The Linux find Command

We get so focused on the super-advanced things that Linux can do, that we tend to forget about or glaze over the mundane.  Linux’s find command falls into that category for me.

First of all, remember that Linux is case sensitive. This means that “TEST”, “test”, “Test”, and “TesT” all register as completely different files. Run find –help for all of the available options. To see everything, including the things I’m not going to cover in this brief article, remember you can always man find.

Examples:

Find all files in the entire system that are named test.txt:
find / -name “test.txt”

Find all files in the /etc directory not named test.txt:
find /etc/ -not -name “test.txt”

Find all character devices on the system:
find / -type c

Find all directories called log:
find / -type d -name “log”

Find all files in the /usr/bin directory or subdirectories that are larger than 27,000 bytes:
find /usr/bin/ -size +27000c or find /usr/bin -size +27k

Find all files in the /usr/bin directory or subdirectories that are larger than 1 megabyte:
find /usr/bin/ -size 1M

Find all files created more than a day ago:
find / -mtime 1

Find all files create less than a day ago:
find / -mtime -1

Find all files owned by the user named “chad”:
find / -user chad

Find all files in the /etc directory owned by the user root, and paginate:
find /etc/ -user root | more

Find all files in the /usr/bin directory with the user permissions 755:
find /usr/bin/ -perm 755

Find all files called test.txt and set their permissions to 700:
find / -name “test.txt” -exec chmod 700 {} \;

In Linux, the general rule is “No news is good news,” which means that when a command completes successfully, you will likely receive no command line confirmation or other feedback. If you don’t get a response to a command, it likely completed exactly as you expected.

The more command will cause the output to pause after it fills a page and waits for you to hit the space bar before continuing. There is also a less command that will allow you to scroll back and forth through the output using arrow keys.

The which command allows you to find the version of a command that will be executed if invoked. This is useful for locating the executable file, especially if the behavior is not what you expected. For instance, to find out which python executable would be invoked, run:

which python

The locate command can also help you find files but relies on a database rather than looking directly at the file system. The two can easily be out of sync. To synchronize the locate’s database, run the command (as root):
updatedb