find is one of those commands that looks simple until you need it at 2am on a production box: locate a config file, find logs eating disk space, or hunt down files with dangerous permissions. It searches the filesystem by name, type, size, time, and permissions — and once you know the syntax, it beats clicking through a file manager every single time.
This guide covers the patterns you'll actually use, including the security angle: find is also how admins (and yes, attackers during privilege escalation) locate misconfigured files.
The basic shape
find <where> <conditions> <action> - where — the directory to start from (
.for here,/for everything) - conditions — name, type, size, age, permissions
- action — print the path (default), delete, or run a command on each match
Finding files by name
find /etc -name "*.conf" # all .conf files under /etc find / -name "nginx.conf" 2>/dev/null # exact file, hide permission errors find . -iname "readme*" # case-insensitive The 2>/dev/null trick matters when searching from / — otherwise your results drown in "Permission denied" noise.
By type, size, and age
find /var -type d -name "log*" # directories only find /var/log -type f -size +100M # files over 100 MB — disk-space detective work find /home -type f -mtime -7 # modified in the last 7 days find /tmp -type f -mmin +60 # not modified in the last hour find . -type f -empty # empty files -mtime -7 means less than 7 days old; -mtime +30 means older than 30 days. That plus/minus sign trips everyone up at first.
Running commands on results: -exec
This is where find becomes a power tool:
find /var/log -name "*.log" -exec ls -lh {} \; find . -name "*.tmp" -delete find /var/log -name "*.gz" -mtime +90 -delete # clean old rotated logs {} is the placeholder for each found path, and \; ends the command. Use -exec ... + instead of \; to batch paths into fewer command invocations — much faster on large result sets.
Prefer xargs for pipelines:
find . -name "*.log" | xargs grep -l "ERROR" find . -type f -name "*.sh" | xargs chmod +x The security angle: permissions and privilege escalation
Admins use find to audit dangerous permissions; penetration testers use the exact same commands during privilege escalation. Knowing both sides makes you better at defense.
World-writable files — anything any user can modify is a risk:
find / -type f -perm -0002 2>/dev/null SUID binaries — programs that run as their owner (often root) regardless of who executes them:
find / -perm -4000 -type f 2>/dev/null A legitimate SUID list is short: passwd, sudo, su, a few others. An unexpected entry — say, a copy of bash in /tmp — is a red flag. SUID on a script is ignored by Linux, but SUID on a misconfigured binary is a classic root path.
Files owned by a specific user, useful when auditing a compromised account:
find / -user www-data -type f 2>/dev/null If you find a suspicious SUID binary, remove the bit rather than guessing: chmod u-s /path/to/binary.
Handy one-liners to keep
find . -type f | wc -l # count files recursively find / -xdev -type f -size +500M 2>/dev/null # huge files, stay on one filesystem find . -newer /etc/hostname -type f # files changed after a reference file Once these stick, find stops being a command you look up and becomes the fastest way to answer "where is that file and what is it doing."
