Finding Files with find and locate
As a filesystem grows to contain thousands or millions of files, remembering exact paths becomes impossible, and browsing manually is impractical. Linux provides two complementary tools for this: find, which walks the directory tree in real time and matches on almost any file attribute (name, size, owner, permissions, modification time, type), and locate, which performs a near-instant lookup against a prebuilt database of filenames. find is slower but always accurate and extremely flexible; locate is nearly instantaneous but can be out of date and only matches on filename patterns. Knowing both — and when to reach for each — is a fundamental Linux administration skill.
Cricket analogy: find is like a scout who walks every net session in person checking each player's current form (always accurate but slow), while locate is like consulting last week's published squad list (instant, but possibly outdated if a player was just dropped).
find: real-time, attribute-based search
find <path> <expression> recursively walks the directory tree starting at <path>, testing every file and directory against the expression you supply. Because it inspects the live filesystem, its results are always accurate, but a search over a huge tree (like /) can take a long time. find supports tests like -name (glob-style filename match), -iname (case-insensitive), -type f/d/l (file/directory/symlink), -size, -mtime/-mmin (modification time), -user/-group, and -perm (permission bits), and these can be combined with -and (implicit), -or, and -not. The -exec action runs a command on each match, making find a powerful tool for bulk operations, not just searching.
Cricket analogy: find with combined tests like -name and -type is like a chief selector who filters players by name, role, and recent form all at once, walking the full domestic circuit live and applying -exec to shortlist candidates directly for selection.
# Find all .log files under /var/log, case-insensitive
find /var/log -iname '*.log'
# Find regular files over 100MB anywhere under /home
find /home -type f -size +100M
# Find files modified in the last 24 hours
find /etc -mtime -1
# Find and delete all .tmp files older than 7 days (be careful!)
find /tmp -type f -name '*.tmp' -mtime +7 -delete
# Find files owned by a specific user and change their owner
find /srv/www -user olduser -exec chown newuser {} \;
# Combine conditions: world-writable regular files (a security check)
find / -type f -perm -o+w -not -path '/proc/*' 2>/dev/nulllocate: index-based, near-instant lookup
locate searches a prebuilt database (usually /var/lib/mlocate/mlocate.db on Debian/Ubuntu, or the plocate variant on newer systems) that maps out the filesystem's filenames. Because it's a simple database lookup rather than a live traversal, locate returns results almost instantly even across an entire disk. The tradeoff is staleness: the database is normally refreshed once a day by a cron/systemd timer job running updatedb, so files created or deleted very recently may not show up correctly until the next update. You can force an immediate refresh with sudo updatedb when accuracy matters right now.
Cricket analogy: locate's prebuilt database is like a match-day program printed hours before the toss: it lists the announced squad instantly, but a last-minute injury substitution won't appear until the next edition (updatedb) is printed, unless you check the dressing room directly.
# Quick lookup by filename substring
locate nginx.conf
# Case-insensitive search, limited to 10 results
locate -i --limit 10 readme
# Force the database to refresh before searching
sudo updatedb && locate my-new-file.txt
# Count how many matches exist without printing them all
locate -c '*.jpg'On modern Ubuntu (22.04+) the classic mlocate package has largely been replaced by plocate, a drop-in replacement that uses a more compact, faster-to-search database format while keeping the same locate/updatedb command names. On RHEL/CentOS/Fedora, install with sudo yum install mlocate (or dnf install mlocate) — it is often not installed by default, unlike find, which ships as part of the base findutils package everywhere.
Using find with -exec ... -delete or -exec rm {} \; is powerful but dangerous: a mistyped path (e.g. a stray space turning find /tmp /oldlogs into two separate search roots instead of one path) can delete far more than intended. Always run the find command WITHOUT -delete/-exec first to review the matched file list, and consider -exec ... {} + (batched) over \; (one process per file) for both safety review and performance.
- find performs a real-time recursive filesystem walk and matches on name, type, size, time, owner, permissions, and more.
- find's -exec action lets you run a command on every match, enabling powerful bulk operations like batch chown or delete.
- locate queries a prebuilt database for near-instant filename lookups but can return stale results between updatedb runs.
- updatedb refreshes locate's database and normally runs automatically once a day via a systemd timer or cron job.
- plocate has replaced mlocate as the default locate backend on recent Ubuntu releases, with a faster, smaller database.
- Always dry-run destructive find expressions without -delete/-exec first to confirm the match set before acting on it.
Practice what you learned
1. Why might `locate` fail to return a file that was created 30 seconds ago?
2. Which find test matches only regular files larger than 100 megabytes?
3. What is the main advantage of `-exec ... {} +` over `-exec ... {} \;` in find?
4. On recent Ubuntu releases, which package commonly provides the locate/updatedb commands as a faster successor to mlocate?
5. Which command should you run before trusting locate results if you just created a new file and need to find it immediately?
Was this page helpful?
You May Also Like
Viewing and Editing Files (cat, less, nano, vim basics)
Learn the core command-line tools for reading and modifying text files, from quick dumps with cat to paginated viewing with less and full editing in nano and vim.
grep and Regular Expressions
Master text searching with grep and the regular expression syntax that powers it, from basic literal matches to extended regex patterns and useful flags.
Disk Usage and Management (df, du, mount)
Learn how to inspect filesystem capacity, measure directory sizes, and understand how block devices get attached to the Linux directory tree via mounting.
Linux & Shell Quick Reference
A condensed cheat sheet consolidating the most frequently used Linux commands, Bash syntax, and shortcuts covered throughout this course for fast lookup.
Related Reading
Related Study Notes in DevOps
Browse all study notesNginx Study Notes
DevOps · 30 topics
DevOpsAnsible Study Notes
DevOps · 30 topics
DevOpsAdvanced Kubernetes Study Notes
Kubernetes · 30 topics
DevOpsAdvanced Bash Scripting Study Notes
Bash · 30 topics
DevOpsApache Kafka Study Notes
Kafka · 30 topics
DevOpsDocker & Kubernetes Study Notes
YAML · 40 topics