Ubuntu find Command Safe Usage - Avoid Deletion Accidents

Ubuntu find Command Safe Usage - Avoid Deletion Accidents
Reading time: About 10 min Difficulty: Intermediate

What You'll Learn

  • Basic find searches (by name, extension, modification date, size)
  • Safe deletion procedure (list first -> verify count -> delete)
  • Safe practices with xargs (-print0 / xargs -0)

Quick Summary

Follow this order for deletions - it's non-negotiable:

  1. List first (don't delete)
  2. Verify count (stop if more than expected)
  3. Delete safely (use -print0 / xargs -0 when possible)

Prerequisites

  • OS: Ubuntu
  • Shell: bash
  • Permissions: sudo when needed (for system directories)

1. find Basics (Searching)

Conclusion: Use find with -name, -type, and -iname to locate files before filtering.

1-1. Search by Name (Exact Match)

$ find . -name "error.log"

1-2. Search by Extension (e.g., .log)

$ find . -name "*.log"
$ find . -iname "*.log"

1-4. Files Only / Directories Only

$ find . -type f -name "*.log"   # files only
$ find . -type d -name "cache"   # directories only

2. Filtering by Modification Date & Size

Conclusion: Combine -mtime and -size — broad conditions are the main cause of accidents.

2-1. Files Modified Within Last 7 Days

$ find . -type f -mtime -7

2-2. Files Older Than 30 Days

$ find . -type f -mtime +30

2-3. Files Larger Than 100MB

$ find . -type f -size +100M

Useful for finding "heavy files" during disk space investigations.

3. Before Deletion: List & Count First

Conclusion: Always count with wc -l before deleting — more hits than expected means stop.

3-1. List Files (Without Deleting)

Example: Find .log files under /var/log (use sudo if needed)

$ sudo find /var/log -type f -name "*.log"

3-2. Count Files (Stop If Too Many)

$ sudo find /var/log -type f -name "*.log" | wc -l

If the count is higher than expected, your conditions are too broad. Add -mtime or -size to narrow down.

4. Safe Deletion Methods (Beginner Pattern)

Conclusion: Use -print0 | xargs -0 to delete safely — it handles filenames with spaces.

Deletion can cause instant accidents, so it's best to use a fixed procedure.

4-1. First, Narrow Down (e.g., .log older than 30 days)

$ sudo find /var/log -type f -name "*.log" -mtime +30

4-2. Next, Verify Count

$ sudo find /var/log -type f -name "*.log" -mtime +30 | wc -l

4-3. If OK, Delete Safely

Use -print0 and xargs -0 to handle filenames with spaces safely.

$ sudo find /var/log -type f -name "*.log" -mtime +30 -print0 | sudo xargs -0 rm -f
  • -print0: Output null-delimited (safe for spaces/newlines)
  • xargs -0: Accept null-delimited input correctly

Is -delete OK to Use? (Answer: Be Careful)

find ... -delete is simple but can cause instant accidents if conditions are wrong.

# Only use if you understand the risks
$ sudo find /tmp -type f -mtime +7 -delete

For beginners, master the -print0 | xargs -0 rm pattern first.

5. Common Pitfalls (Where Accidents Happen)

Conclusion: Run pwd first to confirm location — this single habit prevents most accidents.

$ pwd
$ ls -la

Example: Older than 30 days AND larger than 10MB

$ sudo find /var/log -type f -name "*.log" -mtime +30 -size +10M

6. Post-Deletion Verification

Conclusion: Run df -h after deletion to confirm disk space was actually recovered.

After deletion, verify disk usage:

$ df -h

Next Reading