The find command: search for files in Linux

find walks through folders and lists every file that matches your conditions. It is the tool for questions like "where is that config file?", "what is filling the disk?" or "which files did the app change today?". This guide covers the options you will use most on a server, with examples you can copy.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9. find is installed on all of them.
• An SSH session. Searching system folders such as /etc or /var/log fully needs sudo, or you will see "Permission denied" lines.

The basic shape

find [where to look] [conditions] [action]

With no condition, find lists everything under the starting folder:

find /etc/nginx

With no action, it prints the matching paths. Conditions are combined with AND by default.

Search by name

Find a file by exact name:

sudo find / -name nginx.conf

Use wildcards in quotes, so the shell does not expand them first:

find /var/www -name "*.php"

-iname ignores upper and lower case:

find /home -iname "*.jpg"

To hide "Permission denied" noise when searching as a normal user, send errors away:

find / -name "*.conf" 2>/dev/null

Search by type

• -type f: regular files.
• -type d: directories.
• -type l: symbolic links.

find /var/www/example.com -type d -name cache

Search by size

-size uses k, M and G. A + means larger than, a - smaller than:

sudo find /var -type f -size +100M

List them with sizes:

sudo find /var -type f -size +100M -exec ls -lh {} +

For a full disk-space hunt, see Find the largest files and folders.

Search by age

• -mtime -1: content modified in the last 24 hours.
• -mtime +30: modified more than 30 days ago.
• -mmin -60: modified in the last 60 minutes.

find /var/www/example.com -type f -mmin -60

More on timestamps is in Find recently changed files.

Search by owner or permissions

Files owned by a user or group:

sudo find /var/www -user deploy
sudo find /srv -group webteam

Files no current user owns, often left after deleting an account:

sudo find / -xdev -nouser

Files with exact permissions, or with a bit set:

find /var/www -type f -perm 777
find /var/www -type f -perm -o+w

The second example finds anything writable by everyone, which on a web server deserves a closer look.

Combine conditions

Conditions next to each other must all match. Use -o for OR and ! for NOT, with escaped brackets to group:

find /var/log -type f \( -name "*.gz" -o -name "*.1" \)
find /var/www -type f ! -name "*.php"

Exclude folders

-prune skips a folder entirely, which also makes the search faster:

find /var/www -path /var/www/example.com/node_modules -prune -o -type f -name "*.js" -print

The -print at the end is needed so the pruned folder itself is not printed.

To stay on one filesystem and skip /proc, /sys and other mounts, add -xdev:

sudo find / -xdev -type f -size +500M

Act on the results

-exec runs a command on each match. {} stands for the path:

find /var/www/example.com -type f -name "*.sh" -exec chmod 755 {} +

• Ending with + passes many files to one command call. It is fast.
• Ending with \; runs the command once per file. Use it when the command takes only one file.

To be asked before each action, use -ok instead of -exec.

Delete files

-delete removes every match:

find /tmp/myapp -type f -name "*.tmp" -mtime +7 -delete

Check it works

Create a small test tree and search it:

mkdir -p ~/findtest/sub && touch ~/findtest/a.log ~/findtest/sub/b.log ~/findtest/c.txt
find ~/findtest -name "*.log"

The output lists a.log and sub/b.log, but not c.txt. Remove the test folder with rm -r ~/findtest.

Troubleshooting

• Many "Permission denied" lines: you searched folders your user cannot read. Use sudo, or add 2>/dev/null to hide the errors.
• "paths must precede expression": a wildcard was not quoted, so the shell expanded it. Write -name "*.log", with quotes.
• Search takes very long: you started at / and included network or virtual filesystems. Add -xdev or start in a narrower folder.
• Nothing found with -size -1M: sizes round up to whole units, so only empty files are smaller than 1M. Use -size -1024k.

Next steps

• Clean up automatically: Delete files older than X days.
• Search inside files instead: Search text inside files with grep.