locate and find Commands

Think of searching for files on your Linux system like trying to find items in your home. The locate command is like asking someone who keeps a catalog of everything in your house - it's incredibly fast but might not know about things you've recently bought. The find command is like searching room by room yourself - it takes longer but will find even the newest items and can search based on detailed criteria like size, color, or when you got them. These powerful search tools help you track down files no matter how deeply they're tucked away in your system.

Quick Reference

When to Use These Commands

• When you need to find a file but don't know where it's located
• When you need to find files based on specific characteristics (size, date, permissions)
• When you need to perform actions on multiple files that match certain criteria
• When troubleshooting missing or hidden files
• When cleaning up a system by finding old or large files

The locate Command

Think of locate as the lightning-fast card catalog in a library. It doesn't search your actual files - instead, it checks a pre-built index that gets updated regularly. This makes locate extremely fast but means it might miss recent changes if the database hasn't been updated. Another limitation is that it can only search by filename, not by other attributes like file size, permissions, or modification time. For those searches, find is needed.

# Find all files containing "homework" in their name
locate homework
# Lists all files with "homework" in their path

# Find files containing "report" regardless of case
locate -i report
# Finds "Report.pdf", "REPORT.txt", "weekly_report", etc.

# Find at most 5 PDF files
locate -n 5 "*.pdf"
# Shows only the first 5 PDF files found

# Find all configuration files using regular expressions
locate -r "/etc/.*\.conf$"
# Finds all .conf files in /etc and its subdirectories

# Count how many Python files you have
locate -c "*.py"
# Shows just the number of Python files found

# Update the locate database (do this after creating new files)
sudo updatedb
# Refreshes the database so locate will find new files

The find Command

Think of find as a detective that searches your entire system in real-time. Unlike locate, it doesn't use a database but instead looks through your actual directories. This makes it more versatile and accurate for recent changes, but slower than locate, especially on large systems.

Basic Structure

The basic structure of a find command is:

find [starting directory] [options] [tests] [actions]

Common Tests (Search Criteria)

Operators for Combining Tests

Common Actions

Size Options

# Find all text files in your home directory
find ~ -name "*.txt"
# Lists all .txt files in your home directory and subdirectories

# Find large files that might be wasting space
find /home -type f -size +100M
# Finds files larger than 100MB in /home

# Find files between 10MB and 100MB in size (using "and" logic)
find /home -type f -size +10M -size -100M
# Finds files larger than 10MB but smaller than 100MB

# Find files modified in the last week but not in the last day
find /var/log -type f -mtime -7 -not -mtime -1
# Finds files modified between 1 and 7 days ago

# Find recently modified files
find /var/log -type f -mtime -2
# Finds files in /var/log modified in the last 2 days

# Find files with specific permissions
find /etc -type f -perm 0777
# Finds files with potentially insecure 777 permissions

# Find all empty files and directories
find /tmp -empty
# Lists all empty files and directories in /tmp

# Find files owned by a specific user
find /home -user john
# Finds files owned by user 'john'

# Find with complex conditions (find text files NOT owned by root)
find /opt -name "*.txt" -not -user root
# Finds text files that don't belong to root

# Find either PNG or JPG files (using "or" logic)
find ~/Pictures \( -name "*.png" -or -name "*.jpg" \)
# Finds all PNG or JPG files in your Pictures directory

# Find executable files that are not shell scripts
find /usr/bin -type f -executable -not -name "*.sh"
# Finds executable files that don't have the .sh extension

# Find files that match multiple criteria (AND example)
find /home -type f -user john -and -mtime -30
# Finds files owned by john that were modified in the last 30 days

# Find docx files OR pdf files (OR example)
find ~/Documents \( -name "*.docx" -o -name "*.pdf" \)
# Finds all Word documents or PDF files

# Find files with complex conditions using AND, OR, and NOT together
find ~/Projects -type f \( -name "*.java" -o -name "*.py" \) -not -path "*/test/*"
# Finds Java or Python files that are not in test directories

Using find with -exec and xargs

One of the most powerful features of find is the ability to perform actions on the files you find. You can do this with the -exec option or by piping to xargs.

# Find and delete all .tmp files
find /tmp -name "*.tmp" -exec rm {} \;
# The {} is replaced with each filename, and \; marks the end of the command

# Make all shell scripts executable
find ~/scripts -name "*.sh" -exec chmod +x {} \;
# Adds executable permission to all .sh files

# Find and copy all configuration files to a backup directory
find /etc -name "*.conf" -exec cp {} ~/backup/ \;
# Copies each .conf file to ~/backup/

# Find and list details about PDF files
find ~/Documents -name "*.pdf" -exec ls -lh {} \;
# Shows detailed listing of each PDF file

# Find and delete all .bak files (alternative to -exec)
find /home -name "*.bak" | xargs rm
# Pipes filenames to xargs which runs rm with those filenames as arguments

# Count lines of code in all Python files
find . -name "*.py" | xargs wc -l
# Counts lines in all Python files

# Create a tar archive of all HTML files
find . -name "*.html" | xargs tar -czf html_files.tar.gz
# Archives all HTML files into a single compressed file

# Replace text in multiple files
find . -name "*.txt" | xargs sed -i 's/old text/new text/g'
# Replaces "old text" with "new text" in all text files

Tips for Success

• Run sudo updatedb regularly to keep the locate database current
• Use locate for quick searches and find when you need more detailed criteria
• Test complex find commands without destructive actions first (remove -delete or -exec)
• When using -exec with potentially destructive commands, run in a test directory first
• Use quotes around patterns with wildcards to prevent shell expansion
• Add the -type f option to find only files (not directories) when appropriate
• Use find -maxdepth to limit how deep find searches to improve performance
• Remember that locate shows file paths, not just filenames

Common Mistakes to Avoid

• Forgetting to update the locate database after creating new files (sudo updatedb)
• Not escaping parentheses in find commands: use \( \) instead of ( )
• Forgetting to terminate -exec commands with \;
• Using find without specifying a starting directory (defaults to current directory)
• Not using quotes around patterns, causing the shell to expand wildcards before find runs
• Using -delete without first verifying which files will be deleted
• Assuming locate can search for files by criteria other than name
• Running complex find commands as root without testing them first

Best Practices

• Use locate for simple filename searches and find for everything else
• Combine multiple tests to narrow down search results precisely
• Use -exec ... {} + instead of -exec ... {} \; when possible for better performance
• Create aliases for commonly used find commands in your .bashrc
• When searching large filesystems, start with more specific directories to improve speed
• Use 2>/dev/null to suppress permission denied errors when searching system directories
• For complex file operations, consider using find to create a list, review it, then execute
• Document complex find commands you create for future reference

Real-World Scenarios

# Find and remove files older than 30 days in /tmp
find /tmp -type f -mtime +30 -delete

# Explanation:
# This finds all regular files (-type f) in the /tmp directory
# that haven't been modified in more than 30 days (-mtime +30)
# and deletes them (-delete)
# This is a common system maintenance task to free up disk space

# Find and fix world-writable files
find /home -type f -perm -0002 -exec chmod o-w {} \;

# Explanation:
# This finds all regular files in /home
# with world-writable permissions (potentially insecure)
# and removes the world-writable bit
# This improves security by preventing unauthorized users from modifying files

# Back up all configuration files modified today
find /etc -name "*.conf" -type f -mtime 0 -exec cp {} ~/config_backup/ \;

# Explanation:
# This finds all .conf files in /etc
# that were modified today (-mtime 0)
# and copies them to a backup directory
# This helps preserve important changes before making system changes