# find

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/find

## Quick definition

The find command helps you locate files and folders in a Linux or Unix system. You can search by name, size, date, or file type. It is a scriptable tool often used in automation and system administration. Once found, you can run actions like deleting, moving, or copying the files directly.

## Simple meaning

Imagine you have a huge filing cabinet with thousands of papers, and you need to find every document that was created last Tuesday, is more than 10 pages long, and has the word 'invoice' in its name. Without a system, you would have to open every drawer and look through every folder manually. In the computer world, the find command is like a super-powered search assistant. You tell it where to look, what to look for, and what to do with the results. Unlike a simple search box that only looks at file names, find can check file size, when it was last changed, who owns it, and even what permissions are set. It can search through entire disks or just a single folder. When it finds matching files, it can run other commands automatically. For example, you could say 'find all files bigger than 100 megabytes and delete them' or 'find all files modified in the last hour and copy them to a backup folder'. It works by starting at a given directory and then looking through every subdirectory and every file, checking each one against the conditions you set. This makes it an essential tool for system administrators who need to manage thousands of files efficiently. In IT certifications, understanding find is crucial because it shows you understand file system structure, permissions, and shell scripting automation.

## Technical definition

The find command is a standard Unix/Linux utility that recursively descends through a directory tree, evaluating expressions for each file it encounters. It is defined by the POSIX standard and is implemented in nearly all Unix-like operating systems including Linux distributions, macOS, and BSD variants. The basic syntax is 'find [starting-point...] [expression]'. The starting-point is typically a directory path, and if omitted, the current directory is used. The expression consists of options, tests, and actions. Options modify how find behaves, for example '-depth' processes the contents of each directory before the directory itself. Tests return true or false for each file; common tests include '-name pattern' for filename matching (supports shell wildcards like * and ?), '-type f' for regular files, '-type d' for directories, '-size +100M' for files larger than 100 megabytes, '-mtime -7' for files modified less than 7 days ago, and '-perm 755' for files with specific permissions. Actions specify what to do with files that match the tests, such as '-print' to output the path, '-delete' to remove the file, '-exec command {} \;' to run an external command on each file, or '-ok command {} \;' which prompts for confirmation before executing. The '{}' is a placeholder for the current file name, and the semicolon (escaped as \; or ';') terminates the command. The '-exec' action can also be used with '+' instead of ';' to batch file names, improving efficiency. Internal implementation relies on system calls like stat() and lstat() to retrieve file metadata, readdir() to list directory contents, and chdir() to navigate directory trees. Find can also use logical operators such as '-a' (and), '-o' (or), and '!' (not) to combine tests. Parentheses can be used for grouping, but must be escaped. In automation scripts, find is often combined with xargs to process large numbers of files without exceeding command-line length limits. For example, 'find /var/log -type f -name "*.log" -mtime +30 | xargs rm' deletes log files older than 30 days. Security considerations: find will follow symbolic links by default unless the '-P' option is used to prevent that, and it may cross mount points unless '-xdev' or '-mount' is specified. In exam contexts, understanding the -exec and -ok actions is critical for scripting questions. The -print0 action with xargs -0 handles filenames with spaces or newlines safely. The command supports regex matching via -regex and -iregex (case-insensitive). Modern implementations like GNU find add features such as -maxdepth and -mindepth to limit recursion depth. In terms of performance, find can be slow on large filesystems, so using specific starting points and limiting tests is best practice. It is a fundamental tool for file management automation in any IT environment.

## Real-life example

Think of a large public library with many floors, each floor having dozens of shelves, and each shelf holding hundreds of books. You are a librarian and a patron asks you to find every book that was published in the 1990s, is non-fiction, has more than 300 pages, and was checked out in the last month. Without a computer catalog, you would have to physically walk through every aisle, pull out books, check the publication date, count the pages, and look at the checkout record. That could take days. The find command is like having a automated robot that walks through every shelf instantly. You program the robot by giving it the criteria: start at the entrance, go through every floor, every shelf, check each book's publication date (using the file's creation or modification time), check the genre (like file type), check the page count (file size), and see the last checkout date (last access time). The robot then moves quickly, scanning each book, and when it finds a match, it writes down the location or even picks the book up. In our computer example, the librarian's 'start at the entrance' is the starting directory like '/home/user/documents'. The 'book' is a file, the 'shelf' is a subdirectory. The conditions like 'published in the 1990s' maps to '-mtime' or '-newer' tests. The robot's action of writing down the location is the '-print' action, and picking up the book could be '-exec mv {} /archive/ \;' to move the file to an archive folder. This automation saves hours of manual effort, just like the find command saves system administrators from manually browsing folders.

## Why it matters

In practical IT administration, the find command is invaluable for file management, cleanup, and automation tasks. System logs accumulate quickly and can fill up disk space, causing crashes. A daily cron job using 'find /var/log -type f -name "*.log" -mtime +30 -delete' automatically removes logs older than 30 days, preventing disk full errors. Similarly, finding and deleting temporary files, core dumps, or orphaned data is routine. Security audits often require finding files with incorrect permissions or owned by a specific user. For example, 'find /home -type f -perm /o+w' finds files that are world-writable, which is a security risk. The command also plays a role in backup scripts: 'find /data -type f -mtime -1' lists files changed today for differential backups. In DevOps and CI/CD pipelines, find is used to locate artifacts, configuration files, or test reports. It integrates with shell scripts because its output can be piped to other commands like xargs, grep, or sort. Without find, manual searching would be extremely time-consuming and error-prone. Certifications like CompTIA A+, Linux+, and RHCSA include the find command as a key objective because it demonstrates understanding of the Linux file hierarchy, permissions, and scripting. A certified professional is expected to use find efficiently to solve real-world problems. In terms of exam weight, questions about find often appear in performance-based scenarios where you must write a one-liner to accomplish a specific task, such as moving all files older than 7 days to an archive folder. Being comfortable with find options like -exec, -ok, -delete, and -print is crucial. Many exam takers lose time because they are not fluent with the syntax, so mastering find directly impacts exam success and job performance.

## Why it matters in exams

The find command is a staple in Linux and Unix-based certification exams, including CompTIA Linux+ (XK0-005), Red Hat Certified System Administrator (RHCSA), LPIC-1, and even sections of the CompTIA A+ (220-1102) covering Linux commands. In these exams, find appears in both multiple-choice questions and performance-based simulations. Typically, the exam objectives list 'search files using find' or 'perform file operations using find' as a key skill. For example, in the RHCSA exam, you may be asked to 'find all files owned by user jane under /home and change their group to staff'. This tests your understanding of -user, -group, and -exec or xargs. In CompTIA Linux+, you might see a question like 'Which command finds all regular files larger than 1MB in /var?' with options like find, locate, grep, and sort. You must know that locate uses a database and is faster but not real-time, while find is dynamic. Performance-based questions often require you to write a command or complete a partial command. For example, 'Using the find command, delete all files in /tmp that haven't been accessed in 30 days.' The correct answer uses -atime +30 and -delete. A common trick is using -mtime (modification time) when -atime (access time) is required. Another trap: forgetting to escape the semicolon in -exec. In multiple-choice, you may be asked to identify which find option lists only directories. The answer is -type d. Also, understanding the difference between -exec and -ok is tested; -ok asks for confirmation. Exams also test the combination of find with xargs, especially when handling filenames with spaces (use -print0 and xargs -0). The concept of depth limiting with -maxdepth is also tested. For instance, 'Find all .conf files only in /etc, not in subdirectories' requires -maxdepth 1. Some exams include questions on logical operators: 'Find files that are either owned by root or have size greater than 10MB' uses -o (or). Parentheses must be escaped. Therefore, knowing the exact syntax and common pitfalls is essential to passing these exams efficiently.

## How it appears in exam questions

Exam questions around find typically fall into three categories: command syntax, scenario-based problem solving, and troubleshooting. In syntax questions, you may be asked to complete a command: 'find /home -type f -name "*.txt" ______' and the options might be '-exec' or '-print' or '-delete'. You must know that -print is default but -delete performs removal. Scenario questions describe a real situation: 'A system administrator needs to archive all files in /var that are larger than 500MB and have not been modified in over a year. Which command accomplishes this?' The correct approach uses -size +500M -mtime +365. Some questions combine multiple tests: 'Find all regular files in /data that are owned by user1 and have permissions set to 644.' That uses -user user1 -perm 644. Troubleshooting questions might show an error like 'find: missing argument to -exec' which happens when the semicolon is not escaped or omitted. They might also ask 'Why did find fail to delete files with spaces in their names?' The answer relates to using -exec with proper quoting or using -print0 with xargs. Another tricky area is using -newer to compare file modification times: 'Find files in /backup that are newer than /tmp/ref.txt but older than 30 days.' This uses -newer /tmp/ref.txt -mtime +30. Questions also test the difference between -size +1M (greater than 1MB) and -size 1M (exactly 1MB). Also, the -perm modes: -perm 644 (exactly), -perm /u+w (any user write), -perm -007 (other has any permission). In performance-based exams, you might have to type the full command in a terminal simulation. They will check if you use the correct starting directory, tests, and action. For example, 'Move all empty files from /home/student to /tmp/empty.' The solution: find /home/student -type f -empty -exec mv {} /tmp/empty/ \;. You must remember the trailing slash in the target directory. Overall, exam questions test practical fluency, not just memorization.

## Example scenario

You are a junior system administrator for a small company. The shared drive /company_data is filling up, and the manager wants you to clean up old project files from 2020. Specifically, you need to find all files with the extension .docx that were last modified more than 3 years ago, and delete them. However, you must first show the manager the list of files before deleting. Using the find command, you start at the root of the shared drive. The command you use is 'find /company_data -type f -name "*.docx" -mtime +1095'. The -mtime +1095 means modified more than 1095 days ago (3 years approximate). You run it and see a list of files. The manager reviews and approves deletion. You then run the safe version with -ok instead of -exec: 'find /company_data -type f -name "*.docx" -mtime +1095 -ok rm {} \;' This prompts you to confirm each deletion. After confirming, the files are removed. Later, you need to find any leftover .pdf files from the same period that were not deleted. You can reuse the command. This scenario is exactly what performance-based exam questions simulate. They want you to know the structure: starting point, tests, and action. Also, they test whether you remember to use -mtime for modification time, -atime for access time, and -ctime for change time. In the exam, you might be given a similar task with different parameters like 'find all files owned by user analyst that are larger than 10MB' or 'find all symbolic links broken in /etc'. The scenario forces you to combine multiple tests. Understanding this scenario helps you translate exam questions into correct commands.

## Common mistakes

- **Mistake:** Forgetting to escape or quote the semicolon in -exec
  - Why it is wrong: The shell interprets the semicolon as a command separator, causing the find command to fail with 'missing argument to -exec'.
  - Fix: Always escape the semicolon with a backslash \; or use quotes ';' so it is passed as an argument to -exec.
- **Mistake:** Using -mtime instead of -atime when the question asks about access time
  - Why it is wrong: mtime refers to the last modification time, while atime refers to last access time. Using the wrong one yields incorrect results.
  - Fix: Read the question carefully: 'last accessed' means -atime, 'last modified' means -mtime, 'status changed' means -ctime.
- **Mistake:** Omitting the starting directory and running find without any path
  - Why it is wrong: By default, find searches the current directory, but if the current directory is not where you intend to search (e.g., root), you may get unexpected results or permission errors.
  - Fix: Always specify the starting directory explicitly, for example 'find /var/log' instead of just 'find'.
- **Mistake:** Using -delete without first testing with -print
  - Why it is wrong: The -delete action is irreversible and can remove important files if the criteria are wrong. In exams, they may test that you should preview results first.
  - Fix: Always run the command with -print first to see which files will be affected, then replace -print with -delete or use -ok for confirmation.
- **Mistake:** Misunderstanding -size syntax (e.g., using -size +1M instead of -size +1M)
  - Why it is wrong: The syntax -size +1M means files larger than 1 megabyte, but -size 1M means exactly 1 megabyte. Also forgetting the + or - sign returns exact match.
  - Fix: Use + for greater than, - for less than, and no sign for exact size. Remember suffixes: c (bytes), k (kilobytes), M (megabytes), G (gigabytes).

## Exam trap

{"trap":"In a performance-based question, you are asked to find all files older than 30 days in /var/log and delete them. Many learners write: find /var/log -type f -mtime -30 -delete","why_learners_choose_it":"They confuse the + and - signs. -mtime -30 means files modified in the last 30 days (younger), not older.","how_to_avoid_it":"Remember the mnemonic: + means older (plus age), - means newer (minus age). Files older than 30 days have a modification time greater than 30 days ago, so use +30."}

## Commonly confused with

- **find vs locate:** locate uses a pre-built database to find files by name very quickly, but it does not search by size, type, or permissions, and the database updates only periodically. find searches the live filesystem and supports many criteria, so it is more accurate but slower. (Example: To quickly find a file named 'report.pdf', use 'locate report.pdf'. To find all .pdf files larger than 1MB modified today, use 'find / -name '*.pdf' -size +1M -mtime 0'.)
- **find vs grep:** grep searches inside the content of files for text patterns, while find searches for file metadata like name, size, and timestamps. grep does not locate files on disk; it reads file contents. (Example: To find files with 'error' in their content, use 'grep error /var/log/*.log'. To find files named '*error*' themselves, use 'find /var/log -name '*error*'.)
- **find vs which:** which searches for executable files in the directories listed in the PATH variable, showing the location of a command. It only searches for executables by name. find searches any file type in any directory, not limited to PATH. (Example: 'which python' shows /usr/bin/python. 'find /usr -name python' would find any file named python, not just executables, and would take longer.)
- **find vs ls with wildcards (e.g., ls *.txt):** ls lists files in a directory but does not search recursively into subdirectories, and offers limited filtering (name only). find recursively searches all subdirectories and provides extensive filtering options. (Example: 'ls *.txt' lists .txt files only in the current directory. 'find . -name '*.txt'' lists all .txt files in the current directory and all subdirectories.)

## Step-by-step breakdown

1. **Choose the starting directory** — Decide where to begin the search. This is the first argument. For example, /home or /etc. If omitted, the current directory is used. Be specific to narrow the search and reduce processing time.
2. **Define file type test** — Use -type to specify file type: f for regular file, d for directory, l for symbolic link, etc. This prevents actions on directories when you only want files.
3. **Add name or size tests** — Use -name 'pattern' for filename matching (wildcards allowed). Use -size for size-based filtering, e.g., -size +100M. Multiple tests can be combined with -a (implicitly and).
4. **Add time-based tests if needed** — Use -mtime, -atime, or -ctime with + or - to filter by modification, access, or change time. For example, -mtime -7 finds files modified in the last week.
5. **Specify actions for matched files** — Actions include -print (default), -delete, -exec (run a command), -ok (same but prompt). The -exec action requires a semicolon: \; or ';'. Use {} as the placeholder for the file name.
6. **Run and verify** — Always run with -print first to preview. Then replace with intended action. Check for error messages, especially missing semicolon or permission issues. Use -depth if you need to process files before directories.

## Practical mini-lesson

The find command is one of the most versatile tools in a Linux administrator's toolkit. Its true power lies in combining tests and actions to automate complex file management tasks. In practice, professionals use find in shell scripts, cron jobs, and one-liners for daily operations. For example, a common task is to clean up temporary files older than 24 hours: 'find /tmp -type f -atime +1 -delete'. Notice the use of -atime (access time) because temp files often are not modified but accessed. Another typical use is to find and set permissions on misconfigured files: 'find /var/www -type f -perm /o+w -exec chmod o-w {} \;' removes world-writable permission from files under a web server root. This is a security hardening step. When working with large numbers of files, using -exec with {} \; spawns a command for each file, which can be slow. Instead, -exec {} + batches files, but you lose the ability to run complex commands. The efficient pattern is to use -print0 with xargs -0: 'find /data -type f -name '*.log' -size +1G -print0 | xargs -0 rm'. The -print0 option separates output with null characters, so filenames with spaces, tabs, or newlines are handled safely. In scripts, always define starting directory as a variable to avoid hardcoding. Error handling is important: if find encounters a permission-denied directory, it prints an error but continues. To suppress errors, redirect stderr: 'find / -name '*.conf' 2>/dev/null'. In some cases, you want to exclude certain directories like /proc or /sys using -path and -prune: 'find / -path /proc -prune -o -type f -name '*.log' -print'. This skips the /proc filesystem for performance. Understanding -maxdepth is also essential: 'find . -maxdepth 2 -name '*.txt'' limits the search to two levels deep. This prevents excessive recursion in deep directory trees. In automation, always test your find command with -print before destructive actions like -delete or -exec rm. A small typo could remove critical system files. For example, 'find . -type f -name '*.bak' -delete' is safe if you intend to delete .bak files, but if you accidentally omit the -name test, it would delete everything. So, always double-check. In exam scenarios, you will often be asked to write a find command that accomplishes a specific goal with constraints like 'do not use -delete' or 'use -exec'. Be comfortable with all variants. Also, know that -ok is the safe interactive version, but it is rarely used in scripts because it stops for confirmation. Overall, the find command is a must-know for any IT professional working with Linux systems.

## Memory tip

Think 'find' as 'file investigator': it checks name, size, time, and type before taking action. The plus sign (+) means 'older/more', minus (-) means 'newer/less'.

## FAQ

**What is the difference between find and locate?**

find searches the live filesystem in real-time and supports many criteria like size, type, and permissions. locate uses a pre-built database and only searches by name, making it faster but less comprehensive.

**How do I use find to delete files safely?**

First run the command with -print to preview the files. Then replace -print with -ok rm {} \; to confirm each deletion, or use -delete only after verifying the test criteria.

**Why does find need a semicolon in -exec?**

The semicolon marks the end of the command passed to -exec. It must be escaped (\;) or quoted (';') to prevent the shell from interpreting it as a command separator.

**Can find search by file content?**

No, find only searches file metadata. To search file content, combine find with grep: 'find . -type f -exec grep 'pattern' {} \;'.

**How do I skip permission denied errors?**

Redirect stderr to /dev/null: 'find / -name '*.txt' 2>/dev/null'. This suppresses errors but still shows valid results.

**What is the -maxdepth option?**

It limits how deep find goes into subdirectories. For example, -maxdepth 1 restricts search to the current directory only, while -maxdepth 2 goes one level deeper.

## Summary

The find command is a fundamental utility in Unix/Linux systems essential for IT certification candidates. It enables powerful file searches based on name, size, type, permissions, and timestamps, and it can automatically execute actions like deletion or moving. Understanding its syntax, especially the correct use of tests and -exec actions, is critical for both exams and real-world system administration. Common pitfalls include misusing + and - signs, forgetting to escape semicolons, and skipping previews before destructive actions. Mastery of find demonstrates a solid grasp of file systems, permissions, and scripting, which are key skills tested in CompTIA Linux+, RHCSA, and other certifications. In exams, you must be able to write precise one-liners to solve administrative tasks. Practical application includes log rotation, security audits, and automated backups. By learning find, you gain a tool that saves time and reduces errors in managing Linux systems. The takeaway for exam preparation is consistent practice with various combinations of tests and actions, and always verifying commands in a safe environment before using them on production data.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/find