$ Linux One Liners
Back to cert prep

Unofficial practice

Find Files by Size, Owner, and mtime

A host reports write errors or low-space warnings. Prove the pressured mount point first, then decide whether bytes, inodes, or the wrong filesystem are the real issue.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Try first

find /var -xdev -type f -size +100M -mtime -7 -printf '%u %s %TY-%Tm-%Td %p\n' | sort -k2,2nr | head

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

drill evidence

Sample output and answer key

Command anatomy

find /var -xdev -type f -size +100M -mtime -7 -printf '%u %s %TY-%Tm-%Td %p\n' | sort -k2,2nr | head
find
walk a directory tree
-xdev
stay on one filesystem when present
-type f
limit the result to files
-size/-mtime/-perm
filter by size, age, or mode
-printf
choose the fields you need to read

Annotated output

root 524288000 2026-07-03 /var/log/journal/2f/system.journal
www-data 248512000 2026-07-02 /var/log/nginx/access.log
deploy 146800640 2026-07-01 /var/tmp/app-export.tar

What to notice

owner
who owns the file
bytes
how large it is before human formatting
date
whether this is recent growth
path
the exact file, not the directory guess

Safe vs unsafe move

Common wrong move

Deleting the largest file without proving its mount point, owner, or whether a service still has it open.

Next safe command

du -xhd1 /var | sort -h

Goal

Prove the condition with command output before changing the system.

Safe first command

find /var -xdev -type f -size +100M -mtime -7 -printf '%u %s %TY-%Tm-%Td %p\n' | sort -k2,2nr | head

Correct interpretation

The decisive fields are `owner`, `bytes`, `date`. The affected object is the path, user, address, or package named by the command output. The next safe command is `du -xhd1 /var | sort -h` because it narrows the evidence without jumping to a broad fix. Watch out for this wrong move: Deleting the largest file without proving its mount point, owner, or whether a service still has it open.

Next safe command

du -xhd1 /var | sort -h

Common wrong move

Deleting the largest file without proving its mount point, owner, or whether a service still has it open.

Self-check

Which mount point is actually under pressure, and does the output prove byte usage, inode usage, or both?

source and objective

Related cert objective

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

Open related practice area

Related command pages

Why this matters

The point is not to memorize a flag. It is to read the evidence, name the next safe check, and avoid the tempting broad fix.