Cleaning up old files is one of those tasks every sysadmin automates sooner or later. Log rotation leaves behind compressed archives, backup scripts pile up daily snapshots, and temporary files accumulate in /tmp. The find command handles all of these with a single line.
This guide covers practical examples of finding and deleting files older than a specified number of days on any Linux distribution, plus how to automate cleanup with cron.
Find Files Older Than N Days
The find command’s -mtime option matches files by modification time. The value is specified in days: +7 means more than 7 days ago, -7 means less than 7 days ago, and 7 means exactly 7 days ago.
List all files under /var/log that were last modified more than 7 days ago:
find /var/log -type f -mtime +7Add -ls for detailed output including size, permissions, and modification date:
find /var/log -type f -mtime +7 -lsFilter by file extension. This finds only .gz compressed log files older than 30 days:
find /var/log -type f -name "*.gz" -mtime +30Delete Files Older Than N Days
Once you have confirmed the file list looks correct, add -delete to remove them. Always run without -delete first to preview what will be removed.
Delete compressed log files older than 30 days:
find /var/log -type f -name "*.gz" -mtime +30 -deleteThe -delete flag is safer than -exec rm because it only removes files (not directories) and does not require shell expansion. For more control, use -exec instead:
find /var/log -type f -name "*.gz" -mtime +30 -exec rm -f {} \;To see what is being deleted as it happens, add -print before -delete:
find /var/log -type f -name "*.gz" -mtime +30 -print -deleteCommon Cleanup Examples
Delete old backup files
Remove database backup dumps older than 14 days from the backup directory:
find /backups -type f -name "*.sql.gz" -mtime +14 -deleteClean temporary files
Remove all files in /tmp that have not been modified in the last 3 days:
find /tmp -type f -mtime +3 -deleteDelete files by size and age
Remove files larger than 100MB that are older than 7 days. The -size option filters by file size:
find /var/log -type f -mtime +7 -size +100M -deleteDelete empty directories
After deleting files, empty directories may remain. Clean them up with -type d and -empty:
find /backups -type d -empty -deleteUsing Access Time vs Modification Time
The find command supports three time-based options:
| Option | Measures | Use case |
|---|---|---|
-mtime | Modification time (content changed) | Log files, backups, data files |
-atime | Access time (last read) | Cache files, temp data |
-ctime | Change time (metadata changed) | Permission or ownership changes |
For most cleanup tasks, -mtime is what you want. Note that -atime can be unreliable on filesystems mounted with noatime (which is common on modern Linux systems for performance).
For finer granularity, use -mmin instead of -mtime to specify minutes instead of days. Delete files modified more than 60 minutes ago:
find /tmp -type f -mmin +60 -deleteAutomate Cleanup with Cron
Running cleanup commands manually defeats the purpose. Schedule them with cron to run automatically. Open the root crontab:
sudo crontab -eAdd a job that runs daily at 2 AM to clean up old log files:
0 2 * * * find /var/log -type f -name "*.gz" -mtime +30 -deleteFor backup cleanup, run weekly on Sundays at 3 AM:
0 3 * * 0 find /backups -type f -name "*.sql.gz" -mtime +14 -deleteClean /tmp every 6 hours:
0 */6 * * * find /tmp -type f -mtime +3 -delete 2>/dev/nullThe 2>/dev/null suppresses error messages from files that were already deleted by other processes. Redirect output to a log file if you want an audit trail:
0 2 * * * find /var/log -type f -name "*.gz" -mtime +30 -print -delete >> /var/log/cleanup.log 2>&1Using systemd-tmpfiles as an Alternative
Modern Linux systems include systemd-tmpfiles which provides declarative file cleanup rules. This is the system that manages /tmp cleanup by default on most distributions.
Create a custom cleanup rule in /etc/tmpfiles.d/:
sudo vi /etc/tmpfiles.d/cleanup-backups.confAdd a rule to delete backup files older than 14 days:
e /backups - - - 14d *.sql.gzThe e directive means “clean up files matching the pattern that are older than the specified age”. Test the rule without making changes:
sudo systemd-tmpfiles --clean --dry-runThe systemd-tmpfiles --clean command runs automatically via a systemd timer, so your rules execute without needing a separate cron entry.
Safety Tips
- Always preview first – run the
findcommand without-deleteto see what matches before deleting - Use
-type fto avoid accidentally deleting directories - Quote glob patterns – use
-name "*.gz"not-name *.gzto prevent shell expansion - Prefer
-deleteover-exec rm– it handles edge cases like filenames with spaces - Test cron jobs manually first – run the exact command as the cron user to catch permission issues
