# find: Search for files in a directory hierarchy

Syntax

# find [-H] [-L] [-P] [-D debugopts] [-Olevel] [path...] [expression]

-H: Do not follow symbolic links, except while processing the command line arguments.
-L: Follow symbolic links.
-P: Never follow symbolic links (default).
-D: Print diagnostic information. debugopts = help,tree,stat,opt,rates
-O: Enables query optimization. level = 1 | 2 | 3

The expression is made up of options (return true), tests (return true or false) and actions (return true or false), all separated by operators (-and is assumed where the operator is omitted).

Tests

+n for greater than n
-n for less than n
n for exactly n

-amin n: File was last accessed n minutes ago.
-anewer file: File was accessed more recently than file was modified.
-atime n: File was last accessed n*24 hours ago.
-cmin n: File's status was last changed n minutes ago.
-cnewer file: File's status was last changed more recently than file was modified.
-ctime n: File's status was last changed n*24 hours ago.
-empty: File (regular file or directory) is empty.
-executable: Executable files and searchable directories.
-false: Always false.
-fstype type: File is on a filesystem of type ufs | nfs | tmp | ...
-gid n: File's numeric gid ID is n.
-group gname: File belongs to group gname.
-ilname pattern: File is a symbolic link (insensitive).
-inum n: File has inode number n.
-iregex pattern: Case insensitive match.
-links n: File has n links.
-lname pattern: File is a symbolic link.
-mmin n: File's data was last modified n minutes ago.
-mtime n: File's data was last modified n*24 minutes ago.
-name pattern: Base of the file name.
-newer file: File was modified more recently than file.
-newerxY reference: Compares the timestammp of the current file with reference.
-nogroup: No group corresponds to file's numeric group ID.
-nouser: No user corresponds to file's numeric user ID.
-path pattern: File name matches shell pattern.
-perm mode: File's permission bits are exactly mode.
-perm -mode: All of the permission bits mode are set for the file.
-perm /mode: Any of the permission bits mode are set for the file.
-readable: Matches files which are readable.
-regex pattern: Filename matches regular expression pattern.
-samefile name: File refers to the same inode as name.
-size n[cwbkMG]: File uses n units of space.
-true: Always true.
-type c: File is of type b (block) | c (character) | d (directory) | p (named pipe) | f (regular file) | l (symbolic link) | s (socket)
-uid n: File's numeric user ID is n.
-used n: File was last accessed n days after its status was last changed.
-user uname: File is owned by user uname.
-writable: Matches files which are writable.

Actions

-delete: Delete files.
-exec command {} \; : Execute command (one command execution for each file).
-exec command {} + : Execute command (one command execution with all files as arguments).
-execdir command {} \; : Execute command from the subdirectory containing the matched file (more secure than exec).
-execdir command {} + : Execute command from the subdirectory containing the matched file (more secure than exec).
-fls file: Like -ls but write to file.
-fprint file: Like print but write to file.
-fprint0 file: Like print0 but write to file.
-fprint file format: Like fprint format but write to file.
-ls: List in ls -dils format on standard output.
-ok command: Like -exec but ask the user first.
-okdir command: Like -execdir but ask the user first.
-print: Print the full file name on standard output, followed by a newline.
-print0: Print the full file name on standard output, followed by a null character.
-print format: Print format on standard output.
-prune: If the file is a directory, do not descend into it.
-quit: Exit immediately.

Operators

( expr ): Force precedence.
! expr: Negate expr.
expr1 -a expr2: And operator.
expe1 -o expr2: Or operator.

Examples

# find / -iname '*key*'
# find / \( -amin -5 -o -cmin -5 -o -mmin -5 \) -a \! \( -path "/proc/*" -o -path "/dev/*" \) -execdir file '{}' \;
# find / -perm -4000 -fprint /root/suid.txt
# find / -perm -0002 -a \! -type l -print
# find / -type d -empty
# find / -user www-data -o -group www-data
# find / -size +50M
# find / -type f -a -size -10c -a \! -empty