{"id":2306,"date":"2026-03-24T02:03:36","date_gmt":"2026-03-23T23:03:36","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=2306"},"modified":"2026-03-24T15:14:45","modified_gmt":"2026-03-24T12:14:45","slug":"find-delete-old-files-linux","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/find-delete-old-files-linux\/","title":{"rendered":"Find and Delete Files Older Than N Days in Linux"},"content":{"rendered":"\n

Cleaning up old files is one of those tasks every sysadmin automates sooner or later. Log rotation leaves behind compressed archives, backup scripts pile up daily snapshots, and temporary files accumulate in \/tmp<\/code>. The find<\/code> command handles all of these with a single line.<\/p>\n\n\n\n

This guide covers practical examples of finding and deleting files older than a specified number of days on any Linux distribution, plus how to automate cleanup with cron.<\/p>\n\n\n\n

Find Files Older Than N Days<\/h2>\n\n\n\n

The find<\/code> command’s -mtime<\/code> option matches files by modification time. The value is specified in days: +7<\/code> means more than 7 days ago, -7<\/code> means less than 7 days ago, and 7<\/code> means exactly 7 days ago.<\/p>\n\n\n\n

List all files under \/var\/log<\/code> that were last modified more than 7 days ago:<\/p>\n\n\n\n

find \/var\/log -type f -mtime +7<\/code><\/pre>\n\n\n\n
Add -ls<\/code> for detailed output including size, permissions, and modification date:<\/p>\n\n\n\n
find \/var\/log -type f -mtime +7 -ls<\/code><\/pre>\n\n\n\n
Filter by file extension. This finds only .gz<\/code> compressed log files older than 30 days:<\/p>\n\n\n\n
find \/var\/log -type f -name \"*.gz\" -mtime +30<\/code><\/pre>\n\n\n\n
Delete Files Older Than N Days<\/h2>\n\n\n\n
Once you have confirmed the file list looks correct, add -delete<\/code> to remove them. Always run without -delete<\/code> first to preview what will be removed.<\/p>\n\n\n\n
Delete compressed log files older than 30 days:<\/p>\n\n\n\n
find \/var\/log -type f -name \"*.gz\" -mtime +30 -delete<\/code><\/pre>\n\n\n\n
The -delete<\/code> flag is safer than -exec rm<\/code> because it only removes files (not directories) and does not require shell expansion. For more control, use -exec<\/code> instead:<\/p>\n\n\n\n
find \/var\/log -type f -name \"*.gz\" -mtime +30 -exec rm -f {} \\;<\/code><\/pre>\n\n\n\n
To see what is being deleted as it happens, add -print<\/code> before -delete<\/code>:<\/p>\n\n\n\n
find \/var\/log -type f -name \"*.gz\" -mtime +30 -print -delete<\/code><\/pre>\n\n\n\n
Common Cleanup Examples<\/h2>\n\n\n\n
Delete old backup files<\/h3>\n\n\n\n
Remove database backup dumps older than 14 days from the backup directory:<\/p>\n\n\n\n
find \/backups -type f -name \"*.sql.gz\" -mtime +14 -delete<\/code><\/pre>\n\n\n\n
Clean temporary files<\/h3>\n\n\n\n
Remove all files in \/tmp<\/code> that have not been modified in the last 3 days:<\/p>\n\n\n\n
find \/tmp -type f -mtime +3 -delete<\/code><\/pre>\n\n\n\n
Delete files by size and age<\/h3>\n\n\n\n
Remove files larger than 100MB that are older than 7 days. The -size<\/code> option filters by file size:<\/p>\n\n\n\n
find \/var\/log -type f -mtime +7 -size +100M -delete<\/code><\/pre>\n\n\n\n
Delete empty directories<\/h3>\n\n\n\n
After deleting files, empty directories may remain. Clean them up with -type d<\/code> and -empty<\/code>:<\/p>\n\n\n\n
find \/backups -type d -empty -delete<\/code><\/pre>\n\n\n\n
Using Access Time vs Modification Time<\/h2>\n\n\n\n
The find<\/code> command supports three time-based options:<\/p>\n\n\n\n
Option<\/th>Measures<\/th>Use case<\/th><\/tr><\/thead>
-mtime<\/code><\/td>Modification time (content changed)<\/td>Log files, backups, data files<\/td><\/tr>
-atime<\/code><\/td>Access time (last read)<\/td>Cache files, temp data<\/td><\/tr>
-ctime<\/code><\/td>Change time (metadata changed)<\/td>Permission or ownership changes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
For most cleanup tasks, -mtime<\/code> is what you want. Note that -atime<\/code> can be unreliable on filesystems mounted with noatime<\/code> (which is common on modern Linux systems for performance).<\/p>\n\n\n\n
For finer granularity, use -mmin<\/code> instead of -mtime<\/code> to specify minutes instead of days. Delete files modified more than 60 minutes ago:<\/p>\n\n\n\n
find \/tmp -type f -mmin +60 -delete<\/code><\/pre>\n\n\n\n
Automate Cleanup with Cron<\/h2>\n\n\n\n
Running cleanup commands manually defeats the purpose. Schedule them with cron to run automatically. Open the root crontab:<\/p>\n\n\n\n
sudo crontab -e<\/code><\/pre>\n\n\n\n
Add a job that runs daily at 2 AM to clean up old log files:<\/p>\n\n\n\n
0 2 * * * find \/var\/log -type f -name \"*.gz\" -mtime +30 -delete<\/code><\/pre>\n\n\n\n
For backup cleanup, run weekly on Sundays at 3 AM:<\/p>\n\n\n\n
0 3 * * 0 find \/backups -type f -name \"*.sql.gz\" -mtime +14 -delete<\/code><\/pre>\n\n\n\n
Clean \/tmp<\/code> every 6 hours:<\/p>\n\n\n\n
0 *\/6 * * * find \/tmp -type f -mtime +3 -delete 2>\/dev\/null<\/code><\/pre>\n\n\n\n
The 2>\/dev\/null<\/code> suppresses error messages from files that were already deleted by other processes. Redirect output to a log file if you want an audit trail:<\/p>\n\n\n\n
0 2 * * * find \/var\/log -type f -name \"*.gz\" -mtime +30 -print -delete >> \/var\/log\/cleanup.log 2>&1<\/code><\/pre>\n\n\n\n
Using systemd-tmpfiles as an Alternative<\/h2>\n\n\n\n
Modern Linux systems include systemd-tmpfiles<\/code> which provides declarative file cleanup rules. This is the system that manages \/tmp<\/code> cleanup by default on most distributions.<\/p>\n\n\n\n
Create a custom cleanup rule in \/etc\/tmpfiles.d\/<\/code>:<\/p>\n\n\n\n
sudo vi \/etc\/tmpfiles.d\/cleanup-backups.conf<\/code><\/pre>\n\n\n\n
Add a rule to delete backup files older than 14 days:<\/p>\n\n\n\n
e \/backups - - - 14d *.sql.gz<\/code><\/pre>\n\n\n\n
The e<\/code> directive means “clean up files matching the pattern that are older than the specified age”. Test the rule without making changes:<\/p>\n\n\n\n
sudo systemd-tmpfiles --clean --dry-run<\/code><\/pre>\n\n\n\n
The systemd-tmpfiles --clean<\/code> command runs automatically via a systemd timer, so your rules execute without needing a separate cron entry.<\/p>\n\n\n\n
Safety Tips<\/h2>\n\n\n\n