Finding files and text on Linux: find, grep and locate

Knowing a file exists but not remembering where you saved it. Having to find which of two hundred configuration files contains a certain address. Wanting to know which files changed in the last twenty-four hours. These are everyday questions for anyone who works with a computer, and on Linux they have precise answers thanks to three tools: find searches for files by their characteristics, grep searches for text inside files, and locate queries an index for instant answers.

find: searching by characteristics

The structure of find is always the same: where to search, then one or more criteria, and optionally an action.

find /home/anna -name "*.pdf"

finds every PDF in Anna's folder and its subfolders. With -iname the search ignores case, so it also finds Invoice.PDF. The quotes around the pattern matter: without them, the shell might expand *.pdf before find sees it.

The most useful criteria

Criteria can be combined: several in a row act as «and», while -o means «or». For example, files larger than 1 GB modified in the last week:

find / -type f -size +1G -mtime -7 2>/dev/null

The final 2>/dev/null hides the «permission denied» messages for folders the user can't read, which would otherwise swamp the results.

To limit how deep the search goes there is -maxdepth 2, and to exclude a heavy folder, such as a project's dependencies, you use -path ./node_modules -prune -o followed by the rest of the expression.

Acting on the results

find can run a command on what it finds. The safest forms:

find . -name "*.log" -mtime +30 -print
find . -name "*.log" -mtime +30 -delete

The rule I always follow: first run the search with -print and read the list, then swap in -delete. For other commands you use -exec:

find . -name "*.jpg" -exec ls -lh {} +

The braces are replaced by the names found; the trailing + groups many files into a single run, faster than launching the command once per file.

grep: searching text inside files

grep reads files or input and prints the lines containing a pattern:

grep "192.168.1.20" /etc/hosts

The options you need almost every time:

• -r searches recursively through all subfolders;
• -i ignores case;
• -n shows the line number;
• -l lists only the names of files containing the text;
• -v inverts the match, showing lines that do not match;
• -w matches whole words only, so log doesn't find blog;
• -C 3 shows three lines of context before and after each match.

A typical example: finding which configuration file sets a port.

grep -rn "listen 8080" /etc/nginx/

With -E you use extended regular expressions. For instance, to find lines with an email address in a text file:

grep -Eo "[[:alnum:]._%+-]+@[[:alnum:].-]+\.[a-z]{2,}" contacts.txt

The -o option prints only the matched part, not the whole line. grep also works perfectly in a pipe: ps aux | grep nginx or journalctl -b | grep -i error.

ripgrep: when projects are large

For searching source code there is ripgrep, the rg command, available in the repositories of the main distributions. It is recursive by default, very fast, and automatically skips files listed in .gitignore, binary files and hidden folders. rg "functionToFind" inside a project immediately returns files and lines, in colour. For everyday work on code it is handier than grep -r, but grep remains the standard present on every system, minimal servers included.

locate: instant searches by name

find explores the disk every time, and on a large disk that can take a while. locate, by contrast, consults a database of file names that is updated periodically:

locate quote-2025

The answer is immediate. The catch is that the database may be out of date: a file created ten minutes ago might not show up. You update it with sudo updatedb. On many distributions the package is called plocate, a newer and faster implementation.

Which tool to use

• I know the name or part of it and want a quick answer: locate.
• I'm searching by date, size, owner or permissions, or I need to act on the files: find.
• I'm looking for a word or value inside files: grep, or rg in a code project.

In my work, during an analysis, the most useful combination is precisely the two together: find to isolate the files that changed in a given time window, and grep to understand what they contain.

In short

• find searches by name, type, size, date, owner and permissions, and can act on the results.
• Before using -delete, always check the list with -print.
• grep -rn finds text across a whole folder, showing file and line.
• rg is faster and more convenient for code; grep is available everywhere.
• locate answers instantly but depends on an index refreshed with updatedb.