Using Find and Locate commands on Linux

In this article, we want to teach you about Using Find and Locate commands on Linux.

The Find command is used to search for a specific text string in a file.

The Locate command searches the file system for files and directories whose name matches a given pattern.

what you read in this post?

Using Find and Locate commands on Linux

Using Find and Locate commands on Linux

You can follow the steps below to learn to search for files in your system with the Find and Locate commands.

You need to log in to your Linux-based operating system via SSH (secure shell) or your local machine.

Note: To show how to Find and Locate commands work, you need to log in to your server as a root user because the example commands in this guide search for files stored under /, or the root directory.

Using Find command on Linux

Find by name of files on Linux

The most useful way to find files on your Linux system is to search for their names.

You can use the find command to search for your file by its name:

find -name "filename"

This command is case-sensitive. If you want to ignore it, you can use the find command by using the -i option:

find -iname "filename"

If you want to find all files except a file, you can use the following syntax:

find -not -name "filename_to_avoid"

Also, you can use the following syntax instead:

find \! -name "filename_to_avoid"

Note: If you use !, you must escape the character with a backslash (\) so that the shell does not try to interpret it before find can act.

Find by Type of files on Linux

Another way to find files on your Linux system is to specify the type of files.

The syntax of the find command is like this:

find -type type_descriptor query

Let’s see some type descriptors that you can use:

f: regular file
d: directory
l: symbolic link
c: character devices
b: block devices

For example, if you want to find all of the character devices on your Linux system, you can use the following command:

find /dev -type c

This command will search for devices within the /dev directory.

Output
/dev/vcsa6
/dev/vcsu6
/dev/vcs6
/dev/vcsa5
/dev/vcsu5
/dev/vcs5
/dev/vcsa4
/dev/vcsu4
/dev/vcs4
/dev/vcsa3
/dev/vcsu3
...

Also, you can search for files for example that end with the .conf on your Linux syatem. This command will search for files under the /usr directory.

find /usr -type f -name "*.conf"

Output
/usr/src/linux-headers-5.4.0-29-generic/include/config/auto.conf
/usr/src/linux-headers-5.4.0-29-generic/include/config/tristate.conf
/usr/lib/tmpfiles.d/dbus.conf
/usr/lib/tmpfiles.d/systemd-nologin.conf
/usr/lib/tmpfiles.d/var.conf
/usr/lib/tmpfiles.d/systemd.conf
/usr/lib/tmpfiles.d/passwd.conf
...

Find by Time and Size of the files on Linux

With the Find command, you can filter the results by size and time.

You can filter files by their size using the -size parameter. To do this, you need to add the size suffixes at the end of the numerical values.

Here are the most commonly used size suffixes:

c: bytes
k: kilobytes
M: megabytes
G: gigabytes
b: 512-byte blocks

For example, you can find every file in the /usr directory that is exactly 50 bytes on your Linux system with the following command:

find /usr -size 50c

Also, to find files under 50 bytes, you can use the following command:

find /usr -size -50c

You can use the following command to find files of more than 700 Megabytes:

find /usr -size +700M

Linux stores time data about access times, modification times, and change times for every file in the system.

Access Time: The last time a file was read or written to.
Modification Time: The last time the contents of the file were modified.
Change Time: The last time the file’s inode metadata was changed.

You can use the Find command with these options -atime, -mtime, and -ctime. You just enter a value that how many days in the past you’d like to search.

For example, you can use the following command to find files in the /usr directory that were modified on the last day on your Linux system:

find /usr -mtime 1

If you want files that were accessed less than a day ago, you can use the following command:

find /usr -atime -1

To find the files that last had their meta-information changed more than 3 days ago, you can use the following command:

find /usr -ctime +3

You can use these parameters to specify minutes than days. For example, to find files that have been modified at the last minute on your Linux system, you can use the command below:

find /usr -mmin -1

Also, you can find files that were created or changed more recently than the reference file with the command below:

find / -newer reference_file

Search by owner and permissions of files on Linux

You can search for files by the user or group that owns the file using the -user and -group parameters.

For example, To find files in the var directory on your Linux system that is owned by the Syslog user, you can run the command below:

find /var -user syslog

Also, to find files in the /etc directory that is owned by the shadow group, you can use the following command:

find /etc -group shadow

You can find files with exactly the permissions specified with the command below:

find / -perm 644

If you want to specify anything with at least those permissions, you can use the following syntax:

find / -perm -644

Using the Locate command on Linux

The other way to search for the files on Linus is to use the Locate command.

First, you need to install it on your Linux system.

On Debian / Ubuntu:

sudo apt install mlocate

On Centos / RHEL:

sudo dnf install mlocate

This command is quicker and can easily search the entire file system.

The reason locate is faster than find is because it relies on a database that lists all the files on the filesystem.

You can update this database manually with the following command:

sudo updatedb

Note: The locate database must always be up-to-date if you want to find new files. If you add new files before the cron script is executed or before you run the updatedb command, they will not appear in your query results.

The most basic way to find files is to use the following syntax: