Searching Files with find and locate

Published on November 27, 2025 by Team SKY | Tags: DevOps

Efficient file searching is essential for system administration and development workflows. Linux provides two powerful tools for file discovery: find for real-time searching with extensive criteria, and locate for lightning-fast searches using a pre-built database. Understanding when and how to use each tool can dramatically improve your productivity.

find vs locate: Key Differences

Aspect find locate
Search Method Real-time directory traversal Pre-built database query
Speed Slower (searches actual filesystem) Very fast (searches database)
Freshness Always current Might be outdated
Complexity Highly flexible and powerful Simple pattern matching
Resource Usage High CPU and I/O Low resource usage
Use Case Precise, complex searches Quick filename searches
When to Use Each Tool:
• Use find for: Recent files, complex criteria, file content search, permission-based searches
• Use locate for: Quick filename searches, system-wide searches, when you know the approximate filename

The find Command

🔍
find

Search for files in real-time with extensive criteria and actions.

find [path...] [expression]

Basic Syntax:

  • find /path -name "pattern"
  • find . -type f -name "*.txt"
  • find ~ -mtime -7

Key Features:

  • Real-time filesystem search
  • Extensive search criteria
  • Execute actions on found files
  • Recursive directory traversal
⚙️

Common find Options

Essential options for everyday file searching.

-name
Search by filename
-type
File type (f=file, d=dir)
-mtime
Modification time
-size
File size
-user
File owner
-perm
File permissions

Examples:

  • find . -name "*.conf"
  • find /var -type f -mtime -1
  • find ~ -size +100M

Advanced find Expressions

⏰

Time-based Search

Find files based on modification, access, or change times.

find [path] -[cam]time [days]

Time Options:

  • -mtime - Modification time
  • -atime - Access time
  • -ctime - Change time (metadata)
  • -mmin - Minutes instead of days

Time Format:

  • +n - More than n days ago
  • -n - Less than n days ago
  • n - Exactly n days ago

Examples:

  • find . -mtime -7 - Modified in last 7 days
  • find /tmp -atime +30 - Accessed over 30 days ago
  • find /var/log -mmin -60 - Modified in last hour
📏

Size-based Search

Find files based on their size with various units.

find [path] -size [size]

Size Units:

  • c - Bytes
  • k - Kilobytes
  • M - Megabytes
  • G - Gigabytes

Size Format:

  • +n - Larger than n units
  • -n - Smaller than n units
  • n - Exactly n units

Examples:

  • find /home -size +100M - Files larger than 100MB
  • find . -size -1k - Files smaller than 1KB
  • find /var -size +500M -size -1G - Between 500MB and 1GB
👤

Permission & Ownership

Search files by permissions, ownership, and groups.

find [path] -user|-group|-perm [value]

Ownership Options:

  • -user username - Owned by user
  • -group groupname - Owned by group
  • -nouser - No owner in /etc/passwd
  • -nogroup - No group in /etc/group

Permission Examples:

  • find . -perm 644 - Exact permissions
  • find / -perm -4000 - SUID files
  • find . -perm /222 - Writable by someone
  • find /home -user john - Files owned by john

find Actions and Execution

🛠️

Executing Commands

Perform actions on found files using -exec or -delete.

find [path] [criteria] -exec command {} \;

Action Options:

  • -exec - Execute command
  • -ok - Interactive execution
  • -delete - Delete files
  • -ls - List in long format
  • -print - Print file paths (default)

Examples:

  • find . -name "*.tmp" -delete
  • find /var/log -name "*.log" -exec cp {} /backup/ \;
  • find . -name "*.jpg" -ok rm {} \;
  • find . -type f -ls
🔧

Combining Conditions

Use logical operators to create complex search criteria.

find [path] [expr1] -[and|or] [expr2]

Logical Operators:

  • -a or -and - Logical AND
  • -o or -or - Logical OR
  • ! or -not - Logical NOT
  • ( ) - Group expressions

Examples:

  • find . \( -name "*.txt" -o -name "*.md" \)
  • find /home -user john ! -name "*.tmp"
  • find . -type f -size +1M -a -mtime -30
  • find . -name "*.php" -o -name "*.html"

The locate Command

⚡
locate

Fast database-driven file searching using pre-built indexes.

locate [options] pattern

Basic Usage:

  • locate filename
  • locate "*.conf"
  • locate -i "readme"

Key Features:

  • Extremely fast searching
  • Uses pre-built database
  • Simple pattern matching
  • Limited search criteria
🔄

Database Management

Managing the locate database for accurate searches.

sudo updatedb

Database Files:

  • /var/lib/mlocate/mlocate.db - Main database
  • Updated daily via cron
  • Manual update: sudo updatedb

locate Options:

  • -i - Case insensitive
  • -l N - Limit to N results
  • -e - Only existing files
  • -c - Count matches only
  • -r - Regex search

Examples:

  • locate -i "readme"
  • locate -l 10 "*.log"
  • locate -c "*.py"

Practical Examples

Real-World File Search Scenarios

# 1. System Administration
# Find all configuration files modified recently
find /etc -name "*.conf" -mtime -30

# Find large log files
find /var/log -name "*.log" -size +100M

# Find files owned by specific user
find /home -user john -type f

# 2. Development Workflows
# Find all Python files in project
find . -name "*.py" -type f

# Find files containing specific text
find . -type f -name "*.java" -exec grep -l "TODO" {} \;

# Find empty directories
find . -type d -empty

# 3. Cleanup Operations
# Find and delete temporary files
find /tmp -name "*.tmp" -mtime +7 -delete

# Find core dump files
find / -name "core" -type f 2>/dev/null

# Find broken symbolic links
find . -type l -! -exec test -e {} \; -print

# 4. Security Auditing
# Find SUID files
find / -type f -perm -4000 2>/dev/null

# Find world-writable files
find / -type f -perm -0002 ! -type l 2>/dev/null

# Find files without owners
find / -nouser -o -nogroup 2>/dev/null

# 5. Backup and Archiving
# Find recently modified files for backup
find /home -type f -mtime -1 -exec tar -uf backup.tar {} +

# Find large files to archive
find /home -type f -size +500M -exec ls -lh {} \;

# 6. Using locate for quick searches
# Quick find configuration files
locate ".conf" | grep nginx

# Find all PDF documents
locate "*.pdf"

# Count Python files in system
locate -c "*.py"

Common Use Cases

System Maintenance

  • Log Rotation: find /var/log -name "*.log" -size +100M -exec gzip {} \;
  • Temp File Cleanup: find /tmp -type f -atime +7 -delete
  • Disk Space Management: find /home -type f -size +500M -exec ls -lh {} \;
  • Backup Preparation: find /home -type f -mtime -1 -exec tar -rf incremental.tar {} \;

Development & Debugging

  • Code Search: find src/ -name "*.java" -exec grep -l "NullPointer" {} \;
  • Project Analysis: find . -name "*.py" | wc -l
  • Dependency Check: locate "libssl.so"
  • Configuration Files: locate "nginx.conf"

Security & Auditing

  • Permission Audit: find /home -type f -perm /o=w
  • SUID Check: find / -type f -perm -4000 2>/dev/null
  • Recent Changes: find /etc -type f -mtime -1
  • Orphaned Files: find / -nouser -o -nogroup 2>/dev/null

Performance Optimization

🚀

find Performance Tips

Optimize find commands for better performance.

Best Practices:

  • Use specific paths instead of /
  • Apply restrictive criteria early
  • Use -maxdepth to limit recursion
  • Combine multiple criteria with -a
  • Use xargs for better -exec performance

Examples:

  • find /home/user -maxdepth 3 -name "*.txt"
  • find . -name "*.log" -a -size +1M
  • find . -name "*.tmp" | xargs rm
💾

locate Database Management

Keep the locate database accurate and up-to-date.

Database Configuration:

  • Automatic updates via /etc/cron.daily/mlocate
  • Manual update: sudo updatedb
  • Exclude paths in /etc/updatedb.conf
  • Check database age: ls -la /var/lib/mlocate/mlocate.db

Configuration File:

# /etc/updatedb.conf
PRUNE_BIND_MOUNTS="yes"
PRUNEFS="..."
PRUNENAMES="..."
PRUNEPATHS="/tmp /var/spool"
Important Considerations:
• find can be resource-intensive on large filesystems
• locate might not find recently created files until database update
• Always test -exec commands with -ok first
• Be extremely careful with -delete and wildcard patterns
• Use 2>/dev/null to suppress permission denied errors
• Consider filesystem boundaries when using -xdev
Pro Tips:
• Use find . -name "pattern" | xargs command for better performance with many files
• Combine find with grep for content searching: find . -type f -exec grep -l "pattern" {} \;
• Use -printf for custom output formatting in find
• Remember locate -b to match only the basename (filename)
• Set up aliases for common find patterns in your shell configuration

Key Takeaways

Mastering file searching with find and locate is essential for efficient Linux system administration and development. find offers unparalleled flexibility with real-time searching and extensive criteria, while locate provides lightning-fast filename searches using a pre-built database. Understanding when to use each tool, optimizing search patterns, and combining them with other utilities like grep and xargs enables you to handle complex file management tasks efficiently.

Next Step: Explore process management and system monitoring to understand how to track running applications, manage system resources, and maintain optimal system performance.