How to search files using the find command in Linux

If you are at *nix system, whether you are System administrator, common user, programmer or whoever; you will surely need to find file using different criteria. For that *nix system has very powerful and efficient command called “find”.

The find command is a powerful *nix utility that allows the user to find files located in the file system through various criteria such as the file name, owner, group, size, inodes, when file was last accessed, when the file status was last changed, the file's permissions, even using regular expression pattern etc.

I will try to cover maximum usage of commands that you are gonna need for any such operations. I hope after reading those examples one will easily use find command for one's problem.

Syntax for find command:
 
      

find where-to-look criteria what-to-do 

Select all Open in new window

Instead of explaining each options and then showing you its uses with examples, better to see the use of all options while going through different examples based on various requirements.

Examples
1.       Find a file "alien.coders" that exists somewhere in the file system
      

$ find / -name alien.coders -print 

Select all Open in new window

If the file is found the path to the file will be printed as output. On most platforms the -print is optional, however, on some *NIX systems nothing will be printed without using print. If you don’t provide any arguments, find searches recursively through all the directories.

2.Find a file without searching network or mounted file systems
       

$ find / -name alien.coders -print -xdev 

Select all Open in new window

I found it useful, when you have mounted network drives or file systems that you do not want searched (Like Windows box or other remote servers). This will surely increase the search speed greatly if the mounted file system is large or over a slow network. "-mount" does the same thing as "-xdev"  to make it compatible with other versions of find.

3.Find a file without showing "Permission Denied" messages
       

$ find / -name alien.coders -print 2>/dev/null 

Select all Open in new window

When find tries to search a directory or file that you do not have permission to read the message "Permission Denied" will be output to the screen. The 2>/dev/null option sends these messages to /dev/null so that the found files are easily viewed.

4.Find a file, who's name ends with .coders, within the current directory and only search 3 directories deep
 
      

$ find . -name *.coders -maxdepth 3 -print 

Select all Open in new window

-maxdepth option allows you to specify till how much deeper you want to search for a file by specifying n digit i.e. –max depth 3 in the above example.

5.Search directories "./dir1" and "./dir2" for a file "alien.coders"
       

$ find ./dir1 ./dir2 -name alien.coders -print 

Select all Open in new window

6.Search for files that are owned by the user "aliens"
       

$ find /alice/in/wonderland/ -user aliens -print 

Select all Open in new window

The files output will belong to the user "aliencs". Similar criteria are -uid to search for a user by their numerical id, -group to search by a group name, and -gid to search by a group id number.

7.Find a file that is a certain type. "-type l" searches for symbolic links ( manual page of find has lot more explanation on this)
       

$ find /some/directory -type l -print 

Select all Open in new window

Several types of files can be searched for:
b    block (buffered) special
c    character (un-buffered) special
d    directory
p    named pipe (FIFO)
f     regular file
l     symbolic link
s    socket
D   door (Solaris)

8.Search for directories that contains the word "alien" but do not end with ".coders"
       

$ find . -name '*alien*' ! -name '*.coders' -type d -print 

Select all Open in new window

The "!" allows you to exclude results that contain the phrases following it.
 
9.Search files which are modified between 10 and 60 minutes:
       

find . -mmin +9 -mmin -61 

Select all Open in new window

 (-mmin  +or – n is for minutes and –mtime + or – n is for no of days ( n*24 hours format))
(-n means less than n and +n means more than n like -9 and +61 in that example)

10.find files n days older and above certain file size
We have already seen the use of mtime and we will combine with –size option to find files which are n days older and greater than some file size in *nix. This is very common scenario for system administrator people where they need to delete some large old files to free some space in the machine.

This example of find command will find which are more than 30 days old and size greater than 1MB (1024 Kilo bytes with k option or 1024*1024 Bytes with c option instead of M and G for GB i.e. –size +1G for greater than 1Gb file size).
       

find . -mtime +10 -size +1M -exec ls -l {} \; 

Select all Open in new window

 11.   Search files which are writable by both their owner and group:
       

find . -perm -220 

Select all Open in new window

or
      

find . -perm -g+w,u+w 

Select all Open in new window

 The power of find
find becomes extremely useful when combined with other commands. One such combination would be using find and grep together or with xargs and awk etc.
       

$ find dir-path -type f -name '*.txt'  -exec grep -s Aliens {} \; -print 

Select all Open in new window

This sequence uses find to look in give path for a file (-type f) with a name ending in .txt. It sends the files it finds to the grep command via the -exec option and grep searches the file found for any occurrences of the word "Aliens".

If the file is found it will be output to the screen and if the word "Aliens" is found, within one of the found files, the line that "Aliens" occurs in will also be output to the screen.

12.   Find files and print those files whose name contains core.two-or-more-numeric-digits :
Without Regular Expression
       

find directory-path -name "core.[0-9][0-9]*[0-9]" | xargs ls -lRt | awk '{print $9}'; 

Select all Open in new window

 
 
With regular expression
       

find directory-path   -type f -regex ".*/core\.[0-9]*" | xargs -r ls -lRt | awk '{print $9}' 

Select all Open in new window

13.   Find files using regular expression and avoid hard link count error
       

find directory-path -noleaf -type f -regex  ".*/core\.[0-9]*" | xargs -r ls -lRt | awk '{print $9}' 
                       

Select all Open in new window

Some points to remember while using find command in Linux:
All arguments are optional though, but what you will do without any argument? What I meant is, if you write just find, then also it will work.
       

find 
                      	find . 
                      	find . -print 
                      	find -print 

Select all Open in new window

All commands would fetch you the same result. i.e it will display the pathnames of all files in the current directory and all sub directories.
 


What is the real difference between exec and xargs (Source: unix.com)?
find . -name H* -exec ls -l {} \; executes the command ls -l on each individual file.
find . -name H* | xargs ls -l constructs an argument list from the output of the find commend and passes it to ls.

Consider if the ouput of the find command produced:
H1
H2
H3

the first command would execute
ls -l H1
ls -l H2
ls -l H3

but the second would execute
ls -l H1 H2 H3

the second (xargs) is faster because xargs will collect file names and execute a command with as long as a length as possible. Often this will be just a single command.

If file name is having space then xargs will fail but exec will work because each filename is passes to exec as a single value, with special characters escaped, so it is as if the filename has been enclosed in single quotes.
 
For more details about how to use different arguments and options type

man find

Select all Open in new window

I have written this article in our website too. Here is the url: http://www.aliencoders.com/content/how-search-files-using-find-command-linux