find
FilesPackage: findutils
Walks a tree and selects files by their properties: name, size, date, owner, permissions. Each test is an option, and -exec or -delete acts on what is left; run it without the action first.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
find -type- Restricts to the given type:
fregular file,ddirectory,lsymbolic link. find -name- Filters on the file name with a shell pattern (
*.log). Quote it so the shell does not expand it first. find -perm- Filters on permission bits.
-perm -4000finds *setuid* binaries — those that run with their owner’s rights. find -user- Filters on the file’s owner.
find -xdev- Does not descend into other filesystems. Without it, a search from
/wanders into/proc,/sysand network mounts. find -exec- Runs a command on each result.
{}is the path found, and\;ends the command. find -print- Prints the path found. It is the default; you write it when other actions are combined.
find -print0- Separates results with a null byte instead of a newline — the one character a filename cannot contain. With
xargs -0, that is what makes a name containing a space survive. find -printf- Chooses the output format rather than the path alone.
-printf '%T@ %p\n'puts the timestamp first, so the results can be sorted by age. find -mtime- Filters on last-modified time, in days.
-mtime +30is older than 30 days;-mtime -2is newer than 2. find -delete- Deletes the files found. Only add it after running the same search with
-printand reading the list: it asks for no confirmation. find -iname- Like
-name, but ignoring case.-iname "*.LOG"also findserrors.log. find -maxdepth- Limits the descent to that many levels.
-maxdepth 1looks only at the named directory, without entering its subdirectories. find -size- Filters on size.
-size +100Mis larger than 100 MiB, about 105 MB —Mcounts mebibytes. The suffix matters twice over, because without one the unit is a 512-byte block, not a byte. find -newermt- Modified after the given date, written plainly:
-newermt '2026-08-01', or-newermt '2 hours ago'. Easier to read than-mtimeas soon as you are looking around a specific moment. find -newer- Keeps only files modified after a reference file.
-newer /var/lib/dpkg/statusgives what moved since the last package operation. find -newerct- Compares the file’s *inode change time* against the given date, rather than its modification time. This is the variant that survives a
touch -d, which only sets the latter.
Lessons that teach it
- Finding filesLinux Fundamentals
- Creating and removing accountsUsers, sudo and SSH access
- Quotes are not optionalBash scripting for administrators
- Files, retention and off-site copiesBackups and restores
- The periodic checkFirewall and hardening
- Telling what changed on diskFirewall and hardening
- Two logs that say 14:02: a timestamp is not a numberDiagnosing a failure: what each output proves
- How wide a fix may be, and the record it leavesDiagnosing a failure: what each output proves