find Command Cheat Sheet

find . -name '*.log'                       # by name (case-sensitive)
find / -iname 'nginx.conf' 2>/dev/null     # case-insensitive, hide permission errors
find . -type f -mtime -7                   # files changed in the last 7 days
find / -xdev -type f -size +1G             # files over 1 GiB on this filesystem
find . -type f -name '*.tmp' -delete       # delete matches (test without -delete first)
find . -type f -exec grep -l 'TODO' {} +   # run a command on the results

Syntax: find [starting-point...] [tests] [actions]. The starting point defaults to the current directory, and the default action is -print. Tests are combined with an implicit AND. This page covers GNU find from findutils, the version on all mainstream distros.

By name and path

By type, size and emptiness

By time

-mtime counts in 24-hour periods, -mmin in minutes. -N means "less than N ago", +N "more than N ago".

By owner and permissions

Permission numbers explained: Linux file permissions guide and the chmod calculator.

Actions

Common recipes

Largest files on the system when you hit No space left on device (a full script is in find largest files):

sudo find / -xdev -type f -size +200M -printf '%s\t%p\n' 2>/dev/null | sort -rn | head -20 | numfmt --field=1 --to=iec

Delete log files older than 14 days, after checking what would be removed:

find /var/log/myapp -type f -name '*.log' -mtime +14 -print
find /var/log/myapp -type f -name '*.log' -mtime +14 -delete

Fix permissions on a web root: directories 755, files 644:

find /srv/www -type d -exec chmod 755 {} +
find /srv/www -type f -exec chmod 644 {} +

Search file contents only in certain files:

find . -type f -name '*.yaml' -exec grep -Hn 'image:' {} +

Handle names with spaces safely using xargs:

find . -type f -name '*.png' -print0 | xargs -0 -r optipng -o2

Archive files changed in the last week (see the tar cheat sheet):

find ~/projects -type f -mtime -7 -print0 | tar --null -T - -czf recent.tar.gz

Count files per extension:

find . -type f -name '*.*' | sed 's/.*\.//' | sort | uniq -c | sort -rn | head

Find and remove broken symlinks:

find /usr/local/bin -xtype l -print -delete

Gotchas

• Quote the pattern. find . -name *.txt lets the shell expand *.txt first; if a matching file exists in the current directory you search for that exact name, or get "paths must precede expression". Write -name '*.txt'.
• -exec ... {} + vs {} \;. + batches many paths into one command (fast, avoids Argument list too long) but {} must be the last argument before +. \; runs once per file and allows {} anywhere; escape or quote the semicolon so the shell doesn't eat it.
• Order matters for -delete. find . -delete -name '*.tmp' deletes everything, because -delete runs before the name test. Put -delete last, and run the command with -print first.
• -o needs parentheses. find . -name '*.c' -o -name '*.h' -exec rm {} + only applies -exec to .h files, because AND binds tighter than OR. Wrap the alternatives in \( ... \).
• -size rounds up. -size -1M means "0 blocks of 1 MiB", which only matches empty files. Use -size -1024k.
• -mtime +1 means at least 2 days. find drops the fractional part of the age, so "+1" is more than one full day, i.e. 48 hours or older.
• Permission denied noise. Searching / as a normal user prints many errors; add 2>/dev/null or use sudo.

Reference: find(1). For searching inside files, see the grep cheat sheet.

Frequently asked questions