Finding files: find, locate & which

"Where did I put that config file?" "Which logs are eating my disk?" "Delete every .tmp file older than a week." The find command answers questions like these by walking a directory tree and testing every file against rules you give it. We'll also cover quicker tools for finding commands.

Practice tree (create it once):

mkdir -p ~/practice/find && cd ~/practice/find
mkdir -p project/{src,docs,logs,node_modules/lib}
touch project/README.md project/src/{app.py,utils.py,Test.PY} project/docs/guide.md \
      project/node_modules/lib/index.md "project/docs/release notes.md"
head -c 2000000 /dev/zero > project/logs/big.log      # a 2 MB file of zero bytes
echo hi > project/logs/small.log
touch -d '40 days ago' project/logs/old.log           # pretend this is old
cd project

(A \ at the end of a line continues the command on the next line.)

The shape of a find command#

find  WHERE  TESTS...  ACTION
find  .      -name "*.md"   -print

• WHERE: one or more starting directories (. is here, / is everything, ~ is home).
• TESTS: conditions like name, type, size and age. Several tests are ANDed together.
• ACTION: what to do with matches. The default is -print (print the path).

find lists files in on-disk order, which may differ on your machine. Pipe to sort if you need a stable order.

Finding by name#

find . -name "*.md"

./docs/release notes.md
./docs/guide.md
./node_modules/lib/index.md
./README.md

find . -iname "*.py"      # -iname: case-insensitive

./src/Test.PY
./src/app.py
./src/utils.py

Always quote the pattern. Unquoted, the shell would expand *.md in the current directory first (to README.md), and find would only search for that one name.

Search the whole system for a file, hiding "Permission denied" noise:

find / -name "sshd_config" 2>/dev/null

Finding by type#

find . -type d

.
./logs
./docs
./src
./node_modules
./node_modules/lib

find . -maxdepth 1 -type f

./README.md

Finding by size and age#

find . -size +1M          # bigger than 1 MiB
find . -mtime +30         # modified more than 30 days ago

./logs/big.log
./logs/old.log

A classic disk-space hunt:

sudo find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null

-xdev stays on one filesystem, so find doesn't wander into network mounts or /proc.

Combining and excluding#

Tests are ANDed. Use -o for OR, ! (or -not) for NOT, and escaped parentheses for grouping:

find . -type f \( -name "*.py" -o -name "*.md" \)
find . -name "*.md" -not -path "*/node_modules/*"

For big folders you don't want to descend into at all, -prune is faster than filtering afterwards:

find . -path ./node_modules -prune -o -name "*.md" -print

./docs/release notes.md
./docs/guide.md
./README.md

Read it as: "if the path is ./node_modules, prune it (don't go in); otherwise print .md files". The explicit -print at the end is required here.

Acting on what you find#

-exec

find . -name "*.log" -size +1k -exec ls -lh {} \;

-rw-r--r-- 1 ada ada 2.0M Oct  1 10:30 ./logs/big.log

{} is replaced by each path, and \; ends the command (escaped so the shell doesn't eat the ;). Ending with + instead of \; passes many paths to one command, which is much faster:

find . -name "*.md" -exec wc -l {} +
find . -type f -name "*.sh" -exec chmod +x {} +

-delete

find /tmp/myapp -name "*.tmp" -mtime +7 -print        # 1. preview
find /tmp/myapp -name "*.tmp" -mtime +7 -delete       # 2. then delete

Always run the command with -print first and read the list. Put -delete last: find . -delete -name "*.tmp" deletes everything, because actions run in order.

Piping to xargs safely

File names can contain spaces (and even newlines). -print0 separates names with a NUL byte, which xargs -0 understands:

find . -name "*.md" -print0 | xargs -0 ls -1

./README.md
./docs/guide.md
./docs/release notes.md
./node_modules/lib/index.md

Without -print0/-0, release notes.md would be split into two bogus names.

locate: instant searches from an index#

find walks the disk live, which can be slow. locate searches a prebuilt database instead:

sudo apt install plocate      # Fedora: sudo dnf install plocate
sudo updatedb                 # build/refresh the index (also runs daily)
locate sshd_config
locate -i readme | head

The trade-off: files created since the last updatedb won't show up.

Finding commands: which, type, whereis#

When you type a command name, the shell searches the directories listed in the PATH variable, in order. To see which file wins:

which python3
type -a ls
whereis -b bash

/usr/bin/python3
ls is aliased to `ls --color=auto'
ls is /usr/bin/ls
ls is /bin/ls
bash: /usr/bin/bash

• which prints the first match on PATH.
• type (a Bash built-in) also reveals aliases, functions and built-ins, so it's the most truthful answer.
• whereis lists the binary (-b), and without options also source and man pages.
• command -v git is the portable way for scripts to check whether a tool is installed: it prints the path, or nothing with a non-zero exit status.

Common mistakes#

• Unquoted patterns: find . -name *.txt.
• Forgetting the starting directory on older systems (find -name x works in GNU find but not everywhere).
• Using -delete without previewing, or placing it before the tests.
• Misreading sizes: -size -1k means "rounded up to 1 KiB blocks, fewer than 1", i.e. empty files only. Use c (bytes) for precision: -size -1000c.
• Parsing ls output in scripts instead of using find ... -print0.

What's next#

find locates files by their properties. To search inside files for text and patterns, you need grep and regular expressions.