Linux find Command Explained: Find Files by Name, Size, and Time

You remember saving a configuration file, but not its directory. Or you need to identify which files changed during a deployment. The Linux find command lets you search a directory tree using conditions you can inspect before taking action.

This guide uses GNU find, commonly installed on Linux servers. Every search below prints results without changing files. For help choosing a starting directory, see our Linux file system guide.

Start with a directory and a filename

find /etc -type f -name '*.conf' -print

Read this from left to right: start in /etc, select regular files, match names ending in .conf, and print their paths. Subdirectories are included. Keep the quotes around the pattern so your shell does not expand it first.

Choose the smallest useful starting directory. Searching an application directory is usually easier to interpret than searching the entire server. Use . to start from your current directory.

Search by name or type

find . -type f -name 'settings.json' -print
find . -type f -iname '*readme*' -print
find . -type d -name 'backups' -print

The first search matches an exact filename. The second ignores letter case. The third finds directories. These tests inspect names, not file contents; a content-search tool such as grep answers a different question.

Find large files

find /var/log -type f -size +100M -print

This finds regular files with logical lengths greater than 100 MiB. GNU find uses binary units: M means 1,048,576 bytes. Size tests round upward to the chosen unit, so use bytes for an exact threshold:

find . -type f -size +104857600c -print

A large file is a candidate for investigation. Its size does not tell you whether it can be removed. An active log, database, or backup may be large for a legitimate reason.

Find recent changes

find . -type f -mmin -60 -print
find . -type f -mtime -1 -print

These select files modified within the last hour and the last 24 hours. Modification time concerns file data, rather than when you last read the file.

Day tests use completed 24-hour periods, not calendar dates. For example, -mtime +7 starts matching at eight completed days. See GNU’s age-range documentation for the rounding rules.

Combine filters

find /var/log -type f -name '*.log' -size +10M -print

Adjacent tests use an implicit AND. Here, every match must be a regular file, have a name ending in .log, and exceed 10 MiB. Build a search one condition at a time; if results disappear, you know which condition narrowed the selection.

Keep the search manageable

find . -maxdepth 2 -type f -print
find /var -xdev -type f -name '*.log' -print

The first limits directory depth. The second avoids descending onto other filesystems. GNU find does not follow symbolic links by default. Changing that behavior changes the scope of your search.

“Permission denied” means some paths could not be searched, so the results may be incomplete. Check access instead of hiding the error. Our Linux permissions guide explains directory access.

Practice before adding actions

Inside a directory containing your own project files, find a known filename, then try a size filter and a recent modification window. Explain each result before changing the query. Keep -print while learning: deleting matches or running another command on them is a separate decision.

Reference: GNU Findutils manual. Run man find for the options supported by your installed version.