---
title: find — find files by criteria
date: 2026-10-17
time: 12:00
model: admin
category: programs
author_type: human
summary: Command that finds files by name, time, size, and permission criteria and connects subsequent actions. Includes practical cleanup and inspection examples.
tags: program, File and disk management, find
---

**💬 "find command"**

find doesn’t just search by file name; it finds files by combining conditions such as **modification time, size, permissions, and owner**. It is a basic tool for automating server cleanup and inspection.

Because its results can be passed to other commands, “find and delete, compress, and create lists” can be handled in a single line.

- **Concept**: Recursively traverses the specified path and prints files and directories that match the conditions.
- **Left column**: The search condition expression. Combine `-name`, `-mtime`, `-size`, `-type`, and so on.
- **Right column**: The path where the search starts. The narrower the path, the faster and less risky the search.
- **-exec / -delete**: Run a follow-up command on the found results. If used incorrectly it cannot be undone, so check the results first.
## Commonly used options

| Option | Description |
| --- | --- |
| -name / -iname | Name pattern (case-sensitive / case-insensitive) |
| -type f|d | Files only / directories only |
| -mtime +7 | Modified more than 7 days ago |
| -size +100M | Larger than 100MB |
| -maxdepth 2 | Search only up to 2 levels deep (speed improvement) |

## 3 essential command combinations

- `find /var/log -type f -name '*.log' -mtime +30` — Find log files older than 30 days
- `find /data -type f -size +500M -printf '%s %p\n' | sort -n` — List large files over 500MB by size
- `find /var/www/html -type f -name '*.conf' | wc -l` — Count only files that match the conditions
**💬 "Show me an example based on a real incident scenario"**

Here is a step-by-step walkthrough of a common situation on a production server.

### Step 1 · Narrow down candidates by conditions

First, check only the list of results without deleting or compressing.

```
find /var/log -type f -name '*.log' -mtime +30
```

### Step 2 · Check count and size

Check how many targets there are and how large the total is to understand the scope of impact.

```
find /var/log -type f -name '*.log' -mtime +30 | wc -l
```

### Step 3 · Run only after verification

Once the list is confirmed, compress or delete. For files in active use, compression is recommended instead of -delete.

```
find /var/log -type f -name '*.log' -mtime +30 -exec gzip {} +
```

## How it’s used in practice

### 1. Automatically clean up old logs

**Situation** — Disk usage has reached 86%, and you want to select and compress logs older than 30 days.

```
find /var/log -type f -name '*.log' -mtime +30 -exec gzip {} +
```

**Result** — Only files matching the conditions are compressed with gzip, reducing disk usage, while recent logs remain unchanged.

**Point** — Before running, print a list with the same conditions and be sure to check the number of targets.

### 2. Full inspection of configuration files

**Situation** — Before migrating a server, you need to list the configuration files under /etc and keep a change history.

```
find /etc -type f -name '*.conf' -printf '%TY-%Tm-%Td %p\n' | sort
```

**Result** — The modification dates and paths are sorted together, making it easy to find recently changed configuration files.

**Point** — Putting the date first with -printf makes sorting and comparing easier.

### 3. Find files with loose permissions

**Situation** — During a security audit, you need to find files writable by everyone.

```
find /var/www -type f -perm -o+w
```

**Result** — You get a list of files that anyone can modify. If it’s a web directory, these need immediate action.

**Point** — After cleanup, run the same command again to confirm there are zero results.

## Things to watch out for

- Commands like find / -delete can damage the system. Specify a narrow starting path and check the results first.
- -mtime is measured in 24-hour units, and -mmin is measured in minutes. Confusing them changes the target set.
- Deleting logs that are in active use may not free up space because the process still holds the file open.
- A full scan on network storage causes heavy I/O load. Narrow the target path with -maxdepth.
## Actual execution screen

After narrowing the conditions and finding files, get into the safe habit of checking the scope of impact by counting them first, as in the second example.

![find execution result: list of log files matching the conditions and count of configuration files](https://games.aidebatehub.com/assets/find-demo.png)

Production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/filesystem/find.html
This file is an auto-generated Markdown twin of the DevHub document.