Find Command Builder

What this tool does

It writes a GNU find command for you. You choose the starting path and the filters — type, name, path, size, times, owner, group, permissions, depth — and it produces the command plus an explanation of every part it added. Nothing is executed: the output is text you copy.

-name and -path are not the same thing

-name matches the file name only. -path matches the whole path, which is what you want when the interesting part is a directory in the middle:

find /srv -name '*.log'      # any file ending in .log, anywhere
find /srv -path '*/cache/*'  # anything whose path goes through a cache directory

A frequent mistake is trying to put a slash inside -name: -name 'src/*.js' never matches, because -name only ever sees the file name. Use -path for that.

-mtime and -atime are in days

-mtime -7 means “modified less than 7 days ago”. The sign is the part people get wrong:

-atime is useful for finding cold data, but be aware that many systems mount filesystems with relatime, which does not update access times on every read. Treat it as a hint, not a fact.

-size units

-size +100M is more than 100 mebibytes. The units are c (bytes), k, M and G — and they are binary, so M is 1,048,576 bytes, not 1,000,000. That is why du and this tool can disagree slightly with a file manager that shows decimal megabytes.

Running a command on each result: -exec

-exec runs a program once per match. The {} is replaced by the path and the escaped \; closes the command:

find /data -name '*.gz' -exec gzip -d {} \;

For many files it is usually faster to let find batch them, but -exec is the portable answer and the one that is easy to read.

-print0 and why paths with spaces break scripts

By default find separates results with a newline, so a path containing a newline or a space is ambiguous when another program reads the output. -print0 separates results with a NUL byte, and commands that accept it (xargs -0, while read -d '') then handle any path correctly. If you are feeding the output to another command, use -print0.

-delete is not like rm

find … -delete deletes every match immediately: no confirmation, no trash, no undo. Before using it, run exactly the same command with -print and read the list. The builder hides the command until you confirm this, and it is worth taking seriously — a missing -name filter turns a cleanup into a disaster.

Real examples

Clean up logs older than a month:

find /var/log -type f -name '*.gz' -mtime +30 -print

Find large files that are eating the disk:

find / -xdev -type f -size +500M -print

Find world-writable files, a classic security check:

find /var/www -type f -perm -002 -print

To copy the results somewhere else, the rsync command builder pairs naturally with this one.