Skip to main content

Documentation Index

Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt

Use this file to discover all available pages before exploring further.

In this guide, you’ll learn how to quickly locate files on a Linux system using the powerful find command. Whether you need to hunt down large log files, uncover recently modified documents, or filter by permissions, find provides flexible options to suit your needs. By default, files on Linux are organized under standard directories:
  • SSH daemon configurations: /etc/ssh
  • System logs: /var/log
However, there are many scenarios where you must perform an arbitrary search:
  • Locate all image files beneath your web directory
  • Identify huge files when disk space is low
  • List files modified or created within a specific timeframe
Below, we cover the most common use cases with examples.

​
Basic Usage

The general syntax is: 
find [search_path] [expression]
If you omit search_path, find searches the current directory.
Omitting the search path is equivalent to specifying . (the current directory).

​
Examples

# Search by name under /usr/share for JPEG files
find /usr/share/ -name '*.jpg'

# Find files larger than 10 MB in /lib64
find /lib64/ -size +10M

# List files modified in the last minute under /dev
find /dev/ -mmin -1

​
Specifying the Search Path First

Always place the directory to search before your search criteria. Incorrect (no results under /bin): 
find -name file1.txt /bin
Correct: 
find /bin/ -name file1.txt
find -name file1.txt    # searches the current directory

​
Name-Based Searches

  • -name : case-sensitive filename match
  • -iname : case-insensitive filename match
  • Wildcards (*) match any sequence of characters
find -name felix
find -iname FELIX
find -name "f*"          # all files starting with 'f'

​
Time-Based Searches

You can filter files based on modification or change times.

​
Modified Time by Minutes (-mmin)

SyntaxDescription
nexactly n minutes ago
-nwithin the last n minutes
+nmore than n minutes ago
find -mmin 5    # exactly 5 minutes ago
find -mmin -5   # in the last 5 minutes
find -mmin +5   # more than 5 minutes ago

​
Modified Time by Days (-mtime)

  • 0 : within the last 24 hours
  • 1 : between 24 and 48 hours ago
  • +n : more than n days ago
  • -n : less than n days ago
find -mtime 0    # modified within the last day
find -mtime 1    # modified one to two days ago

​
Change Time (-ctime)

Tracks metadata changes (permissions, ownership): 
find -ctime 1    # metadata changed one to two days ago

​
Size-Based Searches

Filter files by size using the following suffixes:
SuffixUnit
cbytes
kkilobytes
Mmegabytes
Ggigabytes
SyntaxDescription
nexactly n units
-nless than n units
+nmore than n units
find -size 512k    # exactly 512 KB
find -size -512k   # less than 512 KB
find -size +512k   # more than 512 KB

​
Combining Expressions

By default, multiple expressions are combined with AND: 
# Files starting with 'f' AND exactly 512 KB in size
find -name "f*" -size 512k

​
OR Operator

Use -o to OR expressions: 
# Files that start with 'f' OR are 512 KB in size
find -name "f*" -o -size 512k

​
NOT Operator

Negate conditions with -not or an escaped !: 
# Exclude files starting with 'f'
find -not -name "f*"

# Equivalent using escaped '!'
find \! -name "f*"

​
Permission-Based Searches

Search by file permission bits (octal notation):
Mode FormatDescription
modeexact match
-modeat least the bits in mode
/modeany of the bits in mode
Examples (mode 664 = rw-rw-r--): 
find -perm 664       # exactly 664
find -perm -664      # at least these bits
find -perm /664      # any of these bits
More permission filters: 
find -perm 600       # owner read/write only
find -perm -100      # owner has execute
find \! -perm -o=r   # not readable by others
find -perm /u=r,g=r,o=r  # readable by user OR group OR others
Be careful to quote wildcard patterns (e.g., "*.txt"), especially when running in scripts or complex shells.

​
Further Reading & References

Watch Video

Practice Lab