find Cheatsheet - Linux File Search Reference
find is the go-to for locating files, but it recurses everywhere and follows symlinks, which has traps. This table covers filtering by name, type, size, time, and permission, plus using -exec to act on matches — so you use find fast and safely.
By Name 6
find . -name "file.txt"find . -iname "file.txt"find . -name "*.log"find . -name "file*"find /var/log -name "*.gz"find . -maxdepth 2 -name "*.log"By Type 5
find . -type ffind . -type dfind . -type lfind . -type f -name "*.sh"find . ! -type dBy Size 5
find . -size +100Mfind . -size -1kfind . -emptyfind . -size 0find . -size +10M -size -100MBy Time 5
find . -mtime -7find . -mtime +30find . -mmin -60find . -atime -1find . -newer file.txtBy Permission 4
find . -perm 755find . -perm -u+xfind . -perm /o+wfind . -perm -g=wBy Owner 5
find . -user tomfind . -group devfind . -uid 1000find . -nouserfind . -nogroupActions 7
find . -name "*.tmp" -deletefind . -name \"*.sh\" -exec chmod +x {} \;find . -name \"*.log\" -exec rm {} +find . -name "*.txt" -printfind . -name \"*.bak\" -ok rm {} \;find . -name node_modules -prune -o -name "*.js" -printfind . -type f -exec ls -lh {} + | sort -k5 -rhTypical Use Case
When a live disk alert climbs to 90 percent but you are not sure which directory is growing, that is the most common use case for find. Start with du for the directory overview, then list files over 1G directly with find . -type f -size +1G, and use -mtime -3 to find files touched in the last three days — often an abnormal log or temp file. Once you find the culprit, pair -exec or -delete to clear stale .log/.tmp files in one pass, far more efficient than browsing directories on a full disk.
Command Examples
List files larger than 1GB below the current directory
find . -type f -size +1G-size +1G 匹配大于 1G 的普通文件;取消 -type f 则会连带把大目录也算进去。
Output
./backup/dump.sql ./media/concert_4k.mp4
Find config files modified in the last 3 days
find /etc -type f -mtime -3-mtime -3 表示最近 3 天内(含)修改过,=3 是恰好 3 天前,+3 是 3 天之前,方向别弄反。
Output
/etc/nginx/nginx.conf /etc/hosts
Delete log files older than 30 days
find /var/log -name "*.log" -mtime +30 -delete-delete 是真实的删除操作且无输出,建议先去掉该参数跑一遍确认命中范围,再用 -exec rm {} \; 或直接启用。
Common Pitfalls
- find recurses the whole tree by default and can be slow on big directories; limit depth with -maxdepth or prune skipped dirs with -prune.
- The -mtime N semantics vary: -3 is within the last 3 days, 3 is exactly 3 days ago, +3 is more than 3 days ago — mixing them up selects the wrong range.
- -exec and -delete really change files; list matches without them first, then enable deletion or actions after confirming.
- Symlinks are not followed by default; use -L or -follow if you need to, otherwise targets can be missed.
- find matching differs from shell glob; quote patterns with single quotes so they are not expanded early when matching names with spaces.
Tips
- find searches the current directory recursively by default; use -maxdepth 1 to limit it to the current directory only.
- In -exec, {} stands for the found file; \; runs the command per file, while + batches them.
- Preview with -print before deleting, to confirm matches and avoid accidental deletion.
FAQ
How do I choose between find -exec and xargs?
For small result sets and simple commands, run them inside find with -exec {} + or -exec {} \;. For large sets or complex per-item handling, pipe to xargs — be sure to combine -print0 on the find side with -0 on the xargs side, otherwise filenames containing spaces or newlines break the command.
How do I safely delete the files that find matches?
The safest way is adding -delete to the find command, which removes the matched files in place without going through an alias. If you need a pipeline, prefer find ... -print0 | xargs -0 rm. Avoid bare xargs rm or wrapping find in command substitution, which mishandles or fails on unusual filenames.
How do I find several file types (such as txt and log) at once with find?
Wrap the individual -name rules with the -o operator inside a pair of parentheses and pair that with the implicit -a, for example placing the -name for txt and the -name for log inside one parenthesized group followed by -type f. Without the parentheses, -o mixes with -a in a precedence that rarely matches what you intend.
Why does find -name differ from matching the full path?
-name matches only the base filename and ignores the directory part, whereas -path matches the full path. When filtering on multi-level paths or excluding directories, use -path together with -prune, and limit the scope with -maxdepth to avoid scanning the entire filesystem.
What do the sign and number mean for find -mtime and -mmin when filtering by modification time?
-mtime N selects files modified within the 24-hour window N days ago, -mtime -N means within the last N days, and -mtime +N means older than N days. For minute precision use -mmin, for example -mmin -30 selects files modified in the last 30 minutes. Note -mtime rounds to whole days, so boundary values are easy to misread.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us