Complete Guide to Linux File Operations: find, stat, and file Commands for RHCSA Certification

Published On: 25 July 2025

Objective

If you're preparing for the Red Hat Certified System Administrator (RHCSA) exam, mastering file management is essential. Among the many commands you'll rely on, three stand out for navigating and analyzing the Linux filesystem: find, stat, and file. These commands are your Swiss Army knives for system administration. The find command helps you locate files based on various criteria like name, size, and permissions. The stat command reveals detailed metadata about files, including timestamps and ownership. The file command identifies file types regardless of their extensions. This guide provides practical examples and tips to help you master these tools for both the RHCSA exam and real-world system administration tasks in Red Hat Enterprise Linux (RHEL).

The Power of find: Locating Files Like a Pro

The find command is one of the most powerful tools in a sysadmin's arsenal. It helps you locate files and directories based on a wide range of criteria: name, size, permissions, timestamps, and more.

Basic Syntax

find [path] [expression]    # Searches files and directories using specified criteria

Common Use Cases

1. Find by Name

find /home -name "report.txt"     # Searches /home for a file named report.txt 
find /home -iname "REPORT.txt"    # Case-insensitive search
find /home -name "*.log"          # Using wildcards to find all .log files

This searches the /home directory and all its subdirectories for files matching the specified pattern.

2. Find by Type

find /var -type d  # Lists all directories under /var
find /etc -type f  # Lists all regular files under /etc
find /dev -type l  # Lists all symbolic links under /dev

The -type option helps you filter results by file type (d=directory, f=regular file, l=symbolic link).

3. Find by Size

find / -size +100M     # Finds files larger than 100 MB 
find /home -size -1k   # Finds files smaller than 1 KB
find /var -size 50M    # Finds files exactly 50 MB

Size units: c=bytes, k=kilobytes, M=megabytes, G=gigabytes.

4. Find by Permission

find /tmp -perm 777        # Finds files with exactly 777 permissions
find /home -perm -644      # Finds files with at least 644 permissions
find /var -perm /u+w       # Finds files writable by owner

Locates files with specific permissions—an excellent way to audit potential security risks.

5. Find and Execute Commands

find /var/log -name "*.log" -exec gzip {} \;   # Compresses all .log files in /var/log 
find /tmp -name "*.tmp" -exec rm {} \;         # Removes all .tmp files
find /home -name "*.bak" -ok rm {} \;          # Prompts before removing .bak files

This compresses all .log files in /var/log. The {} is replaced with each matching file, and \; ends the command. Use -ok instead of -exec for interactive confirmation.

6. Find by Time

Modified in last 1 day:

find /etc -mtime -1     # Finds files modified in the last 1 day 
find /var -mtime +7     # Finds files modified more than 7 days ago

Accessed more than 10 days ago:

find /home -atime +10    # Finds files accessed more than 10 days ago

Time units: Use +n for "more than n days ago", -n for "within n days", and n for "exactly n days ago".

Using stat: Peering Into File Metadata

Once you have found a file, the next step is often to understand its metadata—when it was modified, who owns it, what the permissions are, and more. That is where the stat command comes in.

Basic Usage

stat filename   # Displays metadata details of the specified file 
stat -c "%n %s %y" filename  # Custom format: name, size, modification time

Example Output

stat /etc/passwd  # Displays information about /etc/passwd

Output:

File: /etc/passwd
  Size: 2531	    Blocks: 8       IO Block: 4096   regular file
Device: 802h/2050d  Inode: 393217   Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2025-05-29 08:00:00.000000000 +0000
Modify: 2025-05-28 22:14:30.000000000 +0000
Change: 2025-05-28 22:14:30.000000000 +0000
 Birth: -

Key Elements

  • Size: File size in bytes
  • Blocks: Number of disk blocks used (usually 512-byte blocks)
  • Inode: Unique identifier on the filesystem
  • Access/Modify/Change: Critical timestamps for troubleshooting and auditing
    • Access — last read time (atime)
    • Modify — last time the content changed (mtime)
    • Change — last time metadata (e.g., permissions, ownership) changed (ctime)
  • Uid/Gid: User and group ownership information

Why it matters for RHCSA: Understanding metadata is crucial for tasks like auditing, troubleshooting file issues, managing permissions, or optimizing disk usage.

The file Command: What is This File Really?

Sometimes, a file doesn't behave the way you expect. It might not have the extension you are familiar with, or it could be a binary in disguise. That is when you turn to the file command.

Basic Usage

file filename              # Determines the file type based on content, not extension
file -b filename           # Brief output (no filename prefix)
file -i filename           # Show MIME type

Examples

1. Regular Text File

file /etc/hosts  # Checks the type of /etc/hosts

Output:

/etc/hosts: ASCII text

2. Binary Executable

file /bin/ls    # Checks the type of /bin/ls

Output:

/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked

3. Compressed Files

file archive.tar.gz    # Determines compression type

Output:

archive.tar.gz: gzip compressed data

4. Scripts

file script.sh  # Verifies shell script type

Output:

script.sh: Bourne-Again shell script, ASCII text executable

Pro Tip

Even when a file is missing its extension, file can usually identify its type based on internal magic numbers and file signatures—so it is incredibly useful when managing systems with poorly named or unknown files. The command reads the first few bytes of a file to determine its true nature, regardless of the filename.

Combining find, stat, and file: A Real-World Use Case

Let's say you are auditing a system and need to:

  • Find all .sh scripts under /home
  • Identify their metadata
  • Confirm they're actually shell scripts

Here's how you could approach it:

Method 1: Sequential execution

find /home -type f -name "*.sh" -exec stat {} \; -exec file {} \;

Method 2: More organized approach

# First, find and list the files
find /home -type f -name "*.sh" > script_list.txt

# Then analyze each file
while read script; do
    echo "=== Analyzing: $script ==="
    stat "$script"
    file "$script"
    echo
done < script_list.txt

This workflow demonstrates how these three tools complement each other and support practical, day-to-day sysadmin tasks.

Advanced Tips and Tricks

Combining find with other commands

# Find large files and sort by size
find /var -type f -size +50M -exec ls -lh {} \; | sort -k5 -hr

# Find files by user and show permissions
find /home -user john -exec ls -l {} \;

# Find empty directories
find /tmp -type d -empty

Using logical operators

# Find files that are either .txt OR .log
find /var -name "*.txt" -o -name "*.log"

# Find files that are .conf AND larger than 1KB
find /etc -name "*.conf" -a -size +1k

Tips for the RHCSA Exam

  • Expect hands-on tasks by practicing commands in a real RHEL 9 environment, not just reading syntax. Try RHCSA.GURU platform for hands-on practicing. 
  • Combine commands logically to solve real problems, not just to show knowledge of individual options.
  • Use man and --help during practice so you're fluent in finding answers quickly when stuck.
  • Practice with time constraints to improve speed and accuracy under exam conditions.
  • Understand the security implications of each command to recognize and address potential risks.

Conclusion

Mastering find, stat, and file is not just about passing the RHCSA exam, it is about becoming a competent Linux system administrator. These commands empower you to locate, inspect, and verify files quickly and accurately, giving you confidence to manage complex environments. Whether you are analyzing logs, troubleshooting issues, or securing your system, these tools will serve you well throughout your career. If you are serious about acing the RHCSA and want expert guidance, practice labs, and real-world scenarios, look no further than RHCSA.GURU. Stay curious. Stay sharp. Stay rooted in Linux.