find, locate, and xargs — bulk operations on files · Linux

The combination of find and xargs is how you apply a command to many files. The hazard is filenames with spaces, newlines, or quotes — a class of bug that has deleted production data when uncarefully composed.

find — predicate-based file selection

A find command is a series of predicates evaluated left to right. The most-used predicates:

Predicate	Effect
`-name '*.log'`	Match by glob (case-sensitive)
`-iname '*.log'`	Case-insensitive name match
`-type f`	Regular file
`-type d`	Directory
`-type l`	Symbolic link
`-size +100M`	Larger than 100 MiB
`-mtime -7`	Modified in the last 7 days
`-mtime +30`	Modified more than 30 days ago
`-user alice`	Owned by user alice
`-group admins`	Owned by group admins
`-perm -u+w`	Writable by owner
`-perm 0644`	Exactly mode 0644
`-newer reference`	Modified after `reference`
`! -name '*.gz'`	Negate a predicate

Predicates can be combined implicitly (AND) or with explicit -or and grouped with parens.

Read-only / Safefind old compressed logs— Find compressed log files older than 30 days. This is the predicate set behind most log-rotation cleanup tasks.

$ find /var/log -type f -name '*.gz' -mtime +30 | head

/var/log/nginx/access.log.10.gz
/var/log/nginx/access.log.11.gz
/var/log/nginx/error.log.5.gz
...

Illustrative output

Acting on matches

find can run a command on each match with -exec or pass them to xargs:

Destructivedelete old logs— -delete is destructive. Verify the predicate set first by running without -delete. Always pipe to head or count results to confirm scope.

$ find /var/log -type f -name '*.gz' -mtime +30 -delete

Illustrative output

Read-only / Safefind -exec— -exec cmd {} + batches the matches and runs cmd once per batch (more efficient than {} \\;). {} is replaced with the file list. Always use + unless you specifically need per-file semantics.

$ find /var/log -type f -name '*.gz' -mtime +30 -exec ls -lh {} +

-rw-r--r-- 1 root root 12M Aug  1 06:25 /var/log/nginx/access.log.10.gz
-rw-r--r-- 1 root root 14M Aug  1 06:25 /var/log/nginx/access.log.11.gz

Illustrative output

Always test before -delete

The single most common cause of accidental data loss in production is find … -delete with the wrong predicate. Before running it:

Run find … | head to see what would be deleted.
Run find … | wc -l to see how many files.
Run find … -print to confirm paths.
Only then run find … -delete.

Prefer -delete over find … -exec rm {} +, not the other way round. -delete implies -depth, refuses to remove ., and unlinks relative to an open directory descriptor, so it is not vulnerable to a symlink being swapped in between the moment find matched a path and the moment something removes it. man find says of the other form: “There are unavoidable security problems surrounding use of the -exec action.”

Neither form prints anything. rm without -v is silent, so “I will see it if it goes wrong” is not a safety property either way. If you want output, use -print -delete or -exec rm -v -- {} +.

Predicate order is evaluation order

find evaluates its expression left to right for every entry it visits, and -delete is part of that expression rather than something applied at the end.

# CATASTROPHIC - deletes everything under /var/log
find /var/log -delete -name '*.gz'

For each entry, -delete runs first. It succeeds, returns true, and only then does -name '*.gz' get evaluated — on a file that is already gone. The -name filter never filtered anything.

Actions go last. Always. And dry-run the exact command with the action replaced by -print before you run it for real:

find /var/log -name '*.gz' -mtime +30 -print
find /var/log -name '*.gz' -mtime +30 -delete

The two lines must differ in exactly one word. If you have to move anything else to make the second line work, the first line did not test what you are about to run.

xargs — feeding file lists into commands

xargs reads whitespace-separated tokens from stdin and invokes a command with those tokens as arguments. The classic combination:

Read-only / Safefind piped to xargs— xargs takes the find output and passes it as arguments to ls. By default it runs ls once with as many files as fit in ARG_MAX.

$ find /var/log -type f -name '*.gz' | xargs ls -lh

-rw-r--r-- 1 root root 12M Aug  1 06:25 /var/log/nginx/access.log.10.gz
...

Illustrative output

Read-only / Safenull-delimited find + xargs— -print0 separates records with NUL bytes (which filenames cannot contain). xargs -0 reads that and passes each record as one argument. This is the production-safe pattern.

$ find /var/log -type f -name '*.gz' -print0 | xargs -0 ls -lh

-rw-r--r-- 1 root root 12M Aug  1 06:25 /var/log/nginx/access.log.10.gz
...

Illustrative output

Empty input still runs the command — use xargs -r

GNU xargs invokes the command once with no arguments when stdin is empty. That is harmless for ls. It is not harmless for anything whose no-argument behaviour differs from its with-arguments behaviour:

# find matches nothing, so this becomes: rm -rf
find /srv/cache -name '*.tmp' -mtime +7 -print0 | xargs -0 rm -rf

# find matches nothing, so this becomes: tar -czf backup.tar.gz
#   -> an archive of nothing, overwriting yesterday's
find /data -newer /var/lib/last-backup -print0 | xargs -0 tar -czf backup.tar.gz

xargs -r (--no-run-if-empty) makes xargs exit without running the command at all. Put it on every xargs in a script — the day it matters is the day the find returns nothing unexpectedly, which is exactly the day nobody is watching.

find /srv/cache -name '*.tmp' -mtime +7 -print0 | xargs -0 -r rm -rf

find … -exec cmd {} + does not have this problem: with no matches, it never invokes the command. That is one more reason to prefer -exec … + when the pipeline starts with find.

locate — fast name search

locate is faster than find for simple name searches because it queries a pre-built index (usually /var/lib/mlocate/mlocate.db or /var/lib/plocate/plocate.db). The index is rebuilt periodically by a daily cron job (the mlocate or plocate package).

Read-only / Safelocate— locate queries the file database. It does not see files created since the last index update; for recent files use find instead.

$ locate sshd_config | head

/etc/ssh/sshd_config
/usr/share/openssh/sshd_config.5.gz
/usr/share/man/man5/sshd_config.5.gz

Illustrative output

find, locate, and xargs — bulk operations on files

find — predicate-based file selection

Acting on matches

xargs — feeding file lists into commands

locate — fast name search

WhyThisMatters

Knowledge check