Finding Files with find and locate

Analogy categoryAnalogies

As a filesystem grows to contain thousands or millions of files, remembering exact paths becomes impossible, and browsing manually is impractical. Linux provides two complementary tools for this: find, which walks the directory tree in real time and matches on almost any file attribute (name, size, owner, permissions, modification time, type), and locate, which performs a near-instant lookup against a prebuilt database of filenames. find is slower but always accurate and extremely flexible; locate is nearly instantaneous but can be out of date and only matches on filename patterns. Knowing both — and when to reach for each — is a fundamental Linux administration skill.

🏏

Cricket analogy: find is like a scout who walks every net session in person checking each player's current form (always accurate but slow), while locate is like consulting last week's published squad list (instant, but possibly outdated if a player was just dropped).

find: real-time, attribute-based search

find <path> <expression> recursively walks the directory tree starting at <path>, testing every file and directory against the expression you supply. Because it inspects the live filesystem, its results are always accurate, but a search over a huge tree (like /) can take a long time. find supports tests like -name (glob-style filename match), -iname (case-insensitive), -type f/d/l (file/directory/symlink), -size, -mtime/-mmin (modification time), -user/-group, and -perm (permission bits), and these can be combined with -and (implicit), -or, and -not. The -exec action runs a command on each match, making find a powerful tool for bulk operations, not just searching.

🏏

Cricket analogy: find with combined tests like -name and -type is like a chief selector who filters players by name, role, and recent form all at once, walking the full domestic circuit live and applying -exec to shortlist candidates directly for selection.

bash

# Find all .log files under /var/log, case-insensitive
find /var/log -iname '*.log'

# Find regular files over 100MB anywhere under /home
find /home -type f -size +100M

# Find files modified in the last 24 hours
find /etc -mtime -1

# Find and delete all .tmp files older than 7 days (be careful!)
find /tmp -type f -name '*.tmp' -mtime +7 -delete

# Find files owned by a specific user and change their owner
find /srv/www -user olduser -exec chown newuser {} \;

# Combine conditions: world-writable regular files (a security check)
find / -type f -perm -o+w -not -path '/proc/*' 2>/dev/null

locate: index-based, near-instant lookup

locate searches a prebuilt database (usually /var/lib/mlocate/mlocate.db on Debian/Ubuntu, or the plocate variant on newer systems) that maps out the filesystem's filenames. Because it's a simple database lookup rather than a live traversal, locate returns results almost instantly even across an entire disk. The tradeoff is staleness: the database is normally refreshed once a day by a cron/systemd timer job running updatedb, so files created or deleted very recently may not show up correctly until the next update. You can force an immediate refresh with sudo updatedb when accuracy matters right now.

🏏

Cricket analogy: locate's prebuilt database is like a match-day program printed hours before the toss: it lists the announced squad instantly, but a last-minute injury substitution won't appear until the next edition (updatedb) is printed, unless you check the dressing room directly.

bash

# Quick lookup by filename substring
locate nginx.conf

# Case-insensitive search, limited to 10 results
locate -i --limit 10 readme

# Force the database to refresh before searching
sudo updatedb && locate my-new-file.txt

# Count how many matches exist without printing them all
locate -c '*.jpg'

On modern Ubuntu (22.04+) the classic mlocate package has largely been replaced by plocate, a drop-in replacement that uses a more compact, faster-to-search database format while keeping the same locate/updatedb command names. On RHEL/CentOS/Fedora, install with sudo yum install mlocate (or dnf install mlocate) — it is often not installed by default, unlike find, which ships as part of the base findutils package everywhere.

Using find with -exec ... -delete or -exec rm {} \; is powerful but dangerous: a mistyped path (e.g. a stray space turning find /tmp /oldlogs into two separate search roots instead of one path) can delete far more than intended. Always run the find command WITHOUT -delete/-exec first to review the matched file list, and consider -exec ... {} + (batched) over \; (one process per file) for both safety review and performance.

find performs a real-time recursive filesystem walk and matches on name, type, size, time, owner, permissions, and more.
find's -exec action lets you run a command on every match, enabling powerful bulk operations like batch chown or delete.
locate queries a prebuilt database for near-instant filename lookups but can return stale results between updatedb runs.
updatedb refreshes locate's database and normally runs automatically once a day via a systemd timer or cron job.
plocate has replaced mlocate as the default locate backend on recent Ubuntu releases, with a faster, smaller database.
Always dry-run destructive find expressions without -delete/-exec first to confirm the match set before acting on it.

Practice what you learned

1. Why might `locate` fail to return a file that was created 30 seconds ago?

2. Which find test matches only regular files larger than 100 megabytes?

3. What is the main advantage of `-exec ... {} +` over `-exec ... {} \;` in find?

4. On recent Ubuntu releases, which package commonly provides the locate/updatedb commands as a faster successor to mlocate?

5. Which command should you run before trusting locate results if you just created a new file and need to find it immediately?

Was this page helpful?

Viewing and Editing Files (cat, less, nano, vim basics)

Related Study Notes in DevOps

Browse all study notes

DevOps

Nginx Study Notes

DevOps · 30 topics

DevOps

Ansible Study Notes

DevOps · 30 topics

DevOps

Advanced Kubernetes Study Notes

Kubernetes · 30 topics

DevOps

Advanced Bash Scripting Study Notes

Bash · 30 topics

DevOps

Apache Kafka Study Notes

Kafka · 30 topics

DevOps

Docker & Kubernetes Study Notes

YAML · 40 topics

Topics covered

#Bash#LinuxShellScriptingStudyNotes#DevOps#FindingFilesWithFindAndLocate#Finding#Files#Find#Locate#StudyNotes#SkillVeris

Finding Files with find and locate