The Linux find command: find files and act on them safely

Everything in this lab happens inside ~/lab25 as student, except step 9, which only looks at /var/log and changes nothing. The block in step 1 creates a fixed set of files with known ages and sizes, so the outputs below match yours, apart from dates and the order of unsorted lines. The big files are made with truncate, which sets the size without writing data, so they take almost no real disk space.

1Build the practice tree

Paste this whole block on rocky01:

mkdir -p ~/lab25/logs/nginx ~/lab25/exports ~/lab25/tmp/cache ~/lab25/scripts && cd ~/lab25
seq 1 5000 > logs/app.log
seq 1 3000 > logs/nginx/access.log
for f in app.log.2.gz app.log.3.gz app.log.4.gz "old report.gz" APP-ARCHIVE.GZ nginx/access.log.5.gz; do seq 1 2000 | gzip > "logs/$f"; done
seq 1 4000 > logs/app.log.1
touch -d "2 days ago" logs/app.log.1
touch -d "10 days ago" logs/app.log.2.gz
touch -d "35 days ago" logs/app.log.3.gz
touch -d "40 days ago" logs/app.log.4.gz
touch -d "45 days ago" "logs/old report.gz"
touch -d "60 days ago" logs/APP-ARCHIVE.GZ
touch -d "32 days ago" logs/nginx/access.log.5.gz
truncate -s 12M exports/orders-2026-09.csv && touch -d "50 days ago" exports/orders-2026-09.csv
truncate -s 3M exports/orders-2026-10.csv && touch -d "1 day ago" exports/orders-2026-10.csv
truncate -s 150M exports/db-dump.sql && touch -d "3 days ago" exports/db-dump.sql
truncate -s 600K tmp/session.dat
touch tmp/empty.txt
printf '#!/bin/bash\necho cleanup\n' > scripts/cleanup.sh && chmod 777 scripts/cleanup.sh
printf '#!/bin/bash\necho deploy\n' > scripts/deploy.sh && chmod 755 scripts/deploy.sh
sudo touch logs/audit.log
find . -type f | sort

You should see this:

./exports/db-dump.sql
./exports/orders-2026-09.csv
./exports/orders-2026-10.csv
./logs/APP-ARCHIVE.GZ
./logs/app.log
./logs/app.log.1
./logs/app.log.2.gz
./logs/app.log.3.gz
./logs/app.log.4.gz
./logs/audit.log
./logs/nginx/access.log
./logs/nginx/access.log.5.gz
./logs/old report.gz
./scripts/cleanup.sh
./scripts/deploy.sh
./tmp/empty.txt
./tmp/session.dat

touch -d "35 days ago" sets a file’s modification time to the past, which is how you test age rules without waiting a month. The one sudo touch creates an empty file owned by root for the owner tests. Sorting the output makes it easy to compare, because find itself lists entries in whatever order the file system keeps them.

✅ Checkpoint: find lists 17 files, including “old report.gz” with a space in its name.

2Find by name and type

Run this:

find . -name '*.gz' | sort
find . -iname '*.gz' | sort

You should see this:

./logs/app.log.2.gz
./logs/app.log.3.gz
./logs/app.log.4.gz
./logs/nginx/access.log.5.gz
./logs/old report.gz
./logs/APP-ARCHIVE.GZ
./logs/app.log.2.gz
./logs/app.log.3.gz
./logs/app.log.4.gz
./logs/nginx/access.log.5.gz
./logs/old report.gz

-name is case-sensitive, so APP-ARCHIVE.GZ only shows up with -iname. Both match the file name, not the path; to match a path use -path '*/nginx/*'. The pattern is in single quotes so that find, not the shell, sees the star.

find . -type d | sort
find . -empty | sort

You should see this:

.
./exports
./logs
./logs/nginx
./scripts
./tmp
./tmp/cache
./logs/audit.log
./tmp/cache
./tmp/empty.txt

-type d lists folders, and the starting point “.” counts as one. -empty catches empty files and empty folders together; add -type f if you only want files.

✅ Checkpoint: -iname finds six .gz files and -name finds five.

3Limit how deep find goes

Run this:

find logs -maxdepth 1 -type f -name '*.gz' | sort
find . -mindepth 2 -maxdepth 2 -type d | sort

You should see this:

logs/app.log.2.gz
logs/app.log.3.gz
logs/app.log.4.gz
logs/old report.gz
./logs/nginx
./tmp/cache

With -maxdepth 1 find stays in logs itself and skips the nginx folder, so access.log.5.gz is missing. -mindepth 2 -maxdepth 2 gives only folders two levels down, no more and no less. Put these options right after the starting path; GNU find prints a warning if they come after a test.

✅ Checkpoint: The nginx log is missing from the first list, and the second shows nginx and cache.

4Find by age

Run this:

find logs -type f -mtime +30 | sort
find . -type f -mtime -7 | sort

You should see this:

logs/APP-ARCHIVE.GZ
logs/app.log.3.gz
logs/app.log.4.gz
logs/nginx/access.log.5.gz
logs/old report.gz
./exports/db-dump.sql
./exports/orders-2026-10.csv
./logs/app.log
./logs/app.log.1
./logs/audit.log
./logs/nginx/access.log
./scripts/cleanup.sh
./scripts/deploy.sh
./tmp/empty.txt
./tmp/session.dat

-mtime +30 found the five files that are 32 to 60 days old, both cases of .gz. -mtime -7 is the opposite, everything changed in the last seven days. Two more ways to say “newer than”:

find logs -type f -newer logs/app.log.2.gz | sort
find . -type f -newermt '20 days ago' ! -newermt '5 days ago'

You should see this:

logs/app.log
logs/app.log.1
logs/audit.log
logs/nginx/access.log
./logs/app.log.2.gz

-newer FILE compares with another file’s time, which is handy with a marker file your script touches at the start of a job. -newermt takes a date string such as “2026-10-01” or “20 days ago”, and ! (NOT) turns the second test round, so together they give a window: older than 5 days but newer than 20. -mmin -60 does the same in minutes.

✅ Checkpoint: The first list has five old logs and the last command finds only app.log.2.gz.

5Find the big files

Run this:

find . -type f -size +100M
find . -type f -size +1M -exec ls -lh {} + | sort -k5 -rh

You should see something like this:

./exports/db-dump.sql
-rw-r--r--. 1 student student 150M Oct 24 11:02 ./exports/db-dump.sql
-rw-r--r--. 1 student student  12M Sep  7 11:02 ./exports/orders-2026-09.csv
-rw-r--r--. 1 student student 3.0M Oct 26 11:02 ./exports/orders-2026-10.csv

-size +100M means bigger than 100 MiB. The second line is the big-files report from the runbook: find hands every match to one ls -lh, and sort -k5 -rh sorts on the size column with human units (150M above 12M above 3.0M), largest first. On a real server you’d run it as sudo find /var -xdev -type f -size +100M ... when a disk fills up.

Try it yourself: build the biggest-files command in the Command Builder.

✅ Checkpoint: db-dump.sql is at the top of the sorted list at 150M.

6Find by owner and permissions

Run this:

find . -user root
find . -type f ! -user student
find . -type f -perm -o+w
find scripts -type f -perm 755
find . -type f -perm /111 | sort

You should see this:

./logs/audit.log
./logs/audit.log
./scripts/cleanup.sh
scripts/deploy.sh
./scripts/cleanup.sh
./scripts/deploy.sh

The root-owned audit.log shows up both ways. -perm -o+w (with a minus) means “at least the other-write bit”, which is how you hunt world-writable files, here cleanup.sh with mode 777. -perm 755 (no prefix) means 755 and nothing else. -perm /111 (slash) means “any execute bit at all”, so both scripts match. On a server, sudo find / -xdev -type f -perm -o+w is a standard security check (Lesson 55).

✅ Checkpoint: cleanup.sh is the only world-writable file, and both scripts have an execute bit.

7Print, exec and xargs

Show date, size and path for the old .gz files:

find logs -type f -name '*.gz' -mtime +30 -printf '%TY-%Tm-%Td  %6s  %p\n' | sort

You should see something like this:

2026-09-12    4218  logs/old report.gz
2026-09-17    4218  logs/app.log.4.gz
2026-09-22    4218  logs/app.log.3.gz
2026-09-25    4218  logs/nginx/access.log.5.gz

-printf prints what you ask for: %TY-%Tm-%Td is the modification date, %s the size in bytes and %p the path. Sorting by date puts the oldest first. Now see how the two -exec forms call a command, using echo so nothing is removed:

find logs -type f -name '*.gz' -mtime +30 -exec echo rm {} \;
find logs -type f -name '*.gz' -mtime +30 -exec echo rm {} +

You should see something like this (the order may differ):

rm logs/app.log.4.gz
rm logs/old report.gz
rm logs/nginx/access.log.5.gz
rm logs/app.log.3.gz
rm logs/app.log.4.gz logs/old report.gz logs/nginx/access.log.5.gz logs/app.log.3.gz

With \; find started echo four times, once per file. With + it started echo once with all four paths. With 5,000 files the first form starts 5,000 processes and takes seconds; the second starts one or two and finishes almost at once.

The backslash in \; stops the shell from treating the semicolon as the end of the command. The pipe version needs -print0 and xargs -0 so that “old report.gz” stays one name:

find logs -type f -name '*.gz' -mtime +30 -print0 | xargs -0 ls -1

You should see this:

logs/app.log.3.gz
logs/app.log.4.gz
logs/nginx/access.log.5.gz
logs/old report.gz

✅ Checkpoint: echo ran four times with \; and once with +, and ls listed “old report.gz” as one file.

8Dry run, then delete

First the dry run: the list, the count and the space it will free.

find logs -type f -name '*.gz' -mtime +30 -print
find logs -type f -name '*.gz' -mtime +30 -print | wc -l
find logs -type f -name '*.gz' -mtime +30 -exec du -ch {} + | tail -n 1

You should see something like this:

logs/app.log.4.gz
logs/old report.gz
logs/nginx/access.log.5.gz
logs/app.log.3.gz
4
32K	total

Four files, 32K on disk. APP-ARCHIVE.GZ is 60 days old but isn’t in the list, because -name is case-sensitive. That’s the kind of thing you only notice in a dry run, and here it’s what you want: you decide whether that file belongs in the cleanup or not.

Now press the up arrow to get the first command back and change only the last word:

find logs -type f -name '*.gz' -mtime +30 -delete
find logs -type f -name '*.gz' -mtime +30 -print | wc -l
find logs -type f -iname '*.gz' | sort

You should see this:

0
logs/APP-ARCHIVE.GZ
logs/app.log.2.gz

-delete prints nothing when it works. The second dry run counts zero, and the last line shows the two .gz files the rule was meant to keep: the 10-day-old one and the upper-case archive. If you need rm’s options, -exec rm -f {} + in the same last position does the same job.

Try it yourself: build the “find and delete old files” command, dry run first, in the Command Builder.

✅ Checkpoint: The repeat dry run prints 0 and only app.log.2.gz and APP-ARCHIVE.GZ are left.

9Dry run on the real /var/log

On ubu01, run the runbook dry run (read-only):

sudo find /var/log -xdev -type f -name '*.gz' -print
sudo find /var/log -xdev -type f -name '*.gz' -print | wc -l

You should see something like this:

/var/log/syslog.2.gz
/var/log/auth.log.2.gz
/var/log/kern.log.2.gz
/var/log/apt/history.log.1.gz
4

On rocky01, look at the rotated files instead:

sudo find /var/log -xdev -type f \( -name '*-2026*' -o -name '*.[0-9]' \) -print

You should see something like this:

/var/log/messages-20261025
/var/log/secure-20261025
/var/log/cron-20261025
/var/log/dnf.librepo.log.1

On a lab VM a few days old, adding -mtime +30 prints nothing, and that’s a correct dry-run result. On Ubuntu the old logs are .gz files; on Rocky, logrotate adds a date and leaves them uncompressed, so a “*.gz” rule finds nothing there. Read the dry run before you trust a rule written for the other distro. \( ... -o ... \) groups two tests with OR; the brackets are escaped so the shell passes them to find.

Don’t delete anything here; logrotate already looks after these files (Lesson 29).

✅ Checkpoint: You can say whether -name '*.gz' would clean anything on each VM, without deleting a single file.