Hands-on Lab·Linux Foundation Certified System Administrator

find, locate and the two kinds of link

find is the tool the exam reaches for whenever a task says "all files that...", and its two -exec forms behave differently enough to matter. This guide covers searching by name, type, size, time and permission, the difference between ; and +, locate and why its answer can be wrong, and the two kinds of link - including what happens to each when the original is deleted.

Essential Commands Guide 10 of 38 Intermediate

OSUbuntu 26.04 LTS
LVM2.03.31 (Ubuntu) / 2.03.36 (AlmaLinux)
nftables1.1.6 (Ubuntu) / 1.1.5 (AlmaLinux)
TimeAbout 20 min

GNU findutils. plocate is not installed on Ubuntu 26.04 by default - the capture installs it. -printf and -xtype are GNU extensions and are on both exam images.

Firewallufw 0.36.2 enabled but reporting inactive / firewalld active
Network confignetplan + systemd-networkd / NetworkManager 1.56.0

Everything on this page runs on the one Ubuntu host.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
LFCS-A01	192.168.0.70	Ubuntu 26.04 LTS	Primary host - most guides run only here	2 Core	4 GB	50 GB

This guide includes

Use this because find is what the exam reaches for whenever a task says "all files that...". This matters because -exec ; and -exec + run the same command completely differently - once per file, or once for all of them.

searching by name, type, size, time and permission
seeing the difference between -exec ; and -exec +
using -print0 for filenames you did not choose
using locate, which reads an index instead of the disk
comparing the two kinds of link, what happens when the original goes, and what a hard link cannot do

Before you start

guide 5 - inodes and the file types.
guide 7 - xargs, which pairs with -print0.

find, by name and by type
A small tree, searched four ways.
bash Example session
```
$cd ~/ess/f && find . -name '*.log' | sort./app/logs/big.log./app/logs/old.log./app/logs/small.log$cd ~/ess/f && find . -type d | sort; echo "---"; find . -type f | wc -l; echo "---"; find . -iname '*.LOG' | wc -l../app./app/conf./app/logs./tmp---5---3$cd ~/ess/f && find . -maxdepth 2 -type f | sort; echo "--- maxdepth stops it walking the whole tree"./tmp/scratch--- maxdepth stops it walking the whole tree$cd ~/ess/f && find . -name '*.log' -not -name 'old*' | sort; echo "---"; find . $ -name '*.conf' -o -name '*.log' $ -type f | wc -l./app/logs/big.log./app/logs/small.log---4
```
Note
Quote the pattern. find . -name *.log lets the *shell* expand *.log first, so find receives a filename and searches for that. '*.log' gets the pattern through intact - and on this host's zsh, an unquoted pattern that matches nothing kills the command outright.

-maxdepth 2 found only one file because the logs are at depth 3. Depth counts from the starting point, and -maxdepth 1 means "this directory only" - which is how you avoid walking a huge tree.

-not (or !) negates and -o is or, with  for grouping. The default between two tests is *and*.

-iname is the case-insensitive form, which matters on a filesystem that is not.

Expected resultThree .log files; five directories; -maxdepth 2 finding only ./tmp/scratch; and -not excluding old.log.

Success conditionYou can find files by name and shape.
By size, by time, by permission
The three tests that answer real questions - and one that finds nothing.
bash Example session
```
$cd ~/ess/f && find . -type f -size +1k | sort; echo "--- and the sizes for comparison:"; find . -type f -printf '%6s %p\n' | sort -rn--- and the sizes for comparison:   292 ./app/logs/big.log     2 ./app/logs/small.log     2 ./app/conf/app.conf     0 ./tmp/scratch     0 ./app/logs/old.log$cd ~/ess/f && find . -mtime +5 -type f; echo "--- older than 5 days"; find . -mtime -1 -type f | wc -l; echo "--- modified in the last day"./app/logs/old.log--- older than 5 days4--- modified in the last day$cd ~/ess/f && find . -type f -perm 600; echo "--- exactly 600"; find . -type f -perm -u=w | wc -l; echo "--- has at least user-write"./app/conf/app.conf--- exactly 6005--- has at least user-write$cd ~/ess/f && find . -newer app/logs/small.log -type f | sort; echo "--- newer than a reference file"./tmp/scratch--- newer than a reference file
```
Note
The empty -size +1k result is the lesson. +1k means "more than 1 kibibyte", and 292 bytes is not - so a task that says "find large files" needs a threshold you have actually checked. -printf '%s' gives you the real sizes to calibrate against.

-size with no suffix means 512-byte blocks, rounded up - so -size 1 matches anything from 1 to 512 bytes. Always use a suffix: c bytes, k, M, G.

-mtime +5 is "more than 5 days", -5 is "less than", and plain 5 is "exactly the 5th day" - which is almost never what you want and is a favourite exam trap. -mmin for minutes.

-perm 600 is exact; -perm -u=w is "at least"; -perm /u=w is "any of". The leading - and / change the question completely.

Expected result-size +1k matching nothing (the biggest file is 292 bytes); -mtime +5 finding the 10-day-old file; -perm 600 finding the config.

Success conditionYou can find files by their metadata.
-exec, and the difference between ; and +
The same search, running the same command two ways.
bash Example session
```
$cd ~/ess/f && find . -name '*.log' -exec wc -l {} \; | sort -rn100 ./app/logs/big.log1 ./app/logs/small.log0 ./app/logs/old.log$cd ~/ess/f && find . -name '*.log' -exec wc -l {} + ; echo "--- with + it runs ONCE with all the arguments, so wc prints a total"  0 ./app/logs/old.log100 ./app/logs/big.log  1 ./app/logs/small.log101 total--- with + it runs ONCE with all the arguments, so wc prints a total
```
Note
\; runs the command once per file; + batches as many as fit. The total line is the proof - wc only prints one when it is given more than one file, so its presence tells you the command ran once.

+ is faster and usually what you want. Three files is nothing; ten thousand files is ten thousand process spawns against a handful.

Use \; when the command takes exactly one argument, or when {} is not the last thing on the line - + requires {} immediately before it.

The \; is escaped because a bare ; ends the shell command. ';' works too.

-delete needs no -exec at all, and -ok prompts per file.

Expected resultWith \;: three separate wc runs and no total. With +: one run and a 101 total line.

Success conditionYou can choose the right -exec form.
-print0, for the filenames you did not choose
Handing find's results to another command safely.
bash Example session
```
$cd ~/ess/f && find . -name 'scratch' -delete && find . -name 'scratch' | wc -l; echo "--- -delete needs no -exec rm"0--- -delete needs no -exec rm$cd ~/ess/f && find . -type f -name '*.log' -printf '%p %TY-%Tm-%Td %s\n' | sort./app/logs/big.log 2026-08-29 292./app/logs/old.log 2026-08-19 0./app/logs/small.log 2026-08-29 2
```
Note
-print0 separates with a NUL byte, which is the only character that cannot appear in a filename - so find -print0 | xargs -0 is the safe pairing and find | xargs is not. guide 7 shows it failing.

-printf is a small formatting language: %p path, %s size, %TY-%Tm-%Td a date, %u owner, %M the mode string. It replaces piping into stat and is much faster on a big tree.

-delete implies -depth so it empties directories before removing them - and it does not ask. Run the same find with -print first, every time.

Expected result-delete removing the file with no -exec; and -printf producing path, date and size in one line each.

Success conditionYou can pass results to another tool without breaking on spaces.
locate, which reads an index instead of the disk
Not installed by default. Then indexed, then queried - and then caught out.
bash Example session
```
$command -v locate plocate mlocate updatedb 2>/dev/null; echo "--- (nothing above means not installed)"/usr/bin/locate/usr/bin/plocate/usr/bin/updatedb--- (nothing above means not installed)$sudo apt-get install -y -qq plocate 2>&1 | tail -1; command -v locate updatedb/usr/bin/locate/usr/bin/updatedb$sudo updatedb && locate -n 3 nginx.conf 2>&1 | head -4; echo "---"; locate -c '*.service' 2>&1 | tail -1---532$cd ~/ess/f && touch brand-new-file.txt && locate brand-new-file.txt 2>&1 | head -2; echo "--- not in the index yet, because the index is a snapshot"; sudo updatedb && locate brand-new-file.txt | head -1--- not in the index yet, because the index is a snapshot/home/sysadmin/ess/f/brand-new-file.txt
```
Note
locate is fast because it does not look at the disk - it queries a database built by updatedb, usually from a daily timer. So it answers in milliseconds where find / takes minutes.

And its answer is as old as the index. The capture creates a file, fails to find it, runs updatedb, and then finds it. A file created since the last run is invisible; a file deleted since the last run is still listed.

nginx.conf returned nothing because nginx is not installed here - locate found no such file because there is none, which is the correct answer and a good reminder to sanity-check your search term.

So: find when it must be current, locate when you are hunting for something you know exists. plocate is the current implementation; mlocate and slocate are what older material calls it.

Expected resultNothing installed at first; then locate -c '*.service' counting 554; and a brand-new file not found until updatedb runs again.

Success conditionYou know when to trust locate and when not to.
The two kinds of link
A hard link and a symlink to the same file, side by side.
bash Example session
```
$cd ~/ess/f && printf 'original\n' > target.txt && ln target.txt hard.txt && ln -s target.txt soft.txt && ls -li target.txt hard.txt soft.txt789207 -rw-rw-r-- 2 sysadmin sysadmin  9 Aug 29 09:41 hard.txt789208 lrwxrwxrwx 1 sysadmin sysadmin 10 Aug 29 09:41 soft.txt -> target.txt789207 -rw-rw-r-- 2 sysadmin sysadmin  9 Aug 29 09:41 target.txt$cd ~/ess/f && stat -c '%h links, inode %i, %F, %n' target.txt hard.txt soft.txt2 links, inode 789207, regular file, target.txt2 links, inode 789207, regular file, hard.txt1 links, inode 789208, symbolic link, soft.txt
```
Note
A hard link is another name for the same inode. There is no original and no copy - the two names are equal, the link count is 2, and the data exists once. ls -li showing the same inode number is the definitive test.

A symlink is a small file containing a path. Its own inode, its own permissions (always 777, and ignored), and a size equal to the length of the string it holds.

The link count in ls -l is that number, which is why a directory with two subdirectories has a link count of 4: itself, its ., and each child's ...

Expected resulttarget.txt and hard.txt sharing inode 403889 with a link count of 2; soft.txt on its own inode, 1 link, and 10 bytes - the length of the target's name.

Success conditionYou can tell the two apart from ls -li.
And what happens when the original goes
Delete target.txt and ask both links for the data.
bash Example session
```
$cd ~/ess/f && rm target.txt && echo "--- target removed:"; cat hard.txt; echo "--- the hard link still has the data"; cat soft.txt 2>&1 | tail -1; echo "--- the symlink is now dangling"--- target removed:original--- the hard link still has the datacat: soft.txt: No such file or directory--- the symlink is now dangling$cd ~/ess/f && ls -l soft.txt; find . -xtype l; echo "--- find -xtype l lists broken symlinks"lrwxrwxrwx 1 sysadmin sysadmin 10 Aug 29 09:41 soft.txt -> target.txt./soft.txt--- find -xtype l lists broken symlinks$cd ~/ess/f && ln -s /etc/hostname abs.txt && readlink abs.txt; readlink -f abs.txt; echo "--- readlink -f resolves the whole chain"/etc/hostname/etc/hostname--- readlink -f resolves the whole chain
```
Note
The data survived because a hard link is not a reference to a name. rm decrements the link count; the file is only freed when it reaches zero *and* no process holds it open. That last clause is why deleting a big log file does not free space while the writer is still running.

The symlink is now dangling and still looks perfectly healthy in ls -l - it points at a name, and that name no longer resolves. find -xtype l is how you list them across a tree.

readlink shows the target, readlink -f resolves the whole chain and is what you want when a symlink points at another symlink.

A trailing slash follows the link: ls -ld dirlink describes the link and ls -ld dirlink/ describes the directory. One character, two different questions.

Expected resultcat hard.txt printing original; cat soft.txt giving No such file or directory; and find -xtype l listing ./soft.txt.

Success conditionYou can find and reason about broken links.
And what a hard link cannot do
Two limits, both of which the symlink does not have.
bash Example session
```
$cd ~/ess/f && ln app/logs/big.log hardsame 2>&1 | tail -1 && echo "same filesystem: fine"; ln /etc/hostname /tmp/../home/sysadmin/ess/f/hardcross 2>&1 | tail -1; ln -s /etc/hostname softcross && echo "and a symlink crosses anything"same filesystem: fineln: failed to create hard link '/etc/hostname' => '/tmp/../home/sysadmin/ess/f/hardcross': Permission deniedand a symlink crosses anything$cd ~/ess/f && ln app 2>&1 | tail -1; ln -s app dirsoft && ls -ld dirsoft; echo "--- you cannot hard-link a directory, but you can symlink one"ln: app: hard link not allowed for directorylrwxrwxrwx 1 sysadmin sysadmin 3 Aug 29 09:41 dirsoft -> app--- you cannot hard-link a directory, but you can symlink one
```
Note
A hard link cannot cross a filesystem, because an inode number only means something within one. That is why ln /etc/hostname ~/x fails when / and /home are separate mounts, and it is a favourite exam question.

And it cannot point at a directory - only root can, on filesystems that allow it at all, because a cycle in the directory tree would break every tool that walks it.

A symlink has neither limit. It holds a path, so it can point across filesystems, at directories, and at things that do not exist yet - which is both its usefulness and the reason it can dangle.

So: hard links for the same file under two names on one filesystem; symlinks for everything else. That is the end of Domain 1 - guide 11 starts Operations Deployment.

Expected resultA hard link within the filesystem working; a hard link to a directory refused; and a symlink doing both.

Success conditionYou know which kind of link to reach for.

Troubleshooting

find . -name *.log searches for the wrong thing.

Why: The shell expanded the pattern before find saw it.

Fix:Quote it: -name '*.log'.
find -size +1M finds nothing you expected.

Why: The threshold is wrong, or the suffix was omitted and it is counting 512-byte blocks.

Fix:Always give a suffix - c, k, M, G. Check real sizes with -printf '%s %p\n'.
-mtime 5 misses the files you wanted.

Why: Plain 5 means exactly the 5th day, not "within 5 days".

Fix:-mtime -5 for newer than, +5 for older than.
-exec is very slow on a large tree.

Why: \; spawns one process per file.

Fix:-exec cmd {} +, with {} immediately before the +.
A pipeline from find breaks on some filenames.

Why: Whitespace or newlines in names.

Fix:-print0 | xargs -0, or -exec ... +.
locate cannot find a file that exists.

Why: The index predates the file.

Fix:sudo updatedb, or use find when currency matters.
ln: failed to create hard link: Invalid cross-device link.

Why: Source and destination are on different filesystems.

Fix:ln -s for a symlink, or copy it.
Deleting a large log did not free any disk space.

Why: A process still holds the file open, so the inode is not released.

Fix:lsof | grep deleted to find the holder, then restart it or truncate with : > file instead.

Official sources

← All LFCS guides

find, locate and the two kinds of link

This guide includes

Before you start

find, by name and by type

By size, by time, by permission

-exec, and the difference between ; and +

-print0, for the filenames you did not choose

locate, which reads an index instead of the disk

The two kinds of link

And what happens when the original goes

And what a hard link cannot do

Troubleshooting

Official sources