Linux find Command: Search Files with Every Option (2026)

The find command in Linux isn’t just about finding files; it’s a dynamic expression engine that builds a search query on the fly, allowing you to filter files based on an astonishingly granular set of criteria.

Let’s see it in action. Imagine you need to find all .log files in your /var/log directory and its subdirectories that were modified in the last 24 hours, are larger than 1MB, and don’t have the word "error" in their name.

find /var/log -type f -name "*.log" -mtime -1 -size +1M \! -name "*error*" -print

This command will output a list of files that perfectly match all those conditions.

The core problem find solves is managing and locating files within a hierarchical filesystem when manual browsing is impractical. It’s the ultimate grep for filenames and file metadata.

Here’s how it works internally. find traverses a directory tree, starting from the paths you provide (e.g., /var/log). For each file or directory it encounters, it evaluates a series of tests and actions. These tests are the conditions you specify (like -type f, -name "*.log"), and actions are what find does with the files that pass all the tests (like -print to show them, or -exec to run another command). The order of these tests matters, as find evaluates them from left to right.

Let’s break down the common options and how they give you precise control:

• Pathname Traversal:

  • find /home/user: Starts searching from /home/user.
  • find .: Starts searching from the current directory.
  • find /var/log /tmp: Searches in both /var/log and /tmp.

• File Type (-type):

  • -type f: Finds regular files.
  • -type d: Finds directories.
  • -type l: Finds symbolic links.
  • -type s: Finds sockets.

• Name and Path (-name, -iname, -path, -ipath):

  • -name "config.yaml": Finds files named exactly config.yaml. Case-sensitive.
  • -iname "config.yaml": Finds config.yaml or CONFIG.YAML. Case-insensitive.
  • -name "*.conf": Finds files ending with .conf. Wildcards are supported.
  • -path "*/test/*": Finds files whose entire path (including directory names) matches */test/*. This is powerful for targeting files within specific subdirectories.
  • -ipath "*/Test/*": Case-insensitive version of -path.

• Time (-mtime, -atime, -ctime, -mmin, -amin, -cmin):

  • -mtime -7: Finds files modified in the last 7 days (less than 7*24 hours ago). The number is a count of 24-hour periods.
  • -mtime +7: Finds files modified more than 7 days ago.
  • -mtime 7: Finds files modified exactly 7 days ago (between 7*24 and 8*24 hours ago).
  • -mmin -60: Finds files modified in the last 60 minutes.
  • -atime -1: Files last accessed within the last 24 hours.
  • -ctime -1: Files whose status (metadata like permissions or ownership) was last changed within the last 24 hours.

• Size (-size):

  • -size +10M: Finds files larger than 10 Megabytes. Use k for kilobytes, M for megabytes, G for gigabytes.
  • -size -500k: Finds files smaller than 500 Kilobytes.
  • -size 1G: Finds files exactly 1 Gigabyte in size.
  • -empty: Finds empty files or directories.

• Permissions and Ownership (-perm, -user, -group):

  • -perm 644: Finds files with exactly rw-r--r-- permissions.
  • -perm -644: Finds files with at least rw-r--r-- permissions (e.g., 755 would match). This is often more useful.
  • -user bob: Finds files owned by user bob.
  • -group developers: Finds files owned by the developers group.

• Logical Operators (-a, -o, \!, \( ... \)):

  • -name "*.txt" -a -name "*.log": Finds files ending in .txt and .log (this is the default behavior if no operator is specified between tests).
  • -name "*.txt" -o -name "*.log": Finds files ending in .txt or .log.
  • \! -name "*.tmp": Finds files not named *.tmp.
  • \( -name "*.conf" -o -name "*.cfg" \) -a -user admin: Finds files ending in .conf or .cfg AND owned by admin. Parentheses must be escaped or quoted.

• Actions (-print, -print0, -exec, -delete):

  • -print: Prints the full filename, followed by a newline.
  • -print0: Prints the full filename, followed by a null character. Essential for piping to xargs -0 to handle filenames with spaces or special characters.
  • -exec command {} \;: Executes command for each found file. {} is replaced by the filename, and \; terminates the command. This forks a new process for each file.
  • -exec command {} +: Executes command with as many found filenames as possible as arguments. More efficient than \; as it forks fewer processes.
  • -delete: Deletes the found files. Use with extreme caution.

One subtlety that trips many people up is how find handles the order of operations with its logical operators. By default, -a (AND) has higher precedence than -o (OR), and ! (NOT) binds tightly to the following test. So, find . -name "*.txt" -o -name "*.log" is equivalent to find . \( -name "*.txt" \) -o \( -name "*.log" \). However, find . -name "*.txt" -o -name "*.log" -print is interpreted as find . \( -name "*.txt" \) -o \( -name "*.log" -print \). This means it will find .txt files and then print .log files, which is usually not what you want. To ensure correct grouping, always use parentheses \( ... \) when mixing -o with other tests or actions.

The next logical step after mastering complex find queries is understanding how to chain these results with other command-line tools, particularly xargs, for bulk operations on files.