How I build a find command without deleting the wrong files

The find command is one of the most useful Linux commands, but it is also one of the commands I treat with respect. It can search thousands of files very quickly, and with the wrong option it can also delete thousands of files very quickly.

That is why I like building the command slowly with the find Command Builder. The goal is not only to make a valid command. The goal is to make a command I understand before I run it.

The simple idea

find walks through a directory tree and checks every file or folder against rules you give it.

A very simple command looks like this:

find /var/log -name "*.log"

Plain meaning:

Start in /var/log and show anything whose name ends with .log.

The important parts are:

find <where to start> <rules> <what to do>

If you do not tell find what to do, it usually prints the matches.

Step 1: choose the starting directory

Start with the smallest directory that makes sense.

Bad idea:

find / -name "*.log"

Better idea:

find /var/log -name "*.log"

Searching from / means searching almost the whole system. That is slower and can produce noisy permission errors. If I know the files are under /var/log, I start there.

In the find Command Builder, the starting directory is the first thing I decide.

Step 2: filter by file type

If I only want files, I add:

-type f

If I only want directories:

-type d

Example:

find /var/log -type f -name "*.log"

Plain meaning:

Search under /var/log, but only return files, not directories.

This keeps the result cleaner.

Step 3: filter by name

Name filters are common:

-name "*.log"
-name "*.tmp"
-name "backup-*"

Use quotes around patterns. Without quotes, the shell may expand the pattern before find sees it.

Good:

find . -name "*.log"

Risky:

find . -name *.log

If the current directory already contains .log files, the shell may replace *.log with those filenames. Quoting avoids that surprise.

Step 4: filter by age

Age filters help when cleaning old files.

Example:

find /var/log -type f -name "*.log" -mtime +30

Plain meaning:

Find .log files modified more than 30 days ago.

The +30 part means older than 30 days. A minus sign means newer than:

-mtime -7

means modified within the last 7 days.

I always read age filters twice before using them with delete.

Step 5: filter by size

Size filters are useful for finding large files:

find /var/log -type f -size +100M

Plain meaning:

Find files larger than 100 MB.

Common suffixes:

• k for kilobytes;
• M for megabytes;
• G for gigabytes.

Example:

find /home/ubuntu -type f -size +1G

This helps find files that may be filling a disk.

Step 6: preview first

Before deleting or running another command, print the matches first.

Example:

find /tmp -type f -name "*.tmp" -mtime +7 -print

Look at the output. Ask:

• are these really the files I want?
• is the directory correct?
• is the age filter correct?
• are there unexpected matches?

This preview step is the safety belt.

Step 7: delete only after the preview is correct

After the preview is correct, then use delete:

find /tmp -type f -name "*.tmp" -mtime +7 -delete

I prefer -delete only when the command is simple and already previewed.

Do not build a delete command as the first version. Build the print version first, then change the action.

Step 8: use max depth when needed

Sometimes I only want to search one level deep.

find /var/www -maxdepth 1 -type d

Plain meaning:

Look only directly inside /var/www, not deep inside every project.

This is useful when the top-level folders matter but the contents would be too much.

Step 9: be careful with exec

find can run a command for each match:

find . -type f -name "*.log" -exec gzip {} \;

Here, {} means “the matched file”.

This is powerful, but I use it carefully. First I preview the files. Then I run the -exec version only if the list is right.

For commands that can handle many files at once, this form is often better:

find . -type f -name "*.log" -exec gzip {} +

The + version groups files together instead of running the command once per file.

My safe workflow

When I need a find command, I follow this order:

1. choose the smallest starting directory;
2. add -type f or -type d;
3. add name, age, or size filters;
4. print the results;
5. review the output;
6. only then add -delete or -exec.

The find Command Builder is useful because it makes that slow, safe process easier. It helps me build the command one decision at a time instead of typing a dangerous one-liner from memory.

The simple rule is:

Print first. Delete later.