Linux find command

On Unix-like operating systems, the find command searches for files and directories in a file system.

This page covers the GNU/Linux version of find.

Description

find locates files on your system. Within each directory tree specified by the given paths, it evaluates the given expression from left to right, according to the rules of precedence (see "Operators", below) until the outcome is known. The outcome is "known" when the left side of the expression is determined to be FALSE for AND operations, or TRUE for OR operations. At that point find moves on to the next path until all paths are searched.

find is a fundamental and extremely powerful tool for working with the files on your linux system. It can be used on its own to locate files, or in conjunction with other programs to perform operations on those files.

Syntax

find [-H] [-L] [-P] [-D debugopts] [-Olevel] [path...] [expression]

Options

The -H, -L and -P options control the treatment of symbolic links. Arguments following these are taken to be names of files or directories to be examined, up to the first argument that begins with "-", or the argument "(" or "!". That argument and any following arguments are taken to be the expression describing what is being searched. If no paths are given, the current directory is used. If no expression is given, the expression -print is used (but consider using -print0 instead. More information on this below).

The arguments in the expression list are also referred to as "options," but the five "real" options -H, -L, -P, -D and -O must appear before the first path name, if they are used at all. A double-dash ("--") can also be used to signal that any remaining arguments are not options (though ensuring that all start points begin with either "./" or "/" is generally safer if you use wildcards in the list of start points).

If more than one of -H, -L and -P is specified, each overrides the others; the last one appearing on the command line takes effect. Since it is the default, the -P option should be considered to be in effect unless either -H or -L is specified. GNU find frequently stats files during the processing of the command line itself, before any searching has begun. These options also affect how those arguments are processed. Specifically, there are many tests that compare files listed on the command line against a file we are currently considering. In each case, the file specified on the command line is examined and some of its properties is saved. If the named file is in fact a symbolic link, and the -P option is in effect (or if neither -H nor -L were specified), the information used for the comparison is taken from the properties of the symbolic link. Otherwise, it is taken from the properties of the file the link points to. If find cannot follow the link (for example, because it has insufficient privileges or the link points to a nonexistent file) the properties of the link itself is used.

When the -H or -L options are in effect, any symbolic links listed as the argument of -newer is dereferenced, and the timestamp is taken from the file that the symbolic link points. The same consideration applies to -newerXY, -anewer and -cnewer.

The -follow option has a similar effect to -L, though it takes effect at the point where it appears (that is, if -L is not used but -follow is, any symbolic links appearing after -follow on the command line is dereferenced, and those before it won't).

Expressions

The expression is made up of options (which affect overall operation rather than the processing of a specific file, and always return true), tests (which return a true or false value), and actions (which have side effects and return a true or false value), all separated by operators. -and is assumed where the operator is omitted.

If the expression contains no actions other than -prune, -print is performed on all files for which the expression is true.

Expression Options

All options always return true. Except for -daystart, -follow and -regextype, the options affect all tests, including tests specified before the option. This is because the options are processed when the command line is parsed, while the tests don't do anything until files are examined. The -daystart, -follow and -regextype options are different in this respect, and have an effect only on tests which appear later in the command line. Therefore, for clarity, it is best to place them at the beginning of the expression. A warning is issued if you don't do this.

Tests

Some tests, for example, -newerXY and -samefile, allow comparison between the file currently being examined and some reference file specified on the command line. When these tests are used, the interpretation of the reference file is determined by the options -H, -L and -P and any previous -follow, but the reference file is only examined once, at the time the command line is parsed. If the reference file cannot be examined (for example, the stat system call fails for it), an error message is issued, and find exits with a nonzero status.

Where n is used as a numeric argument, it can be specified as:

Tests are as follows:

find . -path "./sr*sc"

find . -path ./src/emacs -prune -o -print

find bar -path /foo/bar/myfile -print

Actions

Handling Unusual File Names

Many of the actions of find result in the printing of data that is under the control of other users. This includes file names, sizes, modification times and so forth. File names are a potential problem since they can contain any character except '\0' and '/'. Unusual characters in file names can do unexpected and often undesirable things to your terminal (for example, changing the settings of your function keys on some terminals). Unusual characters are handled differently by various actions, as described below:

The -ok and -okdir actions print the current file name as is.

Operators

The following find operators are listed in order of increasing precedence:

Environment Variables

Examples

find

When using linux, running the find command without any options locating and print a list of every file in and beneath the current directory. This includes all files in all subdirectories of the current directory.

find .

Same as the above command. The "." explicitly tells find that you want the search to begin in the current directory.

find . /home/jeff /home/stacy

Locate and print all files and directories in and beneath three different starting directories: the current directory, /home/jeff, and /home/stacy.

find /usr/bin /usr/lib -name '*zip*'

Locate and print all files and directories in and beneath either of the directories /usr/bin and /usr/lib which contains the text "zip" anywhere in the file or directory name.

find /home/jeff/fruit | grep 'apple'

This command tells find to locate and print a complete list of all files in and beneath the directory /home/jeff/fruit, and to pipe this listing to grep, which filters out any file name which does not contain the text "apple".

find . -name 'apple'

Locate and print a list of any file in or below the current directory whose name is exactly "apple", all lowercase letters.

find . -iname 'apple'

Locate and print a list of any file in or below the current directory whose name is "apple", but match the letters case-insensitively. Therefore, files or directories named "Apple", "ApplE", and "ApPLe" are listed by this command.

find . -name 'apple' -type f

Locate and print a list of files in or below the current directory whose name is "apple"; do not display directories, sockets, or other non-regular file types.

find . -name 'apple' -type d

Locate a print a list of directories in or below the current directory whose name is "apple"; do not display regular files, or file types other than directory entries.

find . -group dev

Locate and print a list of any file in or below the current directory whose owning group is the dev group.

find . -L

Locate and print a list of any file in or below the current directory, and follow symbolic links. In other words, display information about the file a symbolic link links to, rather than information about the symlink itself.

find . -atime +1

Locate and print a list of any file in or below the current directory that was last accessed more than 1 day ago.

find . -atime -1

Locate and print a list of any file in or below the current directory that was last accessed less than 1 day ago.

find . -amin +5

Locate and print a list of any file in or below the current directory that was modified more than 5 minutes ago.

find . -amin -5

Locate and print a list of any file in or below the current directory that was modified fewer than 5 minutes ago.

find . -perm 754

Locate and print a list of any file in or below the current directory whose octal permission bits are 755 (user can read, write, and execute; owning group members can read and execute; others can read only). For more information about permission bits, see chmod.

find . -perm u=rwx,g=rx,o=r

Same as the above command, but uses a symbolic representation of the permission bits. Note that the symbolic notation uses a comma separator and contains no spaces.

find . -size +1M -type f

Locate and print a list of any regular file in or below the current directory whose size is greater than 1 megabyte.

find . -size -5G -type f

Locate and print a list of any regular file in or below the current directory whose size is less than 5 gigabytes.

find . -user jeff

Locate and print a list of any file or directory in or below the current directory owned by the user jeff.

find . -size +1G -exec mv '{}' ~/bigfiles \;

Locate any files in or below the current directory whose size is greater than 1 gigabyte, and execute the mv command on them, moving them into the directory bigfiles in your home directory. The {} indicates where in the command the name of the matched file should be placed; it must be enclosed in quotes to protect it from being misinterpreted by the shell. Similarly, the semicolon which ends the command must be escaped with a backslash ("\;").

find . -size +1G -print0 | xargs -0 -I '{}' mv '{}' ~/bigfiles

Locate any files in or below the current directory whose size is greater than 1 gigabyte, then pipe that list to the xargs command, which uses the mv command to move each one of those files into the directory bigfiles in your home directory. This is similar to the above command, but better for several reasons. First, it uses the -print0 option to tell find to create its list separating each file name with a null character rather than a newline; this makes the list difficult for a human to read, but has the advantage of making it easier for another program to parse. Always use -print0 when piping output to xargs.

Using xargs to execute commands on every file found is generally better than using find's -exec option because of the more efficient way xargs threads each command that it spawns.

The -0 argument to xargs tells it to expect the null character as the file name separator (which we specified with find's -print0 option).

The -I '{}' option tells xargs to replace "{}" with the name of each file it finds. We then form our command using {} where we want the file name to appear. We enclose it in single quotes to protect it from the shell.

xargs does not expect a semicolon at the end of the command, unlike find -exec, so it is not included in this command.

find . -size +1G -ok mv '{}' ~/bigfiles \;

Using -ok is the same as using -exec, but you are asked for confirmation before each command is executed.

find . -name '*.jpg' -o -name '*.gif'

Locate any files in or below the current directory whose suffix is ".jpg" or ".gif". The -o option functions as a boolean OR operator; if either of the conditions are true, the file is included in the list.

find . -maxdepth 2 -name '*.jpg'

Locate any files in or below the current directory whose suffix is ".jpg", but limit subdirectory traversal to 2 levels beneath the current directory. Any subdirectories 3 or more levels deep aren't searched.

find . ! -name '*.jpg'

Locate any files in or below the current directory whose suffix is not ".jpg". The exclamation mark ("!") functions as a boolean NOT operator; it lists only files for which the condition is false.

find /tmp -name core -type f -print0 | xargs -0 /bin/rm -f

Find files named core in or below the directory /tmp and delete them. The -name test comes before the -type test to avoid having to call stat on every file.

find $HOME -mtime 0

Search for files in your home directory which were modified in the last twenty-four hours. This command works this way because the time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to match -mtime 0, a file has to have a modification in the past that is less than 24 hours ago.

find /sbin /usr/sbin -executable ! -readable

Search for files in your superuser binary directories, /sbin and /usr/sbin, which are executable but not readable.

Suppressing Error Messages When Using find

One last tip for using find: you receive an error message if find encounters a file or directory you don't have access to view. The error message looks like this:

find: `./tmp/sysfile-PKdhtXMmr18n': Permission denied

You might not want these messages in your output; they can make it difficult to parse your actual find results.

For these examples, we'll assume you're using bash as your shell, which is the default under linux. Let's say your command is this simple one:

find .

If the results of this command are giving you "Permission denied" errors, the simplest way to filter them out is to send them all to /dev/null, which is the device on linux which points to nowhere. Your command would look like this:

find . 2>/dev/null

Here, 2> is a special operator in bash which means "redirect standard error". This effectively hides all error messages from find's output.

You might not want to hide every error message, though. What if there's another error of some kind? You don't want to suppress those messages too. In that case, you can use this command instead:

find . 2>&1 | grep -v 'Permission denied'

Here, 2> tells bash to redirect standard error, and &1 tells it to use standard output as the destination. This redirects all error messages issued by find to standard output; this looks the same on your terminal screen, but by merging them with standard output, we have made them filterable by grep. So we then pipe the output of find to grep, which matches the inverse (-v) of our string, 'Permission denied'. The result is that it displays any line which does not contain that string. This allows you to view your results without any pesky "Permission denied" error messages.

Related commands

chmod — Change the permissions of files or directories.
cpio — Copy files to or from archives.
locate — Search a local database to find files by name.
ls — List the contents of a directory or directories.
sh — The Bourne shell command interpreter.
whereis — Locate the binary, source, and manual page files for a command.
which — Locate the binary of a command.
xargs — Build and execute complex commands, and execute them on multiple files.