How to Search for Files from the Linux Command Line

Searching for files is a common task for Linux users and system administrators. While graphical file managers provide an easy way to browse and locate files, the command line offers more power and flexibility for searching files based on various criteria.

The primary command for searching files in Linux is find. It recursively searches directories for files that match certain criteria and can perform actions on the results. In this guide, we‘ll take an in-depth look at how to use find to locate files from the Linux command line.

The Find Command Syntax

The basic syntax of the find command is:

find [path...] [expression]

• path is one or more directories to search. If omitted, find will search the current directory.
• expression consists of one or more options, tests, and actions that control the search criteria and what to do with the results.

Some common find expressions include:

• -name – Search by filename
• -type – Search by file type
• -size – Search by file size
• -mtime/-atime/-ctime – Search by modification/access/inode change time
• -perm – Search by permissions
• -user/-group – Search by owner/group

We‘ll explore these options in more detail with examples.

Finding Files by Name

The -name option allows searching for files by their name using wildcards. For example, to find all files with a .txt extension in the current directory and its subdirectories:

find . -name "*.txt"

To make the search case-insensitive, use the -iname option instead:

find . -iname "*.txt" 

You can also use other wildcard characters like ? which matches exactly one character. This command finds all 3-letter filenames starting with f:

find . -name "f??"

To find a file with an exact name, just specify the name without any wildcards:

find /etc -name passwd

Finding Files by Type

The -type option restricts the search to files of a certain type. The most common file types are:

• f – regular file
• d – directory
• l – symbolic link
• c – character device
• b – block device

To find only directories under the /home directory:

find /home -type d

You can also negate the search with !. This command finds all non-directory files:

find . -type !d

Finding Files by Size

The -size option searches for files based on their size. You can specify the size in bytes or using suffixes like:

• c – bytes
• k – kilobytes
• M – megabytes
• G – gigabytes

To find files larger than 10 MB in the current directory:

find . -size +10M

The + prefix means "greater than". Similarly, - means "less than" and no prefix means "exactly equal to".

You can also combine tests. To find files between 50 MB and 100 MB:

find . -size +50M -size -100M

Finding Files by Timestamp

The -mtime, -atime, and -ctime options search for files based on their modification, access, and inode change times respectively. The time is specified in days, prefixed with:

• + – older than
• - – newer than
• (no prefix) – exactly that many days ago

This command finds files that were modified within the last 7 days:

find . -mtime -7

And this one finds files that haven‘t been accessed in over 30 days:

find . -atime +30

To search based on minutes instead of days, use -mmin, -amin, -cmin.

Finding Files by Permissions

The -perm option searches for files with specific permissions. The permissions can be specified in octal format or using symbolic notation.

To find files with read and write permissions for owner but not for group/others:

find . -perm 600

Or using symbolic notation:

find . -perm u=rw,g=,o=

You can also search for files that match any of multiple permission criteria using -o (or). This finds files that are writable by either their owner or group:

find . -perm /u=w -o -perm /g=w

Finding Files by Owner and Group

The -user and -group options restrict the search to files owned by a specific user or group. For example, to find all files under /home owned by user "john":

find /home -user john  

And to find files belonging to the "dev" group:

find . -group dev

You can also search by numeric UID/GID instead of names.

Combining Find with Other Commands

A powerful feature of find is the ability to combine it with other commands for filtering and processing search results. This is done with the -exec option, which executes a command for each file found.

For example, to search for .log files and view them with less:

find /var/log -name "*.log" -exec less {} \;

{} represents the filename and \; terminates the command.

You can also use xargs to build and execute command lines from find output:

find . -name "*.bak" | xargs rm

This deletes all .bak files found.

The grep command is often used with find to further filter results based on file content. To search for .txt files containing the word "error":

find . -name "*.txt" -exec grep -l "error" {} +

-l makes grep output only filenames and + terminates the command.

Using Regular Expressions

For even more advanced file searching, you can use regular expressions with find. The -regex option matches the entire path against a regex and -iregex makes it case-insensitive.

This command finds all .jpeg and .jpg files:

find . -regex ".*.jp(e)?g"

You can use POSIX character classes like [[:alnum:]] for alphanumeric characters, [[:space:]] for whitespace and so on.

To find file names containing only digits:

find . -regex ".*/[[:digit:]]+$"

$ anchors the match at the end of the filename.

Practical Examples

Now let‘s look at some practical examples of using find to automate common sysadmin tasks.

To find and delete all .mp3 files last modified over 90 days ago:

find . -name "*.mp3" -mtime +90 -exec rm {} +

To find all .pdf files and copy them to a directory:

find /home -name "*.pdf" -exec cp {} /path/to/dest \; 

To find and compress all .log files older than 30 days:

find /var/log -name "*.log" -mtime +30 -exec gzip {} \;

To find all empty subdirectories and delete them:

find . -type d -empty -delete

Finally, this script finds the 5 largest files in a directory and displays their sizes:

#!/bin/bash

find . -type f -exec du -Sh {} + | sort -rh | head -n 5

du -Sh displays sizes in human-readable format and sort -rh sorts them in reverse order.

Conclusion

As you can see, find is an extremely versatile command for locating files in Linux. Its rich set of options and ability to combine with other commands make it indispensable for any Linux user.

Some key points to remember:

• find searches recursively by default. Use -maxdepth to limit the depth.
• The -o operator performs a logical OR between tests while -a (default) does an AND.
• Be careful with -exec. Test your commands thoroughly before running them, especially when deleting files.
• When in doubt, consult the find man page (man find) for all available options.

I hope this guide has helped you master the find command and boosted your Linux file-sleuthing skills. Happy searching!