linux Permissions.

Find empty files and directories

Use -empty to find empty files or directories.

# Empty files
find . -type f -empty

# Empty directories
find . -type d -empty

This can be useful during cleanup tasks, but always review the results before removing anything.

Find files and run a command with -exec

-exec lets you run another command on every result.

find . -name "*.log" -exec ls -lh {} \;

• {} is replaced with the current matching file.
• \; ends the -exec command.

Another example, search inside matching files:

find . -type f -name "*.php" -exec grep -i "deprecated" {} \;

If you are mainly searching inside files, the Grep Command Builder may be the better tool.

Find files containing text

You can combine find and grep to search inside specific file types.

find . -type f -name "*.php" -exec grep -i "fatal error" {} \;

Show filenames as well:

find . -type f -name "*.php" -exec grep -Hni "fatal error" {} \;

This is useful for WordPress, PHP and application troubleshooting.

Find and delete files safely

Be careful: find with -delete can remove a lot of files very quickly. Always preview first.

Preview files older than 30 days:

find . -type f -name "*.tmp" -mtime +30

Delete only after checking the output:

find . -type f -name "*.tmp" -mtime +30 -delete

Safer workflow:

1. Run the command without -delete.
2. Check the results carefully.
3. Run again with -delete only when you are confident.

Limit search depth

Use -maxdepth to stop find searching too deeply.

# Only search current directory
find . -maxdepth 1 -type f

# Search current directory and one level below
find . -maxdepth 2 -type f

This is useful in large directory trees where a full recursive search would be slow or noisy.

Find command examples for web hosting

Find large files in a hosting account:

find /home/user -type f -size +500M -exec ls -lh {} \;

Find recently modified PHP files:

find /home/user/public_html -type f -name "*.php" -mtime -1

Find world-writable files:

find /home/user/public_html -type f -perm -002

Find backup files inside the web root:

find /home/user/public_html -type f \( -name "*.zip" -o -name "*.tar.gz" -o -name "*.sql" -o -name "*.bak" \)

These are useful checks when investigating disk usage, suspicious changes or exposed backup files.

Common find command mistakes

• Forgetting quotes around wildcards: use "*.log", not just *.log.
• Running from the wrong directory: check with pwd first.
• Using -delete too early: preview results first.
• Searching too broadly: use a specific path or -maxdepth.
• Mixing up -mtime +7 and -mtime -7: plus means older than, minus means newer than.
• Forgetting that permissions can be tricky: exact permission matching and “has at least these bits” are different.

FAQ

How do I find files by extension?

find . -type f -name "*.log"

How do I find files larger than 1GB?

find . -type f -size +1G

How do I find files modified today?

find . -type f -mtime -1

How do I find and delete old files?

Preview first:

find . -type f -name "*.tmp" -mtime +30

Then delete only if the results are correct:

find . -type f -name "*.tmp" -mtime +30 -delete

What does {} \; mean in find?

{} represents each matched file, and \; marks the end of the command passed to -exec.

What is the difference between find and grep?

find searches for files and directories. grep searches inside files.

Related tools and practice

External references

• Linux find man page
• GNU Findutils manual