Linux

linuxfindgrepsearchlocate

Linux Search & Find Cheat Sheet

find - Search for Files

Basic Syntax

find [path] [options] [expression]

Find by Name

# Find files by exact name
find /path -name "filename.txt"

# Case-insensitive search
find /path -iname "filename.txt"

# Find with wildcards
find /path -name "*.log"
find /path -name "file*.txt"

# Find excluding pattern
find /path ! -name "*.log"

# Find in current directory
find . -name "*.conf"

# Find in multiple directories
find /var /etc -name "*.conf"

Find by Type

# Find files only
find /path -type f

# Find directories only
find /path -type d

# Find symbolic links
find /path -type l

# Find sockets
find /path -type s

# Find block devices
find /path -type b

# Find character devices
find /path -type c

# Find pipes
find /path -type p

Find by Size

# Find files larger than 100MB
find /path -type f -size +100M

# Find files smaller than 10KB
find /path -type f -size -10k

# Find files exactly 1GB
find /path -type f -size 1G

# Size units: c (bytes), k (KB), M (MB), G (GB)

# Find empty files
find /path -type f -empty

# Find empty directories
find /path -type d -empty

# Find files between 10MB and 100MB
find /path -type f -size +10M -size -100M

Find by Time

# Modified in last 7 days
find /path -mtime -7

# Modified more than 30 days ago
find /path -mtime +30

# Modified exactly 10 days ago
find /path -mtime 10

# Accessed in last 24 hours
find /path -atime -1

# Changed in last 5 days
find /path -ctime -5

# Modified in last 60 minutes
find /path -mmin -60

# Modified more than 2 hours ago
find /path -mmin +120

# Newer than reference file
find /path -newer reference.txt

# Files modified today
find /path -type f -newermt $(date +%Y-%m-%d)

Find by Permissions

# Find files with exact permissions
find /path -perm 644

# Find files with at least these permissions
find /path -perm -644

# Find files with any of these permissions
find /path -perm /644

# Find executable files
find /path -type f -executable

# Find readable files
find /path -type f -readable

# Find writable files
find /path -type f -writable

# Find files with SUID bit set
find /path -perm /4000

# Find files with SGID bit set
find /path -perm /2000

# Find world-writable files
find /path -type f -perm -002

Find by Owner

# Find by username
find /path -user username

# Find by group
find /path -group groupname

# Find by UID
find /path -uid 1000

# Find by GID
find /path -gid 1000

# Find files not owned by anyone
find /path -nouser

# Find files with no group
find /path -nogroup

Find with Actions

# Delete found files
find /path -name "*.tmp" -delete

# Execute command on each file
find /path -type f -exec chmod 644 {} \;

# Execute command with confirmation
find /path -type f -ok rm {} \;

# Execute command on multiple files at once
find /path -type f -exec chmod 644 {} +

# Print found files
find /path -name "*.log" -print

# Print with null separator (safe for xargs)
find /path -name "*.txt" -print0

# Copy found files
find /path -name "*.conf" -exec cp {} /backup/ \;

# Move found files
find /path -name "*.old" -exec mv {} /archive/ \;

Combine Conditions

# AND (both conditions must be true)
find /path -name "*.log" -size +10M

# OR (either condition can be true)
find /path \( -name "*.log" -o -name "*.txt" \)

# NOT (negate condition)
find /path ! -name "*.log"

# Complex example
find /path -type f \( -name "*.log" -o -name "*.txt" \) -size +1M

# Multiple conditions with grouping
find /path \( -name "*.c" -o -name "*.h" \) -type f -mtime -7

Limit Depth

# Search only in current directory (depth 1)
find /path -maxdepth 1 -name "*.txt"

# Search up to 3 levels deep
find /path -maxdepth 3 -type f

# Skip at least 2 levels
find /path -mindepth 2 -name "*.log"

# Combination
find /path -mindepth 2 -maxdepth 4 -type d

Advanced Examples

# Find large log files older than 30 days
find /var/log -name "*.log" -type f -mtime +30 -size +100M

# Find and compress old files
find /backup -type f -mtime +90 -exec gzip {} \;

# Find and list with details
find /path -name "*.conf" -exec ls -lh {} \;

# Find duplicate files by size
find /path -type f -printf '%s %p\n' | sort -n

# Find broken symlinks
find /path -type l ! -exec test -e {} \; -print

# Find files modified in specific date range
find /path -type f -newermt 2024-01-01 ! -newermt 2024-02-01

# Find and count files by type
find /path -type f -name "*.txt" | wc -l

grep - Search File Contents

Basic Search

# Search for pattern in file
grep "pattern" file.txt

# Search in multiple files
grep "pattern" file1.txt file2.txt

# Search in all files in directory
grep "pattern" /path/*

# Recursive search
grep -r "pattern" /path

# Recursive search following symlinks
grep -R "pattern" /path

Common Options

# Case-insensitive search
grep -i "pattern" file.txt

# Show line numbers
grep -n "pattern" file.txt

# Count matching lines
grep -c "pattern" file.txt

# Show only filenames with matches
grep -l "pattern" *.txt

# Show only filenames without matches
grep -L "pattern" *.txt

# Invert match (show non-matching lines)
grep -v "pattern" file.txt

# Show only the matched part
grep -o "pattern" file.txt

# Show filenames with line numbers
grep -Hn "pattern" /path/*

Context Lines

# Show 3 lines after match
grep -A 3 "pattern" file.txt

# Show 3 lines before match
grep -B 3 "pattern" file.txt

# Show 3 lines before and after match
grep -C 3 "pattern" file.txt

# Combination with line numbers
grep -n -C 2 "pattern" file.txt

Regular Expressions

# Extended regex
grep -E "pattern1|pattern2" file.txt

# Perl-compatible regex
grep -P "\d{3}-\d{3}-\d{4}" file.txt

# Match whole word
grep -w "word" file.txt

# Match at beginning of line
grep "^pattern" file.txt

# Match at end of line
grep "pattern$" file.txt

# Match empty lines
grep "^$" file.txt

# Match any single character
grep "p.ttern" file.txt

# Match zero or more
grep "patt*ern" file.txt

# Match one or more
grep -E "patt+ern" file.txt

File Type Filtering

# Include only specific files
grep -r --include="*.txt" "pattern" /path

# Include multiple patterns
grep -r --include="*.{c,h}" "pattern" /path

# Exclude specific files
grep -r --exclude="*.log" "pattern" /path

# Exclude directories
grep -r --exclude-dir=node_modules "pattern" /path

# Exclude multiple directories
grep -r --exclude-dir={.git,node_modules,dist} "pattern" /path

Advanced Examples

# Find files containing multiple patterns
grep -l "pattern1" *.txt | xargs grep -l "pattern2"

# Search with color highlighting
grep --color=auto "pattern" file.txt

# Search compressed files
zgrep "pattern" file.gz

# Binary file search
grep -a "pattern" binary_file

# Show only count per file
grep -c "pattern" *.txt

# Case-insensitive recursive with line numbers
grep -rni "pattern" /path

Combine find and grep

Find Files Containing String

# Find files containing specific string
find /path -type f -exec grep -l "pattern" {} \;

# More efficient with grep -r
grep -rl "pattern" /path

# With specific file types
find /path -name "*.txt" -exec grep -l "pattern" {} \;

# Show matching lines with filenames
find /path -name "*.conf" -exec grep -Hn "pattern" {} \;

# Search and show context
find /path -type f -exec grep -C 2 "pattern" {} +

Find and Search with Conditions

# Find recent files containing pattern
find /path -type f -mtime -7 -exec grep -l "error" {} \;

# Find large files containing pattern
find /path -type f -size +10M -exec grep -l "pattern" {} \;

# Find by name and search content
find /path -name "*.log" -exec grep -H "ERROR" {} \;

# Exclude certain directories
find /path -type f -not -path "*/node_modules/*" -exec grep -l "TODO" {} \;

Using xargs

# More efficient than -exec
find /path -type f -name "*.txt" -print0 | xargs -0 grep -l "pattern"

# With file type filtering
find /path -name "*.c" -print0 | xargs -0 grep -n "function_name"

# Process in parallel
find /path -type f -print0 | xargs -0 -P 4 grep -l "pattern"

locate - Fast File Search

Basic Usage

# Find files by name
locate filename

# Case-insensitive search
locate -i filename

# Count matches
locate -c filename

# Show only existing files
locate -e filename

# Limit number of results
locate -l 10 filename

# Show statistics
locate -S

Update Database

# Update locate database (requires root)
sudo updatedb

# Update with custom database
updatedb -o /path/to/database

Advanced locate

# Search with regex
locate -r "pattern.*\.txt$"

# Search in specific database
locate -d /path/to/database filename

# Show basename only
locate -b filename

# Ignore case with regex
locate -i -r "pattern"

which - Find Commands

Basic Usage

# Find command location
which python

# Find multiple commands
which python pip node

# Show all matches
which -a python

whereis - Find Binary, Source, Manual

# Find binary, source, and manual
whereis python

# Only binary
whereis -b python

# Only manual
whereis -m python

# Only source
whereis -s python

# Search in unusual locations
whereis -B /custom/path -f python

type - Identify Command Type

# Show command type
type ls
type cd

# Show all locations
type -a python

# Show path only
type -p python

# Check if command exists
type -t command

Modern Alternatives

fd - Modern find Alternative

# Install: apt install fd-find (Debian/Ubuntu)
# or: brew install fd (macOS)

# Simple search
fd pattern

# Case-insensitive
fd -i pattern

# Search specific file type
fd -e txt

# Search in hidden files
fd -H pattern

# Search with regex
fd "^test.*\.py$"

# Exclude patterns
fd pattern -E node_modules

# Execute command
fd pattern -x chmod 644

# Show full path
fd -a pattern

ripgrep (rg) - Modern grep Alternative

# Install: apt install ripgrep (Debian/Ubuntu)
# or: brew install ripgrep (macOS)

# Basic search
rg "pattern"

# Case-insensitive
rg -i "pattern"

# Show context
rg -C 3 "pattern"

# Search specific file types
rg -t py "pattern"

# List available types
rg --type-list

# Search hidden files
rg --hidden "pattern"

# Exclude directories
rg "pattern" -g '!node_modules'

# Show only filenames
rg -l "pattern"

# Fixed string search (no regex)
rg -F "literal.string"

# Count matches
rg -c "pattern"

# Multi-line search
rg -U "pattern.*\n.*other"

# Replace preview
rg "old" -r "new"

Practical Examples

Find and Remove Old Files

# Find and delete files older than 30 days
find /tmp -type f -mtime +30 -delete

# With confirmation
find /tmp -type f -mtime +30 -ok rm {} \;

# Preview before delete
find /tmp -type f -mtime +30 -print

Find Large Files

# Find top 10 largest files
find /path -type f -exec ls -lh {} \; | sort -h -k5 | tail -10

# Using du and sort
find /path -type f -exec du -h {} \; | sort -rh | head -20

# Files larger than 1GB
find /path -type f -size +1G -exec ls -lh {} \;

Find Duplicate Files

# By content (using md5sum)
find /path -type f -exec md5sum {} \; | sort | uniq -w32 -d

# By name
find /path -type f -printf "%f\n" | sort | uniq -d

Search Logs for Errors

# Find error messages in logs
grep -r "ERROR" /var/log/

# With timestamp
grep -rn "ERROR" /var/log/ | grep "$(date +%Y-%m-%d)"

# Count errors per file
grep -rc "ERROR" /var/log/*.log | grep -v ":0$"

# Find multiple error patterns
grep -rE "ERROR|FATAL|CRITICAL" /var/log/

Find Configuration Files

# Find all .conf files
find /etc -name "*.conf"

# Find config files modified today
find /etc -name "*.conf" -mtime 0

# Find and backup config files
find /etc -name "*.conf" -exec cp {} /backup/ \;

Find and Replace in Files

# Find files containing pattern and replace
find /path -type f -name "*.txt" -exec sed -i 's/old/new/g' {} \;

# Preview before replace
find /path -type f -name "*.txt" -exec sed -n 's/old/new/gp' {} \;

# Using grep and sed
grep -rl "old" /path | xargs sed -i 's/old/new/g'

Search Source Code

# Find TODO comments
grep -rn "TODO" --include="*.{c,cpp,h,py,js}" .

# Find function definitions in C
grep -rn "^[a-zA-Z_][a-zA-Z0-9_]*\s*(" --include="*.c" .

# Find imports in Python
grep -rn "^import\|^from" --include="*.py" .

# Count lines of code
find . -name "*.py" -exec wc -l {} \; | awk '{sum+=$1} END {print sum}'

Find Files by Content Type

# Find text files (by content, not extension)
find /path -type f -exec file {} \; | grep "text"

# Find images
find /path -type f -exec file {} \; | grep "image"

# Find executable scripts
find /path -type f -executable -exec file {} \; | grep "script"

Monitor for New Files

# Watch directory for changes
watch -n 1 'find /path -mmin -1'

# Using inotifywait (install inotify-tools)
inotifywait -m -r -e create /path

Performance Tips

Use locate for filename searches - Much faster than find
Limit search depth - Use -maxdepth to avoid deep recursion
Use specific paths - Don’t search from / unless necessary
Use -print0 with xargs -0 - Safe for filenames with spaces
Prefer grep -r over find -exec grep - More efficient
Use modern tools - fd and ripgrep are faster alternatives
Exclude unnecessary directories - Skip .git, node_modules, etc.
Use -type f for files only - Avoids checking directories
Update locate database regularly - Run updatedb as cron job
Use parallel processing - xargs -P for multi-core systems

Common Pitfalls

Forgetting quotes - Always quote patterns with special characters
Not escaping wildcards - Use \* in find patterns when needed
Case sensitivity - Use -i for case-insensitive searches
Permissions - Some directories require sudo to search
Symlinks - Be aware of -L vs -P in find
Large directories - Searching / can be very slow
Binary files - Use -a or -I with grep for binary files
Regex differences - grep, find, and locate use different regex flavors
File name spaces - Use -print0 and xargs -0 for safety
Resource usage - Large searches can consume significant CPU/IO

Quick Reference

# Find files by name
find /path -name "*.txt"
locate filename
fd pattern

# Search file contents
grep -r "pattern" /path
rg "pattern"

# Find files containing string
grep -rl "pattern" /path
find /path -type f -exec grep -l "pattern" {} \;

# Find large files
find /path -type f -size +100M

# Find old files
find /path -type f -mtime +30

# Find and delete
find /path -name "*.tmp" -delete

# Find with permissions
find /path -perm 644

# Update locate database
sudo updatedb

# Find command location
which command
whereis command
type command