find — find files by criteria

💬 "find command"

find doesn’t just search by file name; it finds files by combining conditions such as modification time, size, permissions, and owner. It is a basic tool for automating server cleanup and inspection.

Because its results can be passed to other commands, “find and delete, compress, and create lists” can be handled in a single line.

• Concept: Recursively traverses the specified path and prints files and directories that match the conditions.
• Left column: The search condition expression. Combine -name, -mtime, -size, -type, and so on.
• Right column: The path where the search starts. The narrower the path, the faster and less risky the search.
• -exec / -delete: Run a follow-up command on the found results. If used incorrectly it cannot be undone, so check the results first.

Commonly used options

3 essential command combinations

• find /var/log -type f -name '*.log' -mtime +30 — Find log files older than 30 days
• find /data -type f -size +500M -printf '%s %p\n' | sort -n — List large files over 500MB by size
• find /var/www/html -type f -name '*.conf' | wc -l — Count only files that match the conditions

💬 "Show me an example based on a real incident scenario"

Here is a step-by-step walkthrough of a common situation on a production server.

Step 1 · Narrow down candidates by conditions

First, check only the list of results without deleting or compressing.

find /var/log -type f -name '*.log' -mtime +30

Step 2 · Check count and size

Check how many targets there are and how large the total is to understand the scope of impact.

find /var/log -type f -name '*.log' -mtime +30 | wc -l

Step 3 · Run only after verification

Once the list is confirmed, compress or delete. For files in active use, compression is recommended instead of -delete.

find /var/log -type f -name '*.log' -mtime +30 -exec gzip {} +

How it’s used in practice

1. Automatically clean up old logs

Situation — Disk usage has reached 86%, and you want to select and compress logs older than 30 days.

find /var/log -type f -name '*.log' -mtime +30 -exec gzip {} +

Result — Only files matching the conditions are compressed with gzip, reducing disk usage, while recent logs remain unchanged.

Point — Before running, print a list with the same conditions and be sure to check the number of targets.

2. Full inspection of configuration files

Situation — Before migrating a server, you need to list the configuration files under /etc and keep a change history.

find /etc -type f -name '*.conf' -printf '%TY-%Tm-%Td %p\n' | sort

Result — The modification dates and paths are sorted together, making it easy to find recently changed configuration files.

Point — Putting the date first with -printf makes sorting and comparing easier.

3. Find files with loose permissions

Situation — During a security audit, you need to find files writable by everyone.

find /var/www -type f -perm -o+w

Result — You get a list of files that anyone can modify. If it’s a web directory, these need immediate action.

Point — After cleanup, run the same command again to confirm there are zero results.

Things to watch out for

• Commands like find / -delete can damage the system. Specify a narrow starting path and check the results first.
• -mtime is measured in 24-hour units, and -mmin is measured in minutes. Confusing them changes the target set.
• Deleting logs that are in active use may not free up space because the process still holds the file open.
• A full scan on network storage causes heavy I/O load. Narrow the target path with -maxdepth.

Actual execution screen

After narrowing the conditions and finding files, get into the safe habit of checking the scope of impact by counting them first, as in the second example.

!find execution result: list of log files matching the conditions and count of configuration files

Production server

Source (HTML): https://games.aidebatehub.com/programs/linux/filesystem/find.html This file is an auto-generated Markdown twin of the DevHub document.