Whether you are managing cloud servers, debugging local applications, or building open-source projects, searching is the most essential skill in your terminal toolkit. Linux stores everything as a file, process, or network socket. If you know the right tools, you can search across millions of files, system logs, processes, and active ports in seconds.
Here is a practical, step-by-step guide to searching anything in Linux.
1. Finding Files and Directories by Name, Size, and Date
When you know a file exists but forgot where it lives, file search tools are your first line of defense.
The Classic find Tool
The find utility is built into every Linux distribution. It searches live directory trees based on real-time filesystem checks.
Search for a file by exact name in the current directory:
find . -name "config.yaml"
Search case-insensitively for any file ending in .log:
find /var/log -iname "*.log"
Filter specifically for files or directories only:
find /srv/app -type f -name "*.json"
find /srv/app -type d -name "cache"
Searching by File Size
When disk space runs out, finding large files fast is vital. Use the -size flag to isolate files over a certain threshold:
find /var -type f -size +100M
This command scans /var for regular files larger than 100 megabytes. You can use k for kilobytes, M for megabytes, and G for gigabytes.
Searching by Modification Time
If an incident started twenty minutes ago, look for files created or modified within that window:
find /etc -mmin -30
To search for files modified more than 7 days ago:
find /tmp -mtime +7
Executing Actions on Found Files
Instead of passing file lists manually, find lets you execute actions directly:
find /tmp -type f -name "*.tmp" -delete
Or pass results to another command safely using -exec:
find /var/log -type f -name "*.old" -exec rm -f {} \;
Fast Modern Alternative: fd
While find is universal, its syntax can be verbose. A fast, modern replacement written in Rust is fd.
Install fd on Ubuntu or Debian:
sudo apt update && sudo apt install fd-find
fd simplifies syntax, runs multi-threaded searches, colors output, and ignores hidden files and .gitignore rules by default.
Search for any file containing "nginx" in its name:
fd nginx
Search for a specific extension in a target directory:
fd -e md -e txt . /home/user/docs
Include hidden files and gitignored paths when needed:
fd -H -I "secret"
2. Instant Filesystem-Wide Search with locate and plocate
Running find across the entire root directory / can take time because it hits the disk for every directory traversal. When you need instant results across the whole system, use locate.
How locate Works
locate does not scan your hard drive live. Instead, it reads a pre-built database index file (/var/lib/mlocate/mlocate.db or /var/lib/plocate/plocate.db).
Search for any file or path containing "ssl":
locate nginx.conf
The output returns instantly, even on systems with millions of files.
Updating the Search Database
Because locate reads a database, newly created files won't show up right away. Update the index manually before searching:
sudo updatedb
On modern distributions like Ubuntu 22.04+, plocate has replaced traditional mlocate. plocate uses io_uring and index posting lists, making searches up to 10 times faster while using a much smaller database.
3. Searching Text Inside Files with grep and ripgrep
Finding a file by name is useful, but often you need to search for text inside code, configuration files, or logs.
The Classic grep Command
grep (Global Regular Expression Print) searches text patterns line by line.
Basic search for a string in a file:
grep "DATABASE_URL" /srv/app/.env
Search recursively inside a directory and display line numbers:
grep -rn "error_log" /etc/nginx/
Key flags to remember:
- -r or -R: Search directories recursively.
- -n: Show line numbers.
- -i: Case-insensitive search.
- -w: Match whole words only.
- -c: Count total matching lines instead of printing them.
Exclude noisy directories like node_modules or .git:
grep -rn --exclude-dir={node_modules,.git,dist} "PORT" ./
Show context lines before and after matches:
grep -C 3 "FATAL" /var/log/syslog
The -C 3 flag shows 3 lines above and 3 lines below each match, giving you immediate context around errors.
Lightning Fast Search: ripgrep (rg)
When searching large source code repositories or massive log folders, standard grep can be slow. ripgrep (command name rg) is the fastest line-oriented search tool available.
Install ripgrep:
sudo apt install ripgrep
Search for a pattern in the current directory:
rg "connectTimeout"
Why ripgrep is superior for developers and sysadmins:
- It respects your
.gitignoreand.ignorefiles automatically. - It skips binary files and hidden files by default.
- It uses multi-threading and SIMD CPU instructions to scan gigabytes per second.
Search inside compressed .gz log files without extracting them first:
rg -z "500 Internal Server Error" /var/log/nginx/access.log*.gz
Real Production Scenario
When I was building AiroShare, a local DLNA media server, I had to search across thousands of lines of JavaScript and Node.js files to find every location where a custom SSDP multicast listener was registered. Running rg "ssdp:discover" instantly gave me every file, function, and line number in under 10 milliseconds without dragging in unwanted build artifacts.
4. Searching System Logs and Kernel Events
When an application crashes, an IP gets blocked, or a service fails on boot, your answers live inside system logs.
Searching systemd Logs with journalctl
Modern Linux distributions use systemd to manage services and record binary logs. The journalctl command lets you search these logs with precision.
View logs for a specific service unit:
sudo journalctl -u nginx.service
Filter log output by priority (errors, warnings, or critical events):
sudo journalctl -u app.service -p err
Priority levels include emerg, alert, crit, err, warning, notice, info, and debug.
Search logs within a specific time window:
sudo journalctl --since "2026-08-14 14:00:00" --until "2026-08-14 15:30:00"
Or view entries from the last two hours:
sudo journalctl --since "2 hours ago"
Search log messages matching a specific keyword:
sudo journalctl -g "out of memory"
Follow live log output as new entries arrive:
sudo journalctl -f -u docker.service
Searching Kernel Messages with dmesg
If a hardware device disconnects, a network interface drops, or the Out-Of-Memory (OOM) killer kills a process, check the kernel ring buffer using dmesg.
Search for kernel OOM events:
sudo dmesg -T | grep -i "oom"
The -T flag converts raw kernel timestamps into human-readable date and time formats.
Searching Rotated Log Files
Older log files in /var/log are often compressed into .gz format by logrotate. Standard text tools cannot read them directly. Use zgrep or zless instead:
zgrep -i "failed password" /var/log/auth.log*.gz
5. Searching Command History Like a Master
How many times have you typed a complex 80-character docker or kubectl command, only to forget it three days later? Stop hitting the Up arrow key fifty times.
Built-in Reverse Search: Ctrl+R
Press Ctrl+R in your terminal and start typing any fragment of the past command:
(reverse-i-search)`ssh`: ssh -i ~/.ssh/prod_key.pem admin@10.0.4.15
Press Ctrl+R repeatedly to cycle backward through matching historical commands. Hit Enter to run it, or Right Arrow to edit it on your prompt.
Searching History with Grep
View your command history and filter it:
history | grep "docker run"
To see exact timestamps alongside history entries, set HISTTIMEFORMAT in your ~/.bashrc:
export HISTTIMEFORMAT="%F %T "
Interactive Fuzzy Search: fzf
fzf is a command-line fuzzy finder that turns search into an interactive experience.
Install fzf:
sudo apt install fzf
Once installed, press Ctrl+R in your shell. fzf opens an interactive dropdown list of your entire command history. As you type letters, it filters candidates in real time.
You can also pipe any command output into fzf. For instance, search for a running container interactively:
docker ps | fzf
Or search for a file and open it in vim with a single keypress:
vim $(fd -type f | fzf)
6. Searching Processes, Open Files, and Listening Ports
Sometimes what you need to find is not text on disk, but an active process or network port in memory.
Searching Running Processes
When a process is consuming CPU or hanging, find its Process ID (PID) using ps or pgrep.
Search processes with ps:
ps aux | grep node
Search processes directly with pgrep to get PIDs and full command lines:
pgrep -a python
To kill a process by searching its name:
pkill -f "test_server.py"
Searching Which Process Holds a File
Have you ever tried to unmount a disk partition or delete a folder, only to get an error saying Device or resource busy?
Use lsof (List Open Files) or fuser to find the process locking the file:
sudo lsof /mnt/storage
Or use fuser to see PIDs and kill them directly:
sudo fuser -v /var/log/app.log
sudo fuser -k /var/log/app.log
Searching Network Ports and Sockets
When starting a web server or backend service, a common error is address already in use. You need to find which process is bound to that port.
Find what is listening on port 8080 using lsof:
sudo lsof -i :8080
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
node 14209 asep 23u IPv4 89201 0t0 TCP *:8080 (LISTEN)
Find open ports using ss (Socket Statistics):
sudo ss -tulpn | grep 8080
Flags explained:
- -t: TCP sockets.
- -u: UDP sockets.
- -l: Listening sockets.
- -p: Show process name and PID.
- -n: Display numeric port numbers instead of service names.
Real Production Scenario
When I was developing AiroShare, a high-performance local media streaming engine, pre-launch port conflict resolution was a critical requirement. If port 9900 (DLNA HTTP media server) or port 2121 (FTP media engine) was already taken by another background service, AiroShare automatically scanned socket states using lightweight port checks to locate available ports before binding. Understanding how Linux exposes socket states made building that auto-resolution feature smooth and reliable.
7. Searching Executables, Libraries, and Package Owners
When you type a command in your shell, how do you find where the binary file is actually located?
Finding Command Paths
Locate the absolute path of an executable using which:
which python3
Locate binaries, manual pages, and source files using whereis:
whereis nginx
Identify how shell commands are interpreted using type:
type ll
type cd
type grep
type tells you whether a command is a shell built-in (cd), an alias (ll), a function, or a disk binary (grep).
Finding Which Installed Package Owns a File
If you find a random binary or configuration file on a server and want to know which software package installed it, query your package manager.
On Ubuntu or Debian (dpkg):
dpkg -S /etc/ssh/sshd_config
On RHEL, CentOS, or Fedora (rpm):
rpm -qf /etc/ssh/sshd_config
If a binary is missing and you want to find which package provides it before installing:
sudo apt install apt-file
sudo apt-file update
apt-file search bin/netstat
8. Searching Kernel Parameters and Hardware Information
Linux exposes live kernel variables and attributes through pseudo-filesystems like /proc and /sys.
Searching Active Kernel Variables with sysctl
Search all active kernel settings for network or memory parameters:
sysctl -a | grep "ip_forward"
sysctl -a | grep "swappiness"
You can change these values temporarily at runtime or lock them permanently inside /etc/sysctl.conf.
Searching Hardware Attributes in /proc
Search system CPU information:
grep "model name" /proc/cpuinfo
Search system memory details:
grep -i "memtotal" /proc/meminfo
Search network traffic statistics per interface:
cat /proc/net/dev
9. An Interesting Historical Fact About Linux Search
Did you know where the name grep came from?
Back in the early 1970s at Bell Labs, Unix co-creator Ken Thompson was working on the ed line editor. When users wanted to search an entire file for a regular expression and print matching lines, they typed a specific editor command:
g/re/p
This stood for global / regular expression / print.
Ken Thompson realized that searching text files was such a frequent necessity that he wrote a small, standalone command-line tool over a single night to do it outside the editor. He named that tool grep. More than fifty years later, grep remains one of the most widely used commands in software engineering.
10. Summary Cheat Sheet
Here is a quick reference guide for your daily terminal search needs:
-
Find files by name:
find . -name "*.conf"orfd conf -
Find files by size:
find /var -type f -size +100M -
Search text in files:
grep -rn "pattern" ./orrg "pattern" -
Search text in gz logs:
rg -z "pattern" /var/log/*.gz -
Search systemd logs:
journalctl -u app -p err --since "1 hour ago" -
Search command history:
Ctrl+Rorhistory | grep "command" -
Search listening ports:
sudo lsof -i :8080orsudo ss -tulpn | grep 8080 -
Search running processes:
pgrep -a process_name -
Search package owner:
dpkg -S /path/to/file
What Is Your Go-To Search Tool?
When a production incident hits or a build breaks, which command do you reach for first? Are you sticking with classic tools like find and grep, or have modern tools like fd, ripgrep, and fzf completely replaced them in your workflow? Let me know in the comments below!
About the Author
Asep Sayyad is a Linux and DevOps engineer passionate about Linux administration, automation, cloud technologies, containers, and open-source software. He enjoys solving real-world infrastructure challenges and sharing practical knowledge through in-depth technical articles, tutorials, and hands-on guides.
His goal is to help aspiring and experienced engineers build stronger Linux and DevOps skills with content focused on real production scenarios rather than theory alone.
Connect with Me
Portfolio: https://asepsayyad007.in
GitHub: https://github.com/asepsayyad007
LinkedIn: https://www.linkedin.com/in/asepsayyad
Medium: https://asepsayyad007.medium.com
Enjoyed this article?
If you found this guide helpful, consider:
- Starring my open-source projects on GitHub.
- Sharing this article with fellow Linux and DevOps engineers.
You can also follow me for more practical content on Linux, DevOps, Cloud, Containers, Automation, and Open Source. Thanks for reading, and enjoy your learning!
© 2026 Asep Sayyad
