DEV Community

Cover image for How to Search Anything in Linux: The Complete Terminal Survival Guide
Asep Sayyad
Asep Sayyad

Posted on • Originally published at asepsayyad007.Medium

How to Search Anything in Linux: The Complete Terminal Survival Guide

#linux #devops #cli #ubuntu

Whether you are managing cloud servers, debugging local applications, or building open-source projects, searching is the most essential skill in your terminal toolkit. Linux stores everything as a file, process, or network socket. If you know the right tools, you can search across millions of files, system logs, processes, and active ports in seconds.

Here is a practical, step-by-step guide to searching anything in Linux.

1. Finding Files and Directories by Name, Size, and Date

When you know a file exists but forgot where it lives, file search tools are your first line of defense.

The Classic find Tool

The find utility is built into every Linux distribution. It searches live directory trees based on real-time filesystem checks.

Search for a file by exact name in the current directory:

find . -name "config.yaml"
Enter fullscreen mode Exit fullscreen mode

Search case-insensitively for any file ending in .log:

find /var/log -iname "*.log"
Enter fullscreen mode Exit fullscreen mode

Filter specifically for files or directories only:

find /srv/app -type f -name "*.json"
find /srv/app -type d -name "cache"
Enter fullscreen mode Exit fullscreen mode

Searching by File Size

When disk space runs out, finding large files fast is vital. Use the -size flag to isolate files over a certain threshold:

find /var -type f -size +100M
Enter fullscreen mode Exit fullscreen mode

This command scans /var for regular files larger than 100 megabytes. You can use k for kilobytes, M for megabytes, and G for gigabytes.

Searching by Modification Time

If an incident started twenty minutes ago, look for files created or modified within that window:

find /etc -mmin -30
Enter fullscreen mode Exit fullscreen mode

To search for files modified more than 7 days ago:

find /tmp -mtime +7
Enter fullscreen mode Exit fullscreen mode

Executing Actions on Found Files

Instead of passing file lists manually, find lets you execute actions directly:

find /tmp -type f -name "*.tmp" -delete
Enter fullscreen mode Exit fullscreen mode

Or pass results to another command safely using -exec:

find /var/log -type f -name "*.old" -exec rm -f {} \;
Enter fullscreen mode Exit fullscreen mode

Fast Modern Alternative: fd

While find is universal, its syntax can be verbose. A fast, modern replacement written in Rust is fd.

Install fd on Ubuntu or Debian:

sudo apt update && sudo apt install fd-find
Enter fullscreen mode Exit fullscreen mode

fd simplifies syntax, runs multi-threaded searches, colors output, and ignores hidden files and .gitignore rules by default.

Search for any file containing "nginx" in its name:

fd nginx
Enter fullscreen mode Exit fullscreen mode

Search for a specific extension in a target directory:

fd -e md -e txt . /home/user/docs
Enter fullscreen mode Exit fullscreen mode

Include hidden files and gitignored paths when needed:

fd -H -I "secret"
Enter fullscreen mode Exit fullscreen mode

2. Instant Filesystem-Wide Search with locate and plocate

Running find across the entire root directory / can take time because it hits the disk for every directory traversal. When you need instant results across the whole system, use locate.

How locate Works

locate does not scan your hard drive live. Instead, it reads a pre-built database index file (/var/lib/mlocate/mlocate.db or /var/lib/plocate/plocate.db).

Search for any file or path containing "ssl":

locate nginx.conf
Enter fullscreen mode Exit fullscreen mode

The output returns instantly, even on systems with millions of files.

Updating the Search Database

Because locate reads a database, newly created files won't show up right away. Update the index manually before searching:

sudo updatedb
Enter fullscreen mode Exit fullscreen mode

On modern distributions like Ubuntu 22.04+, plocate has replaced traditional mlocate. plocate uses io_uring and index posting lists, making searches up to 10 times faster while using a much smaller database.

3. Searching Text Inside Files with grep and ripgrep

Finding a file by name is useful, but often you need to search for text inside code, configuration files, or logs.

The Classic grep Command

grep (Global Regular Expression Print) searches text patterns line by line.

Basic search for a string in a file:

grep "DATABASE_URL" /srv/app/.env
Enter fullscreen mode Exit fullscreen mode

Search recursively inside a directory and display line numbers:

grep -rn "error_log" /etc/nginx/
Enter fullscreen mode Exit fullscreen mode

Key flags to remember:

  • -r or -R: Search directories recursively.
  • -n: Show line numbers.
  • -i: Case-insensitive search.
  • -w: Match whole words only.
  • -c: Count total matching lines instead of printing them.

Exclude noisy directories like node_modules or .git:

grep -rn --exclude-dir={node_modules,.git,dist} "PORT" ./
Enter fullscreen mode Exit fullscreen mode

Show context lines before and after matches:

grep -C 3 "FATAL" /var/log/syslog
Enter fullscreen mode Exit fullscreen mode

The -C 3 flag shows 3 lines above and 3 lines below each match, giving you immediate context around errors.

Lightning Fast Search: ripgrep (rg)

When searching large source code repositories or massive log folders, standard grep can be slow. ripgrep (command name rg) is the fastest line-oriented search tool available.

Install ripgrep:

sudo apt install ripgrep
Enter fullscreen mode Exit fullscreen mode

Search for a pattern in the current directory:

rg "connectTimeout"
Enter fullscreen mode Exit fullscreen mode

Why ripgrep is superior for developers and sysadmins:

  • It respects your .gitignore and .ignore files automatically.
  • It skips binary files and hidden files by default.
  • It uses multi-threading and SIMD CPU instructions to scan gigabytes per second.

Search inside compressed .gz log files without extracting them first:

rg -z "500 Internal Server Error" /var/log/nginx/access.log*.gz
Enter fullscreen mode Exit fullscreen mode

Real Production Scenario

When I was building AiroShare, a local DLNA media server, I had to search across thousands of lines of JavaScript and Node.js files to find every location where a custom SSDP multicast listener was registered. Running rg "ssdp:discover" instantly gave me every file, function, and line number in under 10 milliseconds without dragging in unwanted build artifacts.

4. Searching System Logs and Kernel Events

When an application crashes, an IP gets blocked, or a service fails on boot, your answers live inside system logs.

Searching systemd Logs with journalctl

Modern Linux distributions use systemd to manage services and record binary logs. The journalctl command lets you search these logs with precision.

View logs for a specific service unit:

sudo journalctl -u nginx.service
Enter fullscreen mode Exit fullscreen mode

Filter log output by priority (errors, warnings, or critical events):

sudo journalctl -u app.service -p err
Enter fullscreen mode Exit fullscreen mode

Priority levels include emerg, alert, crit, err, warning, notice, info, and debug.

Search logs within a specific time window:

sudo journalctl --since "2026-08-14 14:00:00" --until "2026-08-14 15:30:00"
Enter fullscreen mode Exit fullscreen mode

Or view entries from the last two hours:

sudo journalctl --since "2 hours ago"
Enter fullscreen mode Exit fullscreen mode

Search log messages matching a specific keyword:

sudo journalctl -g "out of memory"
Enter fullscreen mode Exit fullscreen mode

Follow live log output as new entries arrive:

sudo journalctl -f -u docker.service
Enter fullscreen mode Exit fullscreen mode

Searching Kernel Messages with dmesg

If a hardware device disconnects, a network interface drops, or the Out-Of-Memory (OOM) killer kills a process, check the kernel ring buffer using dmesg.

Search for kernel OOM events:

sudo dmesg -T | grep -i "oom"
Enter fullscreen mode Exit fullscreen mode

The -T flag converts raw kernel timestamps into human-readable date and time formats.

Searching Rotated Log Files

Older log files in /var/log are often compressed into .gz format by logrotate. Standard text tools cannot read them directly. Use zgrep or zless instead:

zgrep -i "failed password" /var/log/auth.log*.gz
Enter fullscreen mode Exit fullscreen mode

5. Searching Command History Like a Master

How many times have you typed a complex 80-character docker or kubectl command, only to forget it three days later? Stop hitting the Up arrow key fifty times.

Built-in Reverse Search: Ctrl+R

Press Ctrl+R in your terminal and start typing any fragment of the past command:

(reverse-i-search)`ssh`: ssh -i ~/.ssh/prod_key.pem admin@10.0.4.15
Enter fullscreen mode Exit fullscreen mode

Press Ctrl+R repeatedly to cycle backward through matching historical commands. Hit Enter to run it, or Right Arrow to edit it on your prompt.

Searching History with Grep

View your command history and filter it:

history | grep "docker run"
Enter fullscreen mode Exit fullscreen mode

To see exact timestamps alongside history entries, set HISTTIMEFORMAT in your ~/.bashrc:

export HISTTIMEFORMAT="%F %T "
Enter fullscreen mode Exit fullscreen mode

Interactive Fuzzy Search: fzf

fzf is a command-line fuzzy finder that turns search into an interactive experience.

Install fzf:

sudo apt install fzf
Enter fullscreen mode Exit fullscreen mode

Once installed, press Ctrl+R in your shell. fzf opens an interactive dropdown list of your entire command history. As you type letters, it filters candidates in real time.

You can also pipe any command output into fzf. For instance, search for a running container interactively:

docker ps | fzf
Enter fullscreen mode Exit fullscreen mode

Or search for a file and open it in vim with a single keypress:

vim $(fd -type f | fzf)
Enter fullscreen mode Exit fullscreen mode

6. Searching Processes, Open Files, and Listening Ports

Sometimes what you need to find is not text on disk, but an active process or network port in memory.

Searching Running Processes

When a process is consuming CPU or hanging, find its Process ID (PID) using ps or pgrep.

Search processes with ps:

ps aux | grep node
Enter fullscreen mode Exit fullscreen mode

Search processes directly with pgrep to get PIDs and full command lines:

pgrep -a python
Enter fullscreen mode Exit fullscreen mode

To kill a process by searching its name:

pkill -f "test_server.py"
Enter fullscreen mode Exit fullscreen mode

Searching Which Process Holds a File

Have you ever tried to unmount a disk partition or delete a folder, only to get an error saying Device or resource busy?

Use lsof (List Open Files) or fuser to find the process locking the file:

sudo lsof /mnt/storage
Enter fullscreen mode Exit fullscreen mode

Or use fuser to see PIDs and kill them directly:

sudo fuser -v /var/log/app.log
sudo fuser -k /var/log/app.log
Enter fullscreen mode Exit fullscreen mode

Searching Network Ports and Sockets

When starting a web server or backend service, a common error is address already in use. You need to find which process is bound to that port.

Find what is listening on port 8080 using lsof:

sudo lsof -i :8080
Enter fullscreen mode Exit fullscreen mode

Output:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    14209 asep    23u  IPv4  89201      0t0  TCP *:8080 (LISTEN)
Enter fullscreen mode Exit fullscreen mode

Find open ports using ss (Socket Statistics):

sudo ss -tulpn | grep 8080
Enter fullscreen mode Exit fullscreen mode

Flags explained:

  • -t: TCP sockets.
  • -u: UDP sockets.
  • -l: Listening sockets.
  • -p: Show process name and PID.
  • -n: Display numeric port numbers instead of service names.

Real Production Scenario

When I was developing AiroShare, a high-performance local media streaming engine, pre-launch port conflict resolution was a critical requirement. If port 9900 (DLNA HTTP media server) or port 2121 (FTP media engine) was already taken by another background service, AiroShare automatically scanned socket states using lightweight port checks to locate available ports before binding. Understanding how Linux exposes socket states made building that auto-resolution feature smooth and reliable.

7. Searching Executables, Libraries, and Package Owners

When you type a command in your shell, how do you find where the binary file is actually located?

Finding Command Paths

Locate the absolute path of an executable using which:

which python3
Enter fullscreen mode Exit fullscreen mode

Locate binaries, manual pages, and source files using whereis:

whereis nginx
Enter fullscreen mode Exit fullscreen mode

Identify how shell commands are interpreted using type:

type ll
type cd
type grep
Enter fullscreen mode Exit fullscreen mode

type tells you whether a command is a shell built-in (cd), an alias (ll), a function, or a disk binary (grep).

Finding Which Installed Package Owns a File

If you find a random binary or configuration file on a server and want to know which software package installed it, query your package manager.

On Ubuntu or Debian (dpkg):

dpkg -S /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

On RHEL, CentOS, or Fedora (rpm):

rpm -qf /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

If a binary is missing and you want to find which package provides it before installing:

sudo apt install apt-file
sudo apt-file update
apt-file search bin/netstat
Enter fullscreen mode Exit fullscreen mode

8. Searching Kernel Parameters and Hardware Information

Linux exposes live kernel variables and attributes through pseudo-filesystems like /proc and /sys.

Searching Active Kernel Variables with sysctl

Search all active kernel settings for network or memory parameters:

sysctl -a | grep "ip_forward"
sysctl -a | grep "swappiness"
Enter fullscreen mode Exit fullscreen mode

You can change these values temporarily at runtime or lock them permanently inside /etc/sysctl.conf.

Searching Hardware Attributes in /proc

Search system CPU information:

grep "model name" /proc/cpuinfo
Enter fullscreen mode Exit fullscreen mode

Search system memory details:

grep -i "memtotal" /proc/meminfo
Enter fullscreen mode Exit fullscreen mode

Search network traffic statistics per interface:

cat /proc/net/dev
Enter fullscreen mode Exit fullscreen mode

9. An Interesting Historical Fact About Linux Search

Did you know where the name grep came from?

Back in the early 1970s at Bell Labs, Unix co-creator Ken Thompson was working on the ed line editor. When users wanted to search an entire file for a regular expression and print matching lines, they typed a specific editor command:

g/re/p
Enter fullscreen mode Exit fullscreen mode

This stood for global / regular expression / print.

Ken Thompson realized that searching text files was such a frequent necessity that he wrote a small, standalone command-line tool over a single night to do it outside the editor. He named that tool grep. More than fifty years later, grep remains one of the most widely used commands in software engineering.

10. Summary Cheat Sheet

Here is a quick reference guide for your daily terminal search needs:

  • Find files by name: find . -name "*.conf" or fd conf
  • Find files by size: find /var -type f -size +100M
  • Search text in files: grep -rn "pattern" ./ or rg "pattern"
  • Search text in gz logs: rg -z "pattern" /var/log/*.gz
  • Search systemd logs: journalctl -u app -p err --since "1 hour ago"
  • Search command history: Ctrl+R or history | grep "command"
  • Search listening ports: sudo lsof -i :8080 or sudo ss -tulpn | grep 8080
  • Search running processes: pgrep -a process_name
  • Search package owner: dpkg -S /path/to/file

What Is Your Go-To Search Tool?

When a production incident hits or a build breaks, which command do you reach for first? Are you sticking with classic tools like find and grep, or have modern tools like fd, ripgrep, and fzf completely replaced them in your workflow? Let me know in the comments below!

About the Author

Asep Sayyad is a Linux and DevOps engineer passionate about Linux administration, automation, cloud technologies, containers, and open-source software. He enjoys solving real-world infrastructure challenges and sharing practical knowledge through in-depth technical articles, tutorials, and hands-on guides.

His goal is to help aspiring and experienced engineers build stronger Linux and DevOps skills with content focused on real production scenarios rather than theory alone.

Connect with Me

Portfolio: https://asepsayyad007.in
GitHub: https://github.com/asepsayyad007
LinkedIn: https://www.linkedin.com/in/asepsayyad
Medium: https://asepsayyad007.medium.com

Enjoyed this article?

If you found this guide helpful, consider:

  • Starring my open-source projects on GitHub.
  • Sharing this article with fellow Linux and DevOps engineers.

You can also follow me for more practical content on Linux, DevOps, Cloud, Containers, Automation, and Open Source. Thanks for reading, and enjoy your learning!

© 2026 Asep Sayyad

Top comments (0)