How to Use the Linux find Command to Locate Files by Size, Date, and Permissions

The Need for Advanced Searching

Navigating a complex Linux server environment often requires finding highly specific files across massive directory structures. While the locate command is incredibly fast for finding files by name, it relies on a pre-built database that is often out of date, and it cannot filter results by file attributes. If you need to find a specific log file that was modified exactly two days ago, or identify every massive video file currently consuming disk space, locate is useless.

For these scenarios, the find command is the definitive tool. Unlike locate, find performs real-time searches by actively traversing the directory tree. More importantly, it supports a vast array of filters, allowing you to locate files based on their size, modification date, ownership, permissions, and type.

In this guide, we will cover the most practical use cases for the find command to help you navigate and maintain your Linux filesystem.

Basic Syntax

The standard syntax for the find command is straightforward:

find [starting_directory] [search_criteria] [action]

• starting_directory: Where the search should begin. Using / searches the entire system. Using . searches the current directory and its subdirectories.
• search_criteria: The filters to apply (e.g., name, size, date).
• action: What to do with the files once found (default is to simply print the file path to the terminal).

Finding Files by Name and Type

Basic Name Search

To find a file named exactly “report.txt” starting from the root directory:

find / -name "report.txt"

Case-Insensitive Search

Linux is case-sensitive, meaning “Report.txt” and “report.txt” are entirely different files. To ignore case during the search, use -iname instead of -name:

find / -iname "report.txt"

Filtering by File Type

Often, you only want to search for files, ignoring directories that might share the same name. You can enforce this using the -type flag.

• -type f : Regular files
• -type d : Directories
• -type l : Symbolic links

To find only directories named “backups”:

find / -type d -name "backups"

Finding Files by Size

One of the most common administrative tasks is freeing up disk space by deleting massive, forgotten files. The -size flag makes this trivial.

• k : Kilobytes
• M : Megabytes
• G : Gigabytes

To find all files in the /var/log directory that are larger than 500 Megabytes (using the + symbol):

find /var/log -type f -size +500M

To find files that are exactly 2 Gigabytes (no prefix symbol):

find / -type f -size 2G

To find files smaller than 10 Kilobytes (using the - symbol):

find . -type f -size -10k

Finding Files by Modification Date

If a server is compromised, or an application suddenly stops working, administrators often need to know exactly which configuration files were altered in the last 24 hours. The -mtime (modification time) flag is perfect for this.

To find all files modified exactly 5 days ago:

find /etc -mtime 5

To find all files modified within the last 2 days (less than 48 hours ago):

find /var/www -mtime -2

To find all files modified more than 30 days ago (useful for finding stale data to archive):

find /home/user/Downloads -mtime +30

Note: You can also use -mmin to search by minutes instead of days. For example, -mmin -60 finds files modified in the last hour.

Finding Files by Permissions and Ownership

Security audits require identifying files with dangerous permission levels. The -perm flag checks exact numerical permissions.

To find any file on the system that is globally writable (a massive security risk, typically represented by permission level 777):

find / -type f -perm 777

To find files owned by a specific user (e.g., finding files belonging to a departing employee so they can be archived):

find / -user john_doe

Executing Actions on Found Files (-exec)

Finding files is useful, but automating actions on them is where find truly shines. The -exec flag allows you to run a standard Linux command on every single file that matches your criteria.

Suppose you want to find all .log files older than 30 days and instantly delete them. You can string the commands together:

find /var/log -type f -name "*.log" -mtime +30 -exec rm {} \;

Let’s break down the end of that command:

• rm is the delete command.
• {} is a placeholder representing the current file find has located.
• \; marks the end of the -exec command block (the backslash is required so the shell does not interpret the semicolon).

Warning: Always run the command without the -exec block first to review the list of files and ensure you are not about to delete something critical.

Conclusion

The find command is a cornerstone of Linux system administration. While its syntax can feel complex initially, mastering the -name, -size, -mtime, and -exec flags grants you unparalleled visibility and control over your filesystem, allowing you to instantly locate needles in massive digital haystacks.