Find Cheatsheet
Syntax Reminder
find [PATH] [GLOBAL OPTS] [TESTS] [ACTIONS]
Always: tests before actions.
Search by Name
| Goal | Command |
|---|---|
| Exact name | find / -name "nginx.conf" |
| Glob pattern | find / -name "*.log" (quote it!) |
| Case insensitive | find / -iname "readme.txt" |
| Full path match | find . -path "*/archive/*.log" |
Search by Type
| Goal | Command |
|---|---|
| Files only | find . -type f |
| Directories only | find . -type d |
| Symlinks only | find . -type l |
| Broken symlinks | find . -type l -xtype l |
| Empty files | find . -type f -empty |
| Empty directories | find . -type d -empty |
Search by Size
| Goal | Command |
|---|---|
| Larger than 1 GB | find / -size +1G |
| Smaller than 10 KB | find . -size -10k |
| Between 10–50 MB | find . -size +10M -size -50M |
Search by Time
| Goal | Command |
|---|---|
| Modified in last 24h | find . -mtime -1 |
| Modified > 30 days ago | find . -mtime +30 |
| Changed in last 60 min | find . -cmin -60 |
| Newer than a reference | find . -newer /path/to/ref.txt |
Search by Owner / Permissions
| Goal | Command |
|---|---|
| Owned by user nginx | find /var -user nginx |
| Owned by group devs | find /var -group devs |
| Exact perms 0644 | find . -perm 0644 |
| SUID bit set | find / -perm /4000 |
| World writable | find / -perm /0002 |
| Orphaned (no user) | find / -nouser |
Actions
| Goal | Command |
|---|---|
| Delete matches | find . -name "*.tmp" -delete |
| Run cmd per file | find . -name "*.bak" -exec rm {} \; |
| Run cmd batched | find . -name "*.bak" -exec rm {} + |
| Safe directory exec | find . -exec chmod 644 {} \; |
| Null-safe pipe | find . -print0 | xargs -0 grep "term" |
Pruning & Depth
| Goal | Command |
|---|---|
| Max depth 1 | find . -maxdepth 1 |
| Skip current dir | find . -mindepth 1 |
| Prune node_modules | find . -name node_modules -prune -o -name "*.js" -print |
Quick Recipes
# Compress logs > 7 days old
find /var/log -name "*.log" -mtime +7 -exec gzip {} +
# Delete old backups, keep 30 days
find /backups -type f -mtime +30 -delete
# Find and fix world-writable scripts
find /usr/local/bin -type f -perm /0002 -exec chmod o-w {} +
# Find big files eating disk space
find / -type f -size +500M -exec ls -lh {} \; 2>/dev/null
# Find recently changed configs (security audit)
find /etc -type f -mmin -1440 # last 24h in minutes