Chapter 9. Finding Files with find

How to Use find

The utility find is one of the most useful and important of the Unix utilities. It finds files that match a given set of parameters, ranging from the file's name to its modification date. In this chapter, we'll be looking at many of the things it can do. As an introduction, here's a quick summary of its features and basic operators:

% find 
               path operators

where path is one or more directories in which find will begin to search and operators (or, in more customary jargon, options) tell find which files you're interested in. The operators are as follows:

-name filename: Find files with the given filename. This is the most commonly used operator. filename may include wildcards, but if it does, they must be quoted to prevent the shell from interpreting the wildcards.
-perm mode: Find files with the given access mode. You must give the access mode in octal.
-type c: Find the files of the given type, specified by c. c is a one-letter code; for example, f for a plain file, b for a block special file, l for a symbolic link, and so forth.
-user name: Find files belonging to user name. name may also be a user ID number.
-group name: Find files belonging to group name. name may also be a group ID number.
-size n: Find files that are n blocks long. A block usually equals 512 bytes. The notation + n says "find files that are over n blocks long." The notation n c says "find files that are n characters long." Can you guess what + n c means?
-inum n: Find files with the inode number n.
-atime n: Find files that were accessed n days ago. + n means "find files that were accessed over n days ago" (i.e., not accessed in the last n days). - n means "find files that were accessed less than n days ago" (i.e., accessed in the last n days).
-mtime n: Similar to -atime, except that it checks the time the file's contents were modified.
-ctime n: Similar to -atime, except that it checks the time the inode was last changed. "Changed" means that the file was modified or that one of its attributes (for example, its owner) was changed.
-newer file: Find files that have been modified more recently than file.

You might want to take some action on files that match several criteria. So we need some way to combine several operators:

operator1 -a operator2: Find files that match both operator1 and operator2. The -a isn't strictly necessary; when two search parameters are provided, one after the other, find assumes you want files that match both conditions.
operator1 -o operator2: Find files that match either operator1 or operator2.

Another group of operators tells find what action to take when it locates a file:

-print

Print the file's name on standard output. On most modern finds, this is the default action if no action is given.

-ls

List the file's name on standard output with a format like ls -l. (Not on older versions.)

-exec command

Execute command. To include the pathname of the file that's just been found in command, use the special symbol {}. command must end with a backslash followed by a semicolon (\;). For example:

% find . -name "*.o" -exec rm -f {} \;

tells find to delete any files whose names end in .o.

-ok command

Same as -exec, except that find prompts you for permission before executing command. This is a useful way to test find commands.

A last word: find is one of the tools that vendors frequently fiddle with, adding (or deleting) a few operators that they like (or dislike). The GNU version, in particular, has many more. The operators listed here should be valid on virtually any system. If you check your manual page, you may find others.

— ML