Finding and Searching: find and grep

grep

grep reads text and prints the lines that match a pattern ^{1 2}:

me@linuxbox:~$ grep bash /etc/passwd
root:x:0:0:root:/root:/bin/bash
me:x:1000:1000:Me,,,:/home/me:/bin/bash
me@linuxbox:~$ ls /usr/bin | grep zip

The options worth knowing ¹:

me@linuxbox:~$ grep -rin "furnace" ~/notes       # every mention, any case, with file and line
me@linuxbox:~$ grep -c error /var/log/dpkg.log    # how many lines mention error
me@linuxbox:~$ grep -rl TODO ~/projects           # which files still have a TODO

Regular expressions

The pattern grep takes is a regular expression, a small language for describing text ^{1 2}. Most characters match themselves; a few are special:

With grep -E (extended expressions), you also get ¹:

• a|b: a or b
• x+: one or more of x
• x?: zero or one x (optional)
• x{3}: exactly three of x
• ( ): grouping

Examples:

me@linuxbox:~$ grep -v '^#' /etc/ssh/ssh_config | grep -v '^$'   # settings without comments or blanks
me@linuxbox:~$ grep -E '^(root|me):' /etc/passwd                 # lines starting with root: or me:
me@linuxbox:~$ grep -E '[0-9]{3}-[0-9]{4}' contacts.txt          # phone-number-shaped text
me@linuxbox:~$ grep '\.jpg$' filelist.txt                        # ends in .jpg (\. is a literal dot)

Always put patterns in single quotes. Characters like *, ?, [, and $ mean something to the shell too, and quotes keep the shell’s hands off so grep gets the pattern intact ¹.

find

find searches a directory tree for files by their properties: name, type, size, age, owner, permissions. It walks every folder under the starting point ¹:

me@linuxbox:~$ find ~ -name '*.pdf'                       # every PDF in your home
me@linuxbox:~$ find ~ -iname '*.jpg' -size +5M            # JPEGs over 5 MB, any case
me@linuxbox:~$ find ~/projects -type d -name node_modules # directories with this name
me@linuxbox:~$ find /var/log -mtime -1 2> /dev/null       # changed in the last day
me@linuxbox:~$ find ~ -type f -empty                      # empty files

The common tests ¹:

Several tests in a row must all be true. For “or,” use -o, and group with escaped parentheses: find ~ \( -name '*.jpg' -o -name '*.png' \) ¹. ! negates: find ~ -type f ! -name '*.txt'.

Quote the wildcard: find ~ -name '*.pdf'. Unquoted, the shell may expand *.pdf against the current folder before find ever sees it ¹.

Acting on what you find

By default find prints the names. It can also act on them ¹:

me@linuxbox:~$ find ~ -name '*.bak' -delete                       # delete them
me@linuxbox:~$ find ~ -name '*.bak' -exec ls -l {} +              # run a command on them
me@linuxbox:~$ find ~ -name '*.bak' -ok rm {} \;                  # ask before each one

In -exec, {} stands for the found names. Ending with + passes many names to one run of the command; ending with \; runs it once per file ¹.

Run any -delete or -exec rm search without the action first and read the list ¹.

xargs turns lines of input into arguments for a command, the other way to act on a list ¹:

me@linuxbox:~$ find ~/photos -iname '*.jpg' -print0 | xargs -0 ls -lh

Names with spaces would be split apart by plain xargs. -print0 and xargs -0 separate names with an invisible null character instead, so every name arrives whole ¹.

locate

locate searches a database of path names instead of walking the disk, so it’s nearly instant. The database is rebuilt daily, so very new files won’t show up until it updates; sudo updatedb rebuilds it now ¹. On Ubuntu, install it with sudo apt install plocate.

me@linuxbox:~$ locate fstab

Your turn

So

grep finds lines that match a pattern, and regular expressions (^, $, ., *, brackets, and with -E, |, +, and ?) describe the pattern. find walks a tree and tests every file by name, type, size, age, or owner, then prints, deletes, or runs a command on the matches. Quote patterns, and preview before you delete.