VMware ESXi and vSphere Cluster Management

Search for Files in Linux Using the find Command

Learn how to use Linux find to search directory trees by name, size, ownership, permissions, file type, and combined criteria.

What the find Command Does

find is a Linux command that recursively searches a directory tree for files and directories. It examines the filesystem when you run it, rather than consulting a prebuilt list of filenames.

This live search makes find flexible: it can test names, sizes, owners, groups, permissions, and object types in one command. The trade-off is that a large search can take time because find visits directories and entries as it runs.

The locate command is often faster because it usually consults a maintained filename database. However, that database may not include recently created, moved, or deleted files until its index is updated. Use find when you need current filesystem results or detailed filtering.

Basic Syntax

find PATH EXPRESSION

PATH is the directory where traversal begins. An absolute path such as /home starts at that exact location. A relative path such as projects is interpreted from the current directory. The special path . means the current directory.

An expression is a test, logical operator, or action. Tests decide whether each filesystem entry matches. This lesson focuses on search tests; actions can be added later to perform operations on matching entries.

find . -name "report.txt"

This command starts in the current directory and searches every nested directory for an entry named exactly report.txt.

Searching by Name

Case-Sensitive Name Matching with -name

-name matches the name of a file or directory using a case-sensitive shell-style pattern. It does not require the complete name to be literal; wildcard characters can represent variable parts.

find . -name "so*"
find . -name "*.log"
find . -name "*backup*"

• "so*" matches names beginning with so.
• "*.log" matches names ending in .log.
• "*backup*" matches names containing backup.

A wildcard is a pattern character such as * that can match a variable portion of a name. Quote wildcard patterns so the shell passes the pattern to find unchanged. Without quotes, the shell may expand *.log to matching names in the current directory before find runs, producing unintended behavior.

find . -name "so*"

This searches the current directory tree for all files and directories whose names begin with so.

Case-Insensitive Matching with -iname

-name treats uppercase and lowercase letters as different. Use -iname when capitalization should not matter.

find . -type d -iname "projects*"

This finds directories whose names begin with projects, including names such as Projects or PROJECTS-old.

Restricting Results to Files or Directories

By default, find can return both regular files and directories. Use -type when you need a particular kind of filesystem object.

• -type f matches regular files.
• -type d matches directories.

find . -type f -name "*.conf"
find . -type d -name "cache*"

The first command searches only regular files ending in .conf. The second searches only directories whose names begin with cache.

Searching by File Size

The -size test filters entries by size. Add a unit suffix to make the intended unit clear:

For example, +300c means larger than 300 bytes, while -10M means smaller than 10 megabytes. When using larger units such as kilobytes or megabytes, remember that find applies its unit-based size rules and may round values to the selected unit. Use the byte unit when you need a precise byte threshold.

find . -type f -size +300c

This finds regular files larger than 300 bytes. A size search may appear to miss an expected file if the wrong suffix or comparison prefix was used, so check whether the requirement is bytes, kilobytes, megabytes, or gigabytes and whether the comparison should be exact, greater than, or less than.

Searching by Ownership

Owner, Numeric User ID, and Group

Linux records an owner and a group for filesystem entries. Use -user with a username, -uid with a numeric user ID, or -group with a group name.

find /path/to/search -user username
find /path/to/search -uid 1001
find /path/to/search -group developers

Replace username, 1001, and developers with values from your system. Numeric IDs are useful when accounts are identified by IDs or when a username is unavailable.

Searching by Permissions

Linux permissions control read, write, and execute access for three classes: the owner, the group, and others. Symbolic notation writes these classes as u, g, and o. For example, rwxr-xr-x grants the owner read, write, and execute access, while the group and others have read and execute access.

Octal permissions use one digit for each class. The values are 4 for read, 2 for write, and 1 for execute; values are added within each class. Therefore, 775 means:

• 7 for the owner: read, write, and execute.
• 7 for the group: read, write, and execute.
• 5 for others: read and execute.

find /path/to/search -perm 775

With a mode written without a prefix, such as -perm 775, the usual meaning is an exact permission-mode match: the relevant permission bits must equal 775. GNU find also supports permission-bit matching:

• -perm -775 matches entries with every bit in 775 enabled, even if additional permission bits are enabled.
• -perm /775 matches entries with at least one bit from 775 enabled.

Permission syntax and supported forms can vary slightly between Unix-like systems, so consult the local find manual when portability matters.

Combining Search Expressions

Multiple compatible tests placed next to each other have implicit AND behavior. An entry must satisfy every test to be returned.

find . -name "t*" -perm 775

This finds entries whose names begin with t and whose permission mode is exactly 775.

You can make the logic explicit with -and, choose alternatives with -or, and negate a test with !.

find . -type f -and -name "*.log"
find . -type f \( -name "*.log" -or -name "*.txt" \)
find . ! -name "*.tmp"

Parentheses group alternatives, but they must be escaped or quoted so the shell does not interpret them. The second example matches regular files ending in either .log or .txt. The third excludes names ending in .tmp.

Safe Command-Line Usage

Quote Patterns and Paths

Quote wildcard patterns such as "*.log", "so*", and "*backup*". Also quote a starting path containing spaces:

find "My Documents" -type f -name "*.txt"

Single quotes and double quotes both protect spaces and wildcard characters in ordinary cases. For example, find . -name '*.log' is also valid.

Choose a Narrow Starting Path

Begin with the narrowest suitable directory, such as a project directory or your home directory, rather than immediately searching from /. A broad search walks many more entries, can be slow, and may encounter directories your account cannot read.

find /home/username/projects -type f -name "*.py"

Permission-denied messages mean the current user cannot read one or more directories in the traversal. Search accessible paths, adjust permissions when appropriate, or use elevated privileges only when there is a clear administrative reason. Do not use elevated access merely to avoid understanding which paths are readable.

Troubleshooting Common Problems

• Unexpected wildcard results: quote the pattern, such as find . -name "*.log", so the shell does not expand it first.
• Directories appear in a file search: add -type f. Use -type d when you want directories.
• No result because of capitalization: replace -name with -iname.
• The search is slow: use a more specific starting path and add restrictive tests such as -type f and -name.
• Permission-denied messages: limit the search to accessible paths or address access deliberately.
• Unexpected size matches: verify the unit suffix and comparison prefix. Use c for bytes and add + or - for thresholds.

Quick Reference

find PATH EXPRESSION
find . -name "so*"
find . -type f -size +300c
find /path/to/search -user username
find /path/to/search -perm 775
find . -name "t*" -perm 775
find . -type d -iname "projects*"