The

action lists the names of files separated by a newline.  But it is common to pipe the output of

into

, which uses a space to separate file names.  This can lead to a problem if any found files contain spaces in their names, as the output doesn’t use any quoting.  In such cases, when the output of

contains a file name such as

and is piped into another command, that command sees two file names, not one file name containing a space.  Even without using

you could have a problem if the file name contains a newline character.

In such cases you can specify the action

instead.  This lists the found files separated not with a newline but with a null (or NUL) character, which is not a legal character in Unix or Linux file names.  Of course the command that reads the output of

must be able to handle such a list of file names.  Many commands commonly used with

(such as

or

) have special options to read in file names separated with NULs instead of spaces.

You can use shell-style wildcards in the

search argument:

find . -name foo\*bar

This will search from the current directory down for foo*bar (that is, any filename that begins with

and ends with

).  Note that wildcards in the name argument must be quoted so the shell doesn’t expand them before passing them to

.  Also, unlike regular shell wildcards, these will match leading periods in filenames.  (For example

.)

You can search for other criteria beside the name.  Also you can list multiple search criteria.  When you have multiple criteria any found files must match all listed criteria.  That is, there is an implied Boolean AND operator between the listed search criteria. 

also allows OR and NOT Boolean operators, as well as grouping, to combine search criteria in powerful ways (not shown here.)

Here’s an example using two search criteria:

find / -type f -mtime -7 | xargs tar -rf weekly_incremental.tar
gzip weekly_incremental.tar

will find any regular files (i.e., not directories or other special files) with the criteria

, and only those modified seven or fewer days ago (

).  Note the use of

, a handy utility that coverts a stream of input (in this case the output of

) into command line arguments for the supplied command (in this case

, used to create a backup archive).

Using the

option

is dangerous here; 

may invoke

several times if there are many files found and each

will cause

to over-write the previous invocation.  The

option appends files to an archive.  Other options such as those that would permit filenames containing spaces would be useful in a production quality backup script.

Another use of

is illustrated below.  This command will efficiently remove all files named

from your system (provided you run the command as root of course):

find / -name core | xargs /bin/rm -f
find / -name core -exec /bin/rm -f '{}' \; # same thing
find / -name core -delete                  # same if using Gnu find

(The last two forms run the

command once per file, and are not as efficient as the first form.)

One of my favorite

criteria is to locate files modified less than 10 minutes ago.  I use this right after using some system administration tool, to learn which files got changed by that tool:

find / -mmin -10

(This search is also useful when I’ve downloaded some file but can’t locate it.)

Another common use is to locate all files owned by a given user (

).  This is useful when deleting user accounts.

You can also find files with various permissions set. 

means to find files with any of the specified permissions on,

means to find files with all of the specified permissions on, and

means to find files with exactly permissions.  Permissions can be specified either symbolically (preferred) or with an octal number.  The following will locate files that are writeable by others (including symlinks, which should be writeable by all):

find . -perm -o=w

(Using

is more complex than this example shows.  You should check both the POSIX documentation for

(which explains how the symbolic modes work) and the Gnu

man page (which describes the Gnu extensions).

When using

to locate files for backups, it often pays to use the

option (really a criterion that is always true), which forces the output to be depth-first—that is, files first and then the directories containing them.  This helps when the directories have restrictive permissions, and restoring the directory first could prevent the files from restoring at all (and would change the time stamp on the directory in any case).  Normally,

returns the directory first, before any of the files in that directory.  This is useful when using the

action to prevent

from examining any files you want to ignore:

find / -name /dev -prune | xargs tar ...

When specifying time with

options such as

(minutes) or

(24 hour periods, starting from now), you can specify a number

to mean exactly

,

to mean less than

, and

to mean more than

.

Fractional 24-hour periods are truncated!  That means that

says to match files modified two or more days ago.

For example:

find . -mtime 0   # find files modified between now and 1 day ago
                  # (i.e., within the past 24 hours)
find . -mtime -1  # find files modified less than 1 day ago
                  # (i.e., within the past 24 hours, as before)
find . -mtime 1   # find files modified between 24 and 48 hours ago
find . -mtime +1  # find files modified more than 48 hours ago

find . -mmin +5 -mmin -10 # find files modified between
                          # 6 and 9 minutes ago

Using the

action instead of the default

is useful to control the output format better than you can with

or

.  You can use

with

to produce output that can easily be parsed by other utilities or imported into spreadsheets or databases.  See the man page for the dozens of possibilities with the

action.  (In fact

with

is more versatile than

and is the preferred tool for forensic examiners even on Windows systems, to list file information.)  For example the following displays non-hidden (no leading dot) files in the current directory only (no subdirectories), with an custom output format:

find . -maxdepth 1 -name '[!.]*' -printf 'Name: %16f Size: %6s\n'

find . -path './*' -prune ...

find . ! -name . -prune ...

 find . \( -name . -o -prune \) ...

As a system administrator you can use

to locate suspicious files (e.g., world writable files, files with no valid owner and/or group, SetUID files, files with unusual permissions, sizes, names, or dates).  Here’s a final more complex example (which I saved as a shell script):

find / -noleaf -wholename '/proc' -prune \
     -o -wholename '/sys' -prune \
     -o -wholename '/dev' -prune \
     -o -wholename '/windows-C-Drive' -prune \
     -o -perm -2 ! -type l  ! -type s \
     ! \( -type d -perm -1000 \) -print

This says to search the whole system, skipping the directories

,

,

, and

(presumably a Windows partition on a dual-booted computer).  The Gnu

option tells

not to assume all remaining mounted filesystems are Unix file systems (you might have a mounted CD for instance).  The

is the Boolean OR operator, and

is the Boolean NOT operator (applies to the following criteria).

So these criteria say to locate files that are world writable (

, same as

) and NOT symlinks (

) and NOT sockets (

) and NOT directories with the sticky (or text) bit set (

).  (Symlinks, sockets and directories with the sticky bit set are often world-writable and generally not suspicious.)

A common request is a way to find all the hard links to some file.  Using

will tell you how many hard links the file has, and the inode number.  You can locate all pathnames to this file with:

  find mount-point -xdev -inum inode-number

Since hard links are restricted to a single filesystem, you need to search that whole filesystem so you start the search at the filesystem’s mount point.  (This is likely to be either

or

for files in your home directory.)  The

options tells

to not search any other filesystems.

(While most Unix and all Linux systems have a

command that supports the

criterion, this isn’t POSIX standard.  Older Unix systems provided the

utility instead that could be used for this.)

Using

1

-exec

Efficiently:

The

option to

is great, but since it runs the command listed for every found file it isn’t very efficient.  On a large system this makes a difference!  One solution is to combine

with

as discussed above:

  find whatever... | xargs command

However this approach has two limitations.  Firstly not all commands accept the list of files at the end of the command.  A good example is

:

find . -name \*.txt | xargs cp /tmp  # This won't work!

(Note the Gnu version of

has a non-POSIX option

for this, and

has options to handle this too.)

Secondly filenames may contain spaces or newlines, which would confuse the command used with

.  (Again Gnu tools have options for that,

.)

There are POSIX (but non-obvious) solutions to both problems.  An alternate form of

ends with a plus-sign, not a semi-colon.  This form collects the filenames into groups or sets, and runs the command once per set.  (This is exactly what

does, to prevent argument lists from becoming too long for the system to handle.)  In this form the

argument expands to the set of filenames.  For example:

find / -name core -exec /bin/rm -f '{}' +

This form of

can be combined with a shell feature to solve the other problem (names with spaces).  The POSIX shell allows us to use:

sh -c 'command-line' [ command-name [ args... ] ]

(We don’t usually care about the command-name, so X, dummy, or inline cmd is often used.)  Here’s an example of efficiently copying found files to

, in a POSIX-compliant way (Posted on comp.unix.shell netnews newsgroup on Oct. 28 2007 by Stephane CHAZELAS):

find . -name '*.txt' -type f \
  -exec sh -c 'exec cp -f "$@" /tmp' find-copy {} +

Common Gotcha:

If the given expression to

does not contain any of the action primaries

,

, or

, the given expression is effectively replaced by:

find \( expression \) -print

The implied parenthesis can cause unexpected results.  For example, consider these two similar commands:

$ find -name tmp -prune -o -name \*.txt
./bin/data/secret.txt
./tmp
./missingEOL.txt
./public_html/graphics/README.txt
./datafile2.txt
./datafile.txt

$ find -name tmp -prune -o -name \*.txt -print
./bin/data/secret.txt
./missingEOL.txt
./public_html/graphics/README.txt
./datafile2.txt
./datafile.txt

The lack of an action in the first command means it is equivalent to:

find . \( -name tmp -prune -o -name \*.txt \) -print

This causes

to be included in the output.  However for the second

command the normal rules of Boolean operator precedence apply, so the pruned directory does not appear in the output.

The

command can be amazingly useful.  See the man page to learn all the criteria and actions you can use.