EXAMPLES
find /home -user joe
Find every file under the directory /home owned by the user joe.
find /usr -name *stat
Find every file under the directory /usr ending in ".stat".
find /var/spool -mtime +60
Find every file under the directory /var/spool that was modified more than 60 days ago.
find /tmp -name core -type f -print | xargs /bin/rm -f
Find files named
core in or below the directory
/tmp and delete them. Note that this will work incorrectly if there are any filenames containing newlines, single or double quotes, or spaces.
find /tmp -name core -type f -print0 | xargs -0 /bin/rm -f
Find files named core in or below the directory /tmp and delete them, processing filenames in such a way that file or directory names containing single or double quotes, spaces or newlines are correctly handled. The -name test comes before the -type test in order to avoid having to call stat(2) on every file.
find . -type f -exec file '{}' \;
Runs `file' on every file in or below the current directory. Notice that the braces are enclosed in single quote marks to protect them from interpretation as shell script punctuation. The semicolon is similarly protected by the use of a backslash, though ';' could have been used in that case also.
find / \( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \
\( -size +100M -fprintf /root/big.txt '%-10s %p\n' \)
Traverse the filesystem just once, listing setuid files and directories into
/root/suid.txt and large files into
/root/big.txt.
find $HOME -mtime 0
Search for files in your home directory which have been modified in the last twenty-four hours. This command works this way because the time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to match
-mtime 0, a file will have to have a modification in the past which is less than 24 hours ago.
find . -perm 664
Search for files which have read and write permission for their owner, and group, but which other users can read but not write to. Files which meet these criteria but have other permissions bits set (for example if someone can execute the file) will not be matched.
find . -perm -664
Search for files which have read and write permission for their owner and group, and which other users can read, without regard to the presence of any extra permission bits (for example the executable bit). This will match a file which has mode 0777, for example.
find . -perm /222
Search for files which are writable by somebody (their owner, or their group, or anybody else).
find . -perm /220
find . -perm /u+w,g+w
find . -perm /u=w,g=w
All three of these commands do the same thing, but the first one uses the octal representation of the file mode, and the other two use the symbolic form. These commands all search for files which are writable by either their owner or their group. The files don't have to be writable by both the owner and group to be matched; either will do.
find . -perm -220
find . -perm -g+w,u+w
Both these commands do the same thing; search for files which are writable by both their owner and their group.
find . -perm -444 -perm /222 ! -perm /111
find . -perm -a+r -perm /a+w ! -perm /a+x
These two commands both search for files that are readable for everybody (-perm -444 or -perm -a+r), have at least on write bit set (-perm /222 or -perm /a+w) but are not executable for anybody (! -perm /111 and ! -perm /a+x respectively)
Admittedly, the find
command does not help itself by using X-style parameters. The Unix standard is -c
, -s
, and so on, whereas the GNU standard is --dosomething
, --mooby
, and so forth. X-style parameters merge the two by having words preceded by only one dash. The most basic usage is this:
find -name "*.txt"
That query searches the current directory and all subdirectories for files that end in .txt
. The previous search finds files ending in .txt
but not .TXT
, .Txt
, or other case variations. To search without case sensitivity, use -iname
instead of -name
. You can optionally specify where the search should start before the -name
parameter, like this:
find /home -name "*.txt"
Another useful test is -size
, which lets you specify how big the files should be to match. You can specify your size in kilobytes and optionally also use +
or -
to specify greater than or less than. For example:
find /home -name "*.txt" -size 100k
find /home -name "*.txt" -size +100k
find /home -name "*.txt" -size -100k
The first brings up files of exactly 100KB, the second only files greater than 100KB, and the last only files less than 100KB.
The -user
option enables you to specify the user that owns the files you are looking for. So, to search for all files in /home
that end with .txt
, are under 100KB, and are owned by user paul
, you would use this:
find /home -name "*.txt" -size -100k -user paul
You can flip any of the conditions by specifying -not
before them. For example, you can add a -not
before -user paul
to find matching files owned by everyone but paul
:
find /home -name "*.txt" -size -100k -not -user paul
You can add as many -not
parameters as you need, even using -not -not
to cancel each other out! (Yes, that is pointless.) Keep in mind, though, that -not -size -100k
is essentially equivalent to -size +100k
, with the exception that the former will match files of exactly 100KB whereas the latter will not.
You can use -perm
to specify which permissions a file should have for it to be matched. This is tricky, so read carefully. The permissions are specified in the same way as with the chmod
command: u
for user, g
for group, o
for others, r
for read, w
for write, and x
for execute. However, before you give the permissions, you need to specify a plus, a minus, or a blank space. If you specify neither a plus nor a minus, the files must exactly match the mode you give. If you specify -
, the files must match all the modes you specify. If you specify +
, the files must match any the modes you specify. Confused yet?
The confusion can be cleared up with some examples. This next command finds all files that have permission o=r
(readable for other users). Notice that if you remove the -name
parameter, it is equivalent to *
because all filenames are matched.
find /home -perm -o=r
Any files that have o=r
set are returned from that query. Those files also might have u=rw
and other permissions, but as long as they have o=r
, they will match. This next query matches all files that have o=rw
set:
find /home -perm -o=rw
However, that query does not match files that are o=r
or o=w
. To be matched, a file must be readable and writeable by other users. If you want to match readable or writeable (or both), you need to use +
, like this:
find /home -perm +o=rw
Similarly, this next query matches files that are only readable by user, group, and others:
find /home -perm -ugo=r
Whereas this query matches files as long as they are readable by the user, or by the group, or by others, or by any combination of the three:
find /home -perm +ugo=r
If you use neither +
nor -
, you are specifying the exact permissions to search for. For example, the next query searches for files that are readable by user, group, and others but not writeable or executable by anyone:
find /home -perm ugo=r
You can be as specific as you need to be with the permissions. For example, this query finds all files that are readable for the user, group, and others and writeable by the user:
find /home -perm ugo=r,u=w
To find files that are not readable by others, use the -not
condition, like this:
find /home -not -perm +o=r
Now, on to the most advanced aspect of the find command: the -exec
parameter. This enables you to execute an external program each time a match is made, passing in the name of the matched file wherever you want it. This has very specific syntax: Your command and its parameters should follow immediately after -exec
, terminated by \;
. You can insert the filename match at any point using {}
(an opening and a closing brace side by side).
So, you can match all text files on the entire system (that is, searching recursively from /
rather than from /home
as in our previous examples) over 10KB, owned by paul
, that are not readable by other users, and then use chmod
to enable reading, like this:
find / -name "*.txt" -size +10k -user paul -not -perm +o=r -exec chmod o+r {} \;
When you type your own -exec
parameters, be sure to include a space before \;
. Otherwise, you might see an error such as missing argument to ´-exec'
.
Do you see now why some people think the find
command is scary? Many people learn just enough about find
to be able to use it in a very basic way, but hopefully you will see how much it can do if you give it a chance.