Find under Linux: finding a file without manually searching the entire server

When you know a file exists somewhere on a server, but not where, the temptation is often to search folder by folder. Bad idea. Under Linux, find is made for this: search by name, type, size, date, rights, then act only when the result is clear.

I advise you to use it judiciously, especially on a production server. A `find` command run at the root level can scan a huge number of files, display permission errors, and unnecessarily load the disk. The idea is not to type the broadest possible command, but to quickly narrow down the search area.

Tux uses a magnifying glass to search for files on a Linux server. — Find allows you to locate a file in a Linux directory tree without manually searching through each folder.

Start by looking in the right place

The basic form is simple: you specify a starting folder, then a search criterion.

find /etc -name "ssh_config"

Here, Linux is looking for a file named ssh_config In /etc and its subfolders. If you already know the file should be in a specific location, start from that location. It’s faster, more readable, and you avoid scanning the entire system unnecessarily.

To ignore case sensitivity, use -iname :

find /var/www -iname "*.conf"

If you start from the root, expect to see messages Permission deniedThis isn’t necessarily a problem. You can hide them, but don’t do it systematically if you’re specifically looking for a rights issue.

find / -name "nginx.conf" 2>/dev/null

Limit search by file type

On a server, a name can correspond to a file, a folder, a symbolic link, or something else. Add -kind to avoid unnecessary results.

find /var/log -type f -name "*.log"
find /var/www -type d -name "cache"
find /usr/bin -type l -name "python*"

-type f targets standard files. -type d targets folders. -type l It targets symbolic links. This small filter avoids a lot of noise in the results.

You can also limit the depth when you don’t want to go too far down the tree:

find /var/www -maxdepth 2 -type d -name "cache"

This is very useful on websites, backups, or user folders with many subdirectories.

Find the large files before deleting anything.

When a server is running out of disk space, find can help locate large files. Start by listing them, not deleting them.

find /var -type f -size +100M -print
find /home -type f -size +1G -print

To display the sizes in a readable way, you can run ls -lh on each result:

find /var -type f -size +100M -exec ls -lh {} +

If your goal is to free up space, don’t go straight to rmFirst, check what you have found, especially in /var/lib, /var/log or application folders. A database file or cache may require a specific purging method.

For a more comprehensive approach to the subject, you can supplement it with the guide on Commands to use when Linux disk space is full.

Search by date modified

To find what has changed recently, the date options are very useful. For example, files modified in the last 7 days:

find /etc -type f -mtime -7

Files modified more than 30 days ago:

find /var/log -type f -mtime +30

-mtime works in days. For a more refined search, also look at -mmin, which works in minutes:

find /tmp -type f -mmin -60

This is useful after a configuration change, an update, or a script that generated files without clearly telling you where.

Filter by rights without breaking permissions

Find can also search based on permissions. For example, to find executable scripts in a folder:

find /usr/local/bin -type f -perm /111

To identify files that are too easily accessible, you can look for files that are editable by everyone:

find /var/www -type f -perm -002 -exec ls -lh {};

Do not correct a list of results with a chmod global without understanding the context. Linux permissions can quickly lead to application crashes. If you need to review this point, the article on recursive chmod under Linux explains precisely why we need to remain cautious.

Using -exec without triggering a catastrophe

-exec It allows you to execute a command on the files found. It’s powerful, so it’s also where you can do the most damage.

Always start by displaying the results:

find /tmp -type f -name "*.tmp" -print

Only then, if the list is correct, can you request confirmation before deletion:

find /tmp -type f -name "*.tmp" -exec rm -i {} +

The couple {} represents the files found. The + asks find to group several results into the same command when possible, which avoids launching a process for each file.

find /var/log -type f -name "*.log" -exec ls -lh {} +

My advice is simple: don’t delete anything automatically until you’ve reviewed the list. On a server, saving a second isn’t worth restoring from a backup.

A quick method before launching find in production

start with the most accurate file possible;
add -type f, -type d Or -type l as soon as possible;
use -maxdepth if you want to avoid a search that’s too deep;
display the results with -print Or -exec ls -lh before taking action;
Save the destructive commands for last, with confirmation if possible.

For reference documentation, you can consult the GNU Findutils manual at find and the page find(1) from man7. If you need to follow the logs after finding a file, the guide on tail under Linux This method complements it well.