Linux command: find

You know a file is somewhere on the server. Maybe it is a config changed last night, a giant log filling the disk, or every .jpg buried three folders deep. Clicking through directories would take an hour. One command walks the entire tree for you and finds them all in seconds, by name, by size, by age, by anything: find.

2. Where the Name Comes From

Unlike its cryptic neighbours grep, awk, and sed, the name find is not an acronym or an in-joke. It is simply the plain English verb. The early Unix authors, who loved short names, could not make this one much shorter, so they left it as the ordinary word for the ordinary task: to find things.

There is a small twist worth knowing, though. The name suggests the tool only locates files, but that undersells it. From its earliest days find could also run a command on each match. So a better way to read the name is "find each file that matches, and then do this to it". That second half is where most of its power lives.

Read the command as a sentence: find WHERE WHAT-TO-MATCH WHAT-TO-DO. Start here, match files like this, then act on them like that. Once you see that shape, every find command becomes easy to read.

4. Simple Use Cases

4.1 The Simplest Possible Use

Give find a starting directory and nothing else. It prints every file and folder underneath it, one full path per line:

$ find /etc/ssh
/etc/ssh
/etc/ssh/sshd_config
/etc/ssh/ssh_config
/etc/ssh/ssh_host_rsa_key

On GNU find you can even leave out the path, and it searches the current directory . by default:

$ find
.
./notes.txt
./sub
./sub/report.pdf

This bare listing is already useful, but the point of find is to narrow it with a test.

4.2 Find by Name

The -name test matches the file's name against a pattern. The pattern uses shell wildcards (* for any characters, ? for one), not regular expressions. Always quote the pattern so the shell hands it to find untouched:

$ find /var/www -name "*.php"
/var/www/index.php
/var/www/admin/login.php

To ignore case, use -iname (short for insensitive name). This is the version to reach for when you are not sure how a file was capitalised:

$ find . -iname "readme*"
./README.md
./docs/readme.txt

4.3 Find by Type

The -type test limits results to one kind of entry. The two you will use most are f for a regular file and d for a directory:

$ find /var/log -type f -name "*.log"
/var/log/syslog
/var/log/nginx/access.log

Here -type f makes sure a folder that happens to be named something.log is not included. The full list of type letters:

4.4 Limit How Deep to Search

By default find descends the whole tree, however deep it goes. The -maxdepth option (short for maximum depth) stops it after a set number of levels. The starting directory is depth 0, its direct contents are depth 1, and so on:

$ find . -maxdepth 1 -type f
./notes.txt
./config.yml

This lists files in the current folder only, without diving into subfolders. Its partner -mindepth (short for minimum depth) does the opposite and skips the shallow levels. Put these options before the tests; GNU find warns if they come later.

6. Advanced Use Cases

6.1 Running a Command on Each Match with -exec

The real power of find is -exec, which runs a command on every file it finds. Inside the command, the placeholder {} stands for the current file, and the command ends with an escaped semicolon \;:

$ find . -name "*.tmp" -exec rm {} \;

This runs rm once for every .tmp file. That works, but starting a new process per file is slow when there are thousands of them. The + form fixes this: it collects as many files as fit and passes them to a single command, exactly like xargs does:

$ find . -name "*.tmp" -exec rm {} +     # one rm for many files, much faster

Use \; when the command must see one file at a time, and + when the command accepts a list and you want speed. There is also -execdir, which runs the command from inside each file's own directory. That is safer against tricks played by odd path names, and it is the better choice in scripts.

6.2 Confirm Before Acting, and Delete Safely

For dangerous actions, -ok works like -exec but asks you to confirm each file before it runs:

$ find . -name "*.bak" -ok rm {} \;
< rm ... ./old.bak > ?

GNU find also has a built-in -delete that removes matches without spawning rm at all. It is convenient but unforgiving, so build the command as a search first, look at the output, and only then swap -print for -delete:

$ find . -name "*.tmp" -print      # LOOK first
$ find . -name "*.tmp" -delete     # then delete, once you trust the list

6.3 The Safe Pipe: -print0 and xargs -0

Piping find into another tool is common, but a plain pipe splits on spaces and newlines, so a file named my report.pdf breaks into two. The fix is the null-separated pair: -print0 ends each result with an invisible null byte instead of a newline, and xargs -0 reads that same separator:

$ find . -name "*.log" -print0 | xargs -0 gzip

No filename can contain a null byte, so this handles spaces, quotes, and newlines without a single surprise. Make it your default whenever find feeds another command through a pipe.

6.4 Pruning: Skipping Whole Branches

Sometimes you want find to avoid an entire folder, such as .git or node_modules, so it does not waste time walking into it. The -prune action tells find "do not descend into this one". The pattern reads oddly at first but is worth memorising:

$ find . -path "*/node_modules" -prune -o -name "*.js" -print
./src/app.js
./src/util.js

Read it as: if the path is a node_modules folder, prune it (skip its contents); otherwise, if the name ends in .js, print it. The explicit -print at the end is required here, because once you use an action like -prune, find no longer prints automatically.

6.5 Matching with Real Regular Expressions

If shell wildcards are not enough, -regex matches the whole path against a regular expression. Note that it tests the entire path, not just the name, so remember to allow for the leading directories:

$ find . -regextype posix-extended -regex ".*/[0-9]{4}-[0-9]{2}-[0-9]{2}\.log"
./logs/2026-07-11.log

The -regextype option chooses the dialect; posix-extended behaves like grep -E. This is a GNU feature, so avoid it in scripts that must also run on macOS or BSD.

6.6 How find Handles Symbolic Links

By default find looks at a symbolic link itself, not the file it points to, and it never walks through a link into another folder. Three options, placed before the path, change this:

$ find -L /var/www -name "*.php"     # follow links into shared folders too

Because -type l matches a link by looking at the link itself, it cannot tell whether the target still exists. For that, use -xtype l (short for the type after following the link), which reports links whose target is missing. It is the quick way to hunt down broken symlinks after files were moved or deleted:

$ find /var/www -xtype l
/var/www/current
/var/www/logs/latest.log

8. Best Practices

• Always quote name patterns. Write -name "*.log", not -name *.log, or the shell expands the * before find ever sees it.
• Put the cheapest test first. Lead with -name or -type so expensive tests and -exec only run on files that already matched.
• Preview before you act. Build the command with -print, check the list, and only then change it to -delete or -exec rm.
• Prefer -exec ... + over -exec ... \; when the command accepts many files. It runs far fewer processes and is much faster.
• Use -print0 | xargs -0 in pipes. It is the only way to handle filenames with spaces or newlines safely.
• Limit the depth on big trees. -maxdepth and -prune keep a search from wandering into .git, node_modules, or a mounted network drive.
• Use -quit to stop at the first hit. When you only need to know whether any match exists, -quit makes find exit as soon as it finds one, instead of walking the whole tree.
• Add -type f when you mean files. It stops directories and odd entries from sneaking into a result you plan to delete or change.

When you need the full detail, the documentation is one command away:

$ man find        # the full manual page
$ find --help     # a quick summary of every test and action
$ info find       # the long GNU manual with examples

10. Summary

The find command is how you locate files on a Linux system by any property they have, and then act on them in one step.

• find walks a directory tree and tests each entry against a description: name, type, size, age, owner, or permissions.
• Its name is the plain English verb, but it does more than locate: it can run any command on each match.
• The mental model is an expression that reads find WHERE WHAT-TO-MATCH WHAT-TO-DO, evaluated file by file.
• Everyday tests: -name/-iname (by name), -type f or -type d (by kind), -size (by bytes), -mtime/-mmin (by age).
• Tests join with an implicit "and"; use -o, !, and \( \) to build richer conditions.
• -exec {} + runs a command on the matches fast, and -print0 | xargs -0 pipes them safely.
• Order your tests cheapest-first for speed, and always preview with -print before using -delete.
• When in doubt, type man find or find --help.

This is the quick reference worth keeping:

find . -name "*.log"            files named *.log, from here down
find . -iname "readme*"         same, ignoring upper/lower case
find /var -type f -size +100M   regular files larger than 100 MB
find /etc -mtime -1             changed in the last day
find . -mmin -30                changed in the last 30 minutes
find . -type d -empty           empty directories
find . -maxdepth 1 -type f      files in this folder only, no descending
find . \( -name "*.jpg" -o -name "*.png" \)   match either pattern
find . -name "*.tmp" -delete    delete matches (preview with -print first)
find . -name "*.tmp" -exec rm {} +            run one rm for many files
find . -name "*.log" -print0 | xargs -0 gzip  safe pipe for odd names
find . -path "*/.git" -prune -o -name "*.py" -print   skip a whole folder
find . -name "*.conf" -exec grep -l "debug" {} +      find + grep together

Once find feels natural, a Linux server stops hiding things from you. You can track down the file that changed last night, clear out the junk filling a disk, and reach every matching file in a huge tree with a single line. If your servers are holding files that someone needs to locate, clean up, or act on at scale, that is exactly the kind of work I help with.