find Command Builder

Reading the time filters #

The -mtime and -mmin tests take a number, and the sign in front of that number decides the direction of the search. Getting the sign backwards is the most common find mistake, because both forms run without an error and simply return the wrong files.

• find . -mtime -7 matches files modified within the last 7 days.
• find . -mtime +7 matches files last modified more than 7 days ago.
• find . -mtime 7 matches files modified in the single 24-hour period that ended 7 days ago, which is almost never useful.

-mmin works the same way but counts minutes instead of 24-hour periods, so -mmin -60 covers the last hour. The builder spells out the direction in plain English for whatever you select, so you can check the meaning before you run the command.

Argument order matters #

find evaluates the command line as an expression, and the order of the arguments changes the result. Two rules cover most cases.

-maxdepth is a global option rather than a test, so it belongs immediately after the search path. If you place it after a test, GNU find still accepts the command but prints a warning and the depth limit no longer applies the way you expect. The builder always emits it first.

Actions such as -delete belong at the end, after every test. A command like find . -delete -name '*.tmp' deletes the entire tree before the name test is ever evaluated, because find works through the expression from left to right. The builder places the action last for the same reason.

Common find tests #

Patterns need quotes. Without them the shell expands *.log against the current directory before find ever sees it, and the command either searches for the wrong name or fails with a “paths must precede expression” error. The builder quotes patterns for you. The find command guide covers the full test list and more examples.

Two size details are worth knowing. Sizes are rounded up to the next whole unit before the comparison, so -size -1M matches only files that round below one MiB, which in practice means empty files. Use the bytes unit (c) when you need an exact comparison. For hunting down what is filling a disk, see finding large files in Linux .

Running a command on every match #

The builder offers three ways to act on the results, and they behave differently.

-exec command {} \; runs the command once per match, substituting {} with the path. It is the safest and slowest form, and it works with commands that accept a single argument.

-exec command {} + collects as many paths as fit on one command line and runs the command once per batch. This is much faster on large result sets, but the command has to accept several arguments at once.

-print0 | xargs -0 command pipes null-separated paths to xargs. The null separator is what makes this safe: file names containing spaces or newlines stay intact instead of being split into pieces. Note that xargs appends the paths at the end of the command, so use one of the -exec forms when you need {} somewhere in the middle.

Deleting matches safely #

-delete removes every match with no prompt and no undo, so treat it as a two-step operation. Build the command with the print action first, read the list, then switch the action to -delete and run the same command again. The builder shows a warning whenever the delete action is selected.

Two behaviors surprise people. -delete automatically turns on -depth, so directories are processed after their contents; this also means -prune does not combine with -delete. And -delete only removes directories that are already empty, so a directory that still holds unmatched files reports an error and stays in place.

When you need to search file contents rather than metadata, pair find with grep as described in searching files with grep , or reach for locate when an indexed name lookup is enough.