Search for files in a directory hierarchy.
Starting from each specified starting point (directory), search the directory tree rooted at that point, evaluating the given expression from left to right according to operator precedence rules until the result is determined, at which point find moves on to the next filename.
The options listed in this document refer to options in the expression list. These options control the behavior of find and must be specified immediately after the last path name.
There are five "real" options: -H, -L, -P, -D, and -O. If present, they must appear before the first path name. This section does not describe those; for more details, refer to the find man page on man7.org.
If no parameters are provided, the find command searches for subdirectories and files in the current directory and displays them all. This is equivalent to:
find . -print
find [-H] [-L] [-P] [-D debugopts] [-Olevel] [starting-point...] [expression]
Excluding real options (more common):
find [starting-point...] [expression]
The part after the starting points (list) is the expression. This is a query specification describing how we match files (returning true or false) and what actions to perform on the matched files. An expression consists of a series of elements:
-empty test is true only if the current file is empty.-print action prints the name of the current file to standard output.-depth option causes find to traverse the filesystem in a depth-first order.-regextype option is a positional option used to specify the regular expression dialect used by subsequent regular expressions in the command line.-o (logical OR) and -a (logical AND). If no operator is specified, -a is used by default.-amin <minutes>: Find files or directories accessed exactly <minutes> ago.
-anewer <reference-file>: Find files or directories whose access time is more recent than the access time of the specified reference file or directory.
-atime <n-24-hour-periods>: Find files or directories accessed exactly n*24 hours ago.
-cmin <minutes>: Find files or directories changed exactly <minutes> ago.
-cnewer <reference-file>: Find files or directories whose status change time is more recent than the status change time of the specified reference file or directory.
-ctime <n-24-hour-periods>: Find files or directories changed exactly n*24 hours ago.
-empty: Find files with a size of 0 bytes, or empty directories.
-executable: Match files that are executable and directories that are searchable by the current user.
-false: Always return false.
-fstype <type>: Search only on filesystems of the specified type.
-gid <gid>: Find files or directories with the specified group ID.
-group <group-name>: Find files or directories belonging to the specified group name.
-ilname <pattern>: Like -lname, but case-insensitive.
-iname <pattern>: Like -name, but case-insensitive.
-inum <inode-number>: Find files or directories with the specified inode number.
-ipath <pattern>: Like -path, but case-insensitive.
-iregex <pattern>: Like -regex, but case-insensitive.
-iwholename <pattern>: See -ipath. This option is less portable than -ipath.
-links <n>: Find files or directories with exactly <n> hard links.
-lname <pattern>: Find symbolic links whose target matches the specified pattern.
-mmin <minutes>: Find files or directories modified exactly <minutes> ago.
-mtime <n-24-hour-periods>: Find files or directories modified exactly n*24 hours ago.
-name <pattern>: Find files or directories matching the specified pattern.
-newer <reference-file>: Find files or directories whose modification time is more recent than the modification time of the specified reference file.
-newerXY <reference>: Succeeds if the timestamp 'X' of the file being considered is newer than the timestamp 'Y' of the reference file.
-nogroup: Find files or directories that do not belong to a valid group ID on the local system.
-nouser: Find files or directories that do not belong to a valid user ID on the local system.
-path <pattern>: Match the full file path against the specified pattern.
-perm <mode>: Find files or directories with the specified permissions.
-readable: Match files readable by the current user.
-regex <pattern>: Match the full file path against a regular expression.
-samefile <name>: Match files that point to the same inode as <name>.
-size <n>: Find files of the specified size.
-type <type>: Find files of the specified type.
-uid <uid>: Find files or directories with the specified user ID.
-used <days>: Find files or directories accessed <days> after their status was last changed.
-user <username>: Find files or directories belonging to the specified user.
-writable: Match files writable by the current user.
-xtype <type>: Like -type, but checks the type of the file pointed to by a symbolic link.
-context <pattern>: SELinux only. Match the file's security context against a glob pattern.
⚠️ Warning: Since find parses the command line as an expression, putting
-deletefirst will delete everything under the specified starting point. Furthermore,-deletecannot delete a directory unless it is empty.
Returns true if the deletion was successful. If the deletion fails, an error message is displayed, and find will exit with a non-zero status code.
-delete action automatically enables the -depth option. To avoid unexpected behavior, it is usually better to explicitly use the -depth option earlier in the Tests.-depth invalidates -prune, the -delete action cannot be effectively combined with -prune. It is generally advisable to test the find command line with -print before adding -delete to perform the actual deletion.-delete action if the file has disappeared since the parent directory was read: it will not output an error diagnostic, will not change the exit code to non-zero, and the return code of the -delete action will be true.⚠️ Warning: There are unavoidable security issues with using the
-execaction; the-execdiroption should be used instead.
command ; or command {} +
The result is true if the return status is 0. Note: find treats all subsequent arguments as arguments to the command until it encounters an argument containing ;. The string {} is replaced by the current file name being processed everywhere it occurs in the arguments to the command, not just in arguments where it stands alone, unlike some versions of find. Both constructions may need to be escaped with a backslash \ or quoted to prevent expansion by the shell. The specified command is run once for each matched file. The command is executed in the starting directory.
command ; | command {} +
Similar to -exec, but the specified command is run in the subdirectory containing the matched file, rather than find's starting directory. As with -exec, {} should be quoted if calling find from a shell. This is a more secure way to invoke command as it avoids race conditions during path resolution. Like the -exec action, the + form of -execdir builds a command line to process multiple matched files, but any given command invocation will only list files that exist in the same subdirectory. If using this option, ensure the PATH environment variable does not refer to ., otherwise an attacker could run any command by leaving a suitably named file in a directory where you will run -execdir. Similarly, entries in PATH should not be empty or non-absolute directory names. If any invocation of the + form returns a non-zero exit status, find will also return a non-zero exit status. If find encounters an error, it may exit immediately, meaning some pending commands might not run at all. The result of the action depends on whether the ; or + variant is used. -execdir command {} + always returns true, while -execdir command {} ; returns true only if the command returns 0.
file
This option always returns true. -fls is similar to -ls and -fprint, but it writes the results to a file. The output file is always created even if the predicate never matches. For information on how special characters in filenames are handled, see the "UNUSUAL FILENAMES" section in the man page.
file
This option always returns true. If file does not exist when find is run, it is created; if it already exists, its content is truncated. Filenames /dev/stdout and /dev/stderr are handled specially and refer to standard output and standard error, respectively. The output file is always created even if the predicate never matches.
file
This option always returns true. Similar to -print0, but writes the output to a file; similar to -fprint. The output file is always created even if the predicate never matches.
file
This option always returns true. Similar to -printf, but writes the output to a file; similar to -fprint. The output file is always created even if the predicate never matches.
This option always returns true. List the current file in ls -dils format on standard output. The block counts are in 1 KB blocks unless the POSIXLY_CORRECT environment variable is set, in which case 512-byte blocks are used.
command ;
Similar to -exec, but prompts the user first. If the user agrees, the command is run; otherwise, it returns false. If the command is run, its standard input is redirected from /dev/null. Responses to the prompt are matched against a pair of regular expressions to determine if they are affirmative or negative. If the POSIXLY_CORRECT environment variable is set, these regular expressions are obtained from the system; otherwise, they are obtained from find's message translations. If the system has no suitable definition, find's own definitions will be used. In either case, the interpretation of the regular expression itself is affected by the environment variables LC_CTYPE (character classes) and LC_COLLATE (character ranges and equivalence classes).
-ok.command ;
Similar to -execdir, but prompts the user in the same manner as -ok before execution. If the user does not agree, it returns false. If the command is executed, its standard input is redirected from /dev/null.
-okdir.This option always returns true. If you are piping the output of find into another program and the files you are searching for might contain newlines, you should consider using -print0 instead of -print.
This option always returns true. This allows filenames that contain newlines or other types of whitespace to be correctly interpreted by programs that process the find output. This option corresponds to the -0 option of xargs.
format
Available escape characters and directives include:
\.\ followed by any other character is treated as an ordinary character, so both are printed.Not available
This option always returns true.
-depth is specified, -prune will have no effect.-delete implies -depth, you cannot effectively use both.Returns zero if no errors have occurred. This is different from -prune, as -prune only applies to the contents of pruned directories, while -quit causes find to stop immediately. No child processes will continue to run. Any command lines built by -exec ... + or -execdir ... + are invoked before the program exits. After -quit is executed, files specified on the command line will no longer be processed. For example, find /tmp/foo /tmp/bar -print -quit will only print /tmp/foo. A common use of -quit is to stop searching the filesystem once you have found what you are looking for.
Always return true. Global options also affect tests that appear earlier in the command line. To avoid confusion, global options should be specified after the starting points and before the first test, positional option, or action. If global options are specified elsewhere, find will issue a warning message explaining that this may be confusing.
Global options appear after the list of starting points and are therefore not in the same category as options like
-L.
-depthUsed for compatibility with FreeBSD, NetBSD, MacOS X, and OpenBSD.
levels
Process the contents of each directory before the directory itself. The -delete action also implies -depth.
file
Use this option to safely pass an arbitrary number of starting points to the find command. Using this option is mutually exclusive with passing starting points on the command line. The file parameter is mandatory. Starting points in the file must be separated by ASCII NUL characters. Two consecutive NUL characters (i.e., a starting point with a zero-length filename) are not allowed and will result in an error diagnostic and a non-zero exit code.
Unlike standard calls where find defaults to the current directory if no path is passed, this option requires the file to be present. Starting points are processed the same way as otherwise; for example, find will recursively enter subdirectories unless prevented. To process only the starting points, pass -maxdepth 0.
Note: If a file is listed multiple times in the input file, it is unspecified whether it will be visited multiple times. If the file is modified during the find operation, the result is also unspecified. Finally, the seek position in the named file when find exits (via -quit or otherwise) is also unspecified. Unspecified means it may or may not work, or might not do anything specific, and the behavior may vary across platforms or findutils versions.
💡 You can use
-files0-from -to read the list of starting points from standard input, for example from a pipe. In this case,-okand-okdiractions are not allowed because they would interfere with reading from standard input for user confirmation.
⚠️ Warning: If the given file is empty, find will not process any starting points and will exit immediately after parsing the arguments.
No description
Normally, find will issue an error message when it cannot stat a file. If you enable this option and a file is deleted between the time find reads the filename from the directory and the time it attempts to stat it, no error message will be issued. This also applies to files or directories specified on the command line. This option takes effect when the command line is read, meaning you cannot enable it for one part of the filesystem and disable it for another (if you need to do this, you need to issue two find commands). Additionally, with -ignore_readdir_race, find will ignore errors from the -delete action if the file has disappeared after the parent directory was read: it will not output error diagnostics, and the return code of the -delete action will be true.
levels
Descend at most levels (a non-negative integer) levels of directories below the starting points. -maxdepth 0 means apply the tests and actions only to the starting points themselves.
levels
Do not apply any tests or actions at levels less than levels (a non-negative integer). -mindepth 1 means process all files except the starting points.
This is an alternative name for -xdev, for compatibility with some other versions of find.
Turns off the effect of -ignore_readdir_race.
Required when searching filesystems that do not follow Unix directory-link conventions, such as CD-ROMs, MS-DOS filesystems, or AFS volume mount points. On a normal Unix filesystem, each directory has at least 2 hard links: its name and its . entry. Additionally, its subdirectories (if any) each have a .. entry pointing to that directory. When find examines a directory, after it has statted 2 fewer subdirectories than the directory's link count, it knows that the remaining entries in the directory are non-directories ("leaf" files in the directory tree). If only the files' names need to be examined, there is no need to stat them; this can significantly speed up the search.
No description
No description
Always return true. They only affect subsequent tests in the command line.
Used for
-amin,-atime,-cmin,-ctime,-mmin, and-mtime.
Measure times from the beginning of today rather than from 24 hours ago. This option only affects tests that appear later in the command line.
Deprecated; use the -L option instead. Implies -noleaf. The -follow option only affects tests that appear after it in the command line. Unless the -H or -L option has been specified, the position of the -follow option changes the behavior of the -newer predicate; any files listed as arguments to -newer will be dereferenced if they are symbolic links. The same applies to -newerXY, -anewer, and -cnewer. Similarly, the -type predicate will always match against the type of the file a symbolic link points to rather than the link itself. Using -follow causes the -lname and -ilname predicates to always return false.
type
Changes the regular expression syntax understood by -regex and -iregex tests that appear later in the command line. To see known regular expression types, use -regextype help. The Texinfo documentation explains the meanings and differences between various regular expression types. If you do not use this option, find behaves as if emacs were specified.
These warnings apply only to command line usage, not to conditions find might encounter while searching directories. The default behavior is -warn if standard input is a tty, and -nowarn otherwise. If a warning message related to command line usage is produced, find's exit status is not affected. If the POSIXLY_CORRECT environment variable is set and -warn is also used, it is unspecified which (if any) warnings will be active.
Operators are listed in order of decreasing precedence:
(expr) Force precedence. Since parentheses have special meaning to the shell, they usually need to be quoted. Many examples use backslashes for this: \(...\) instead of (...).! expr True if the expression is false (negation). This character also usually needs to be protected from shell interpretation.💡 Tip: When
-ais specified implicitly (e.g., no explicit operator between two tests) or explicitly, it has higher precedence than-o. For example,find . -name foo -o -name bar -printwill never printfoo.
expr
Equivalent to ! expr, but not POSIX-compliant.
expr1 -a expr2
Two consecutive expressions are treated as implicitly connected by -a; if expr1 is false, expr2 is not evaluated. Equivalent to expr1 expr2.
expr1 -and expr2
Same as -a. Not POSIX-compliant.
expr1 -o expr2
Both expr1 and expr2 are always evaluated. The value of expr1 is discarded; the value of the list is the value of expr2. The comma operator (,) is useful for searching for several different types of things but only traversing the filesystem hierarchy once. The -fprintf action can be used to list various matches into several different output files. If expr1 is true, expr2 is not evaluated.
expr1 -or expr2
Same as -o. Not POSIX-compliant.
Search all files in the current directory whose content contains "140.206.111.111":
find . -type f -name "*" | xargs grep "140.206.111.111"
List all files and folders in the current directory and its subdirectories:
find .
Find files ending in .txt in the /home directory:
find /home -name "*.txt"
Same as above, but case-insensitive:
find /home -iname "*.txt"
Find all files ending in .txt and .pdf in the current directory and subdirectories:
find . \( -name "*.txt" -o -name "*.pdf" \)
# OR
find . -name "*.txt" -o -name "*.pdf"
Match by file path or name:
find /usr/ -path "*local*"
Match file path based on regular expressions:
find . -regex ".*\(\.txt\|\.pdf\)$"
Same as above, but case-insensitive:
find . -iregex ".*\(\.txt\|\.pdf\)$"
Find files in /home that do not end in .txt:
find /home ! -name "*.txt"
find . -type <type_parameter>
Type parameter list:
Limit maximum depth to 3:
find . -maxdepth 3 -type f
Search for files at least 2 levels deep from the current directory:
find . -mindepth 2 -type f
find . -type f <timestamp_option>
Each file in a UNIX/Linux filesystem has three timestamps:
Search for all files accessed in the last 7 days:
find . -type f -atime -7
Search for all files accessed exactly 7 days ago:
find . -type f -atime 7
Search for all files accessed more than 7 days ago:
find . -type f -atime +7
Search for all files accessed more than 10 minutes ago:
find . -type f -amin +10
Find all files modified more recently than file.log:
find . -type f -newer file.log
find . -type f -size <size_unit>
File size units:
Search for files larger than 10 KB:
find . -type f -size +10k
Search for files smaller than 10 KB:
find . -type f -size -10k
Search for files exactly 10 KB in size:
find . -type f -size 10k
Delete all .txt files in the current directory:
find . -type f -name "*.txt" -delete
Search for files with 777 permissions in the current directory:
find . -type f -perm 777
Find .php files in the current directory that do not have 644 permissions:
find . -type f -name "*.php" ! -perm 644
Find all files owned by user tom in the current directory:
find . -type f -user tom
Find all files belonging to group sunk in the current directory:
find . -type f -group sunk
-exec with Other CommandsFind all files owned by root in the current directory and change ownership to tom:
find . -type f -user root -exec chown tom {} \;
In the example above, {} is used with the -exec option to match each file, which is then replaced by the corresponding filename.
Find all .txt files in your home directory and delete them:
find $HOME/. -name "*.txt" -ok rm {} \;
In the example above, -ok behaves like -exec but prompts the user for confirmation before performing the action.
Find all .txt files in the current directory and concatenate them into all.txt:
find . -type f -name "*.txt" -exec cat {} \; > /all.txt
Move .log files older than 30 days to the old directory:
find . -type f -mtime +30 -name "*.log" -exec cp {} old \;
Find all .txt files in the current directory and print them in the format "File: filename":
find . -type f -name "*.txt" -exec printf "File: %s\n" {} \;
Since multiple commands cannot be used directly within a single -exec parameter, you can invoke a script:
-exec ./test.sh {} \;
Find all .txt files in the current directory or subdirectories, but skip the sk subdirectory:
find . -path "./sk" -prune -o -name "*.txt" -print
⚠️
./skcannot be written as./sk/, otherwise it will not work.
Ignore two directories:
find . \( -path ./sk -o -path ./st \) -prune -o -name "*.txt" -print
⚠️ If using relative paths, you must prepend them with
./.
List all files with zero length:
find . -empty
find ~ -name '*jpg' # Find all jpg files in the home directory. The -name parameter allows you to limit results to files matching a given pattern.
find ~ -iname '*jpg' # -iname is like -name, but case-insensitive.
find ~ \( -iname 'jpeg' -o -iname 'jpg' \) # Some images might have .jpeg extensions. We can combine patterns with OR (-o).
find ~ \( -iname '*jpeg' -o -iname '*jpg' \) -type f # Use -type f to ensure you are finding only files, in case there are directories ending in jpg.
find ~ \( -iname '*jpeg' -o -iname '*jpg' \) -type d # Find directories with these names instead.
Filter for files modified in the last week:
find ~ \( -iname '*jpeg' -o -iname '*jpg' \) -type f -mtime -7
You can filter by status change time (ctime), modification time (mtime), or access time (atime). These are in days; for finer control, use minutes (cmin, mmin, and amin). Use + (greater than) or - (less than) before the number unless you want an exact match.
Find large files (e.g., greater than 1 GB) in the /var/log directory:
find /var/log -size +1G
Find all files owned by bcotton in /data:
find /data -owner bcotton
Find files based on permissions. For example, find files in your home directory that are readable by everyone:
find ~ -perm -o=r
Delete automatically generated files under macOS:
find ./ -name '__MACOSX' -depth -exec rm -rf {} \;
Count lines of code, excluding empty lines:
find . -name "*.java" | xargs cat | grep -v ^$ | wc -l