Find (Unix)


In Unix-like and some other operating systems, find is a command-line utility that locates files based on some user-specified criteria and then applies some requested action on each matched object.
It initiates a search from a desired starting location and then recursively traversing the nodes of a hierarchical structure. find can traverse and search through different file systems of partitions belonging to one or more storage devices mounted under the starting directory.
The possible search criteria include a pattern to match against the filename or a time range to match against the modification time or access time of the file. By default, find returns a list of all files below the current working directory, although users can limit the search to any desired maximum number of levels under the starting directory.
The related locate programs use a database of indexed files obtained through find to provide a faster method of searching the entire file system for files by name.

History

find appeared in Version 5 Unix as part of the Programmer's Workbench project, and was written by Dick Haight alongside cpio, which were designed to be used together.
The GNU find implementation was originally written by Eric Decker. It was later enhanced by David MacKenzie, Jay Plett, and Tim Wood.

Find syntax


$ find path...

The two options control how the find command should treat symbolic links. The default behaviour is never to follow symbolic links. The -L flag will cause the find command to follow symbolic links. The -H flag will only follow symbolic links while processing the command line arguments. These flags are specified in the POSIX standard for find. A common extension is the -P flag, for explicitly disabling symlink following.
At least one path must precede the expression. find is capable of interpreting wildcards internally and commands must be quoted carefully in order to control shell globbing.
Expression elements are separated by the command-line argument boundary, usually represented as whitespace in shell syntax. They are evaluated from left to right. They can contain logical elements such as AND and OR as well as predicates.
GNU find has a large number of additional features not specified by POSIX.

Predicates

Commonly-used primaries include:
If the expression uses none of -print0, -print, -exec, or -ok, find defaults to performing -print if the conditions test as true.

Operators

Operators can be used to enhance the expressions of the find command. Operators are listed in order of decreasing precedence:

$ find. -name 'fileA_*' -o -name 'fileB_*'

This command searches the current working directory tree for files whose names start with "fileA_" or "fileB_". We quote the so that the shell does not expand it.

$ find. -name 'foo.cpp' '!' -path '.svn'

This command searches the current working directory tree except the subdirectory tree ".svn" for files whose name is "foo.cpp". We quote the ! so that it's not interpreted by the shell as the history substitution character.

POSIX protection from infinite output

Real-world file systems often contain looped structures created through the use of hard or soft links. The POSIX standard requires that

Examples

From the current working directory


$ find. -name 'my*'

This searches the current working directory tree for files whose names start with my. The single quotes avoid the shell expansion—without them the shell would replace my* with the list of files whose names begin with my in the current working directory. In newer versions of the program, the directory may be omitted, and it will imply the current working directory.

Regular files only


$ find. -name 'my*' -type f

This limits the results of the above search to only regular files, therefore excluding directories, special files, symbolic links, etc. my* is enclosed in single quotes as otherwise the shell would replace it with the list of files in the current working directory starting with my…

Commands

The previous examples created listings of results because, by default, find executes the -print action.

$ find. -name 'my*' -type f -ls

This prints extended file information.

Search all directories


$ find / -name myfile -type f -print

This searches every directory for a regular file whose name is myfile and prints it to the screen. It is generally not a good idea to look for files this way. This can take a considerable amount of time, so it is best to specify the directory more precisely. Some operating systems may mount dynamic file systems that are not congenial to find. More complex filenames including characters special to the shell may need to be enclosed in single quotes.

Search all but one subdirectory tree


$ find / -path excluded_path -prune -o -type f -name myfile -print

This searches every directory except the subdirectory tree excluded_path that is pruned by the -prune action, for a regular file whose name is myfile.

Specify a directory


$ find /home/weedly -name myfile -type f -print

This searches the /home/weedly directory tree for regular files named myfile. You should always specify the directory to the deepest level you can remember.

Search several directories


$ find local /tmp -name mydir -type d -print

This searches the local subdirectory tree of the current working directory and the /tmp directory tree for directories named mydir.

Ignore errors

If you're doing this as a user other than root, you might want to ignore permission denied errors. Since errors are printed to stderr, they can be suppressed by redirecting the output to /dev/null. The following example shows how to do this in the bash shell:

$ find / -name myfile -type f -print 2> /dev/null

If you are a csh or tcsh user, you cannot redirect stderr without redirecting stdout as well. You can use sh to run the find command to get around this:

$ sh -c "find / -name myfile -type f -print 2> /dev/null"

An alternate method when using csh or tcsh is to pipe the output from stdout and stderr into a grep command. This example shows how to suppress lines that contain permission denied errors.

$ find. -name myfile |& grep -v 'Permission denied'

Find any one of differently named files


$ find. \ -type f -ls

The -ls operator prints extended information, and the example finds any regular file whose name ends with either 'jsp' or 'java'. Note that the parentheses are required. In many shells the parentheses must be escaped with a backslash to prevent them from being interpreted as special shell characters. The -ls operator is not available on all versions of find.

Execute an action


$ find /var/ftp/mp3 -name '*.mp3' -type f -exec chmod 644 \;

This command changes the permissions of all regular files whose names end with .mp3 in the directory tree /var/ftp/mp3. The action is carried out by specifying the statement -exec chmod 644 \; in the command. For every regular file whose name ends in .mp3, the command chmod 644 is executed replacing with the name of the file. The semicolon indicates the end of the command. Permission 644, usually shown as rw-r--r--, gives the file owner full permission to read and write the file, while other users have read-only access. In some shells, the must be quoted. The trailing "" is customarily quoted with a leading "", but could just as effectively be enclosed in single quotes.
Note that the command itself should not be quoted; otherwise you get error messages like

find: echo "mv./3bfn rel071204": No such file or directory

which means that find is trying to run a file called '' and failing.
If you will be executing over many results, it is more efficient to use a variant of the exec primary that collects filenames up to and then executes COMMAND with a list of filenames.

$ find. -exec COMMAND +

This will ensure that filenames with whitespaces are passed to the executed without being split up by the shell.

Delete files and directories

The -delete action is a GNU extension, and using it turns on -depth. So, if you are testing a find command with -print instead of -delete in order to figure out what will happen before going for it, you need to use -depth -print.
Delete empty files and print the names :

$ find. -empty -delete -print

Delete empty regular files:

$ find. -type f -empty -delete

Delete empty directories:

$ find. -type d -empty -delete

Delete empty files named 'bad':

$ find. -name bad -empty -delete

Warning. — The -delete action should be used with conditions such as -empty or -name:

$ find. -delete # this deletes all in.

Search for a string

This command will search all files from the /tmp directory tree for a string:

$ find /tmp -type f -exec grep 'search string' /dev/null \+

The /dev/null argument is used to show the name of the file before the text that is found. Without it, only the text found is printed.
GNU grep can be used on its own to perform this task:

$ grep -r 'search string' /tmp

Example of search for "LOG" in jsmith's home directory tree:

$ find ~jsmith -exec grep LOG /dev/null \; -print
/home/jsmith/scripts/errpt.sh:cp $LOG $FIXEDLOGNAME
/home/jsmith/scripts/errpt.sh:cat $LOG
/home/jsmith/scripts/title:USER=$LOGNAME

Example of search for the string "ERROR" in all XML files in the current working directory tree:

$ find. -name "*.xml" -exec grep "ERROR" /dev/null \+

The double quotes surrounding the search string and single quotes surrounding the braces are optional in this example, but needed to allow spaces and some other special characters in the string. Note with more complex text single quotes are often the easier choice, since double quotes do not prevent all special interpretation. Quoting filenames which have English contractions demonstrates how this can get rather complicated, since a string with an apostrophe in it is easier to protect with double quotes:

$ find. -name "file-containing-can't" -exec grep "can't" \; -print

Search for all files owned by a user


$ find. -user

Search in case insensitive mode

Note that -iname is not in the standard and may not be supported by all implementations.

$ find. -iname 'MyFile*'

If the -iname switch is not supported on your system then workaround techniques may be possible such as:

$ find. -name '*'

This uses Perl to build the above command for you :

$ echo 'MyFile*' | perl -pe 's///g;s//find. -name \1/' | sh

Search files by size

Searching files whose size is between 100 kilobytes and 500 kilobytes:

$ find. -size +100k -a -size -500k

Searching empty files:

$ find. -size 0k

Searching non-empty files:

$ find. ! -size 0k

Search files by name and size


$ find /usr/src ! \ '' \; -print

This command will search the /usr/src directory tree. All files that are of the form '*,v' and '.*,v' are excluded. Important arguments to note are in the tooltip that is displayed on mouse-over.

for file in `find /opt \ -size +300000k -a -size -5000000k`; do
cat /dev/null > $file
done

The units should be one of , 'b' means 512-byte blocks, 'c' means byte, 'k' means kilobytes and 'w' means 2-byte words. The size does not count indirect blocks, but it does count blocks in sparse files that are not actually allocated.

Related utilities