How to recursively search with grep on Linux.

The grep utility is very useful for searching for text in files on a Linux system. It is possible to search for text or files recursively. This is very easy to do.

This example is how to search for a text string recursively with grep. I have double quotes in the query, so I have to escape them with backslashes to make them work.

1
2
3

jason@Yog-Sothoth:~/Documents/NT-782$ grep -rn "Bill \"Shake\" Spear" .
./SOURCE1A.782_disc1/PRIVATE/MVDM/WOW16/WRITE/D_FORM1.C:1772:                        Bill "Shake" Spear [describing Sand Word] */
./SOURCE1A.782_disc1/PRIVATE/MVDM/WOW16/WRITE/FORM1.C:1360:                        Bill "Shake" Spear [describing Sand Word] */

This way you do not need to use find as well.

This example below shows how to specify the file you are looking for.

jason@Yog-Sothoth:~/Documents/NT-782$ grep -rn --include "*.C" "smbData" .
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1072:    } smbParameters, smbData;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1104:           smbData.BaudRate = (PSMB_IOCTL_BAUD_RATE)Data;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1107:               smbData.BaudRate->BaudRate = (USHORT) ntBuffer.BaudRate.BaudRate;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1179:            smbData.LineControl = (PSMB_IOCTL_LINE_CONTROL)Data;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1199:                smbData.LineControl->DataBits =  ntBuffer.LineControl.WordLength;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1200:                smbData.LineControl->Parity =  ntBuffer.LineControl.Parity;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1201:                smbData.LineControl->StopBits =  ntBuffer.LineControl.StopBits;
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1202:                smbData.LineControl->TransBreak = 0; // !!!
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1212:           smbData.DeviceControl =
./SOURCE1A.782_disc1/PRIVATE/NTOS/SRV/SMBIOCTL.C:1235:               smbData.DeviceControl->WriteTimeout = (USHORT)ntBuffer.Timeouts.ReadIntervalTimeout; // !!!

This is a very good way to search for certain files that contain the text you are looking for.

Another example, looking for a certain string in C code files.

jason@Yog-Sothoth:~/Documents/NT-782$ grep -rn --include "*.C" "NtBuildNumber" .
./SOURCE1A.782_disc1/PRIVATE/NTOS/IO/IOINIT.C:3168:    dcb->MinorVersion = (USHORT) NtBuildNumber;
./SOURCE1A.782_disc1/PRIVATE/NTOS/IO/IOINIT.C:3169:    dcb->MajorVersion = (USHORT) ((NtBuildNumber >> 28) & 0xfffffff);
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:91:ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xC0000000;
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:93:ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xF0000000;
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:665:                 NtBuildNumber & 0xFFFF,
./SOURCE1A.782_disc1/PRIVATE/NTOS/KD/KDAPI.C:2384:    m->u.GetVersion.MinorVersion = (short)NtBuildNumber;
./SOURCE1A.782_disc1/PRIVATE/NTOS/KD/KDAPI.C:2385:    m->u.GetVersion.MajorVersion = (short)((NtBuildNumber >> 28) & 0xFFFFFFF);
./SOURCE1A.782_disc1/PRIVATE/NTOS/CONFIG/CMSYSINI.C:1602:        NtBuildNumber & 0xFFFF
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/ALPHA/DMPSTATE.C:132:            "\nMicrosoft Windows NT [0x%08x]\n", NtBuildNumber);
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/I386/DMPSTATE.C:153:            NtBuildNumber);
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/I386/DMPSTATE.C:219:                    NtBuildNumber & 0xFFFFFFF,
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/MIPS/DMPSTATE.C:388:           NtBuildNumber);

With the -l parameter, it is possible to only list the files and not the text around the matches.

jason@Yog-Sothoth:~/Documents/NT-782$ grep -rnl --include "*.C" "NtBuildNumber" .
./SOURCE1A.782_disc1/PRIVATE/NTOS/IO/IOINIT.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/KD/KDAPI.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/CONFIG/CMSYSINI.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/ALPHA/DMPSTATE.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/I386/DMPSTATE.C
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/MIPS/DMPSTATE.C

This shows how easy it is to search for text on a Linux machine, and you do not need to use find. Grep can do everything you need and it is very fast as well.

To have color highlights for grep output, use this in your .bashrc file.

export GREP_COLOR='00;38;5;32;48;5;226'

This is sample output.

4.4 Mon May 18 jason@Yog-Sothoth 1: $ grep -rn --color=auto --include "*.C" "NtBuildNumber" .
./SOURCE1A.782_disc1/PRIVATE/NTOS/IO/IOINIT.C:3168:    dcb->MinorVersion = (USHORT) NtBuildNumber;
./SOURCE1A.782_disc1/PRIVATE/NTOS/IO/IOINIT.C:3169:    dcb->MajorVersion = (USHORT) ((NtBuildNumber >> 28) & 0xfffffff);
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:91:ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xC0000000;
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:93:ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xF0000000;
./SOURCE1A.782_disc1/PRIVATE/NTOS/INIT/INIT.C:665:                 NtBuildNumber & 0xFFFF,
./SOURCE1A.782_disc1/PRIVATE/NTOS/KD/KDAPI.C:2384:    m->u.GetVersion.MinorVersion = (short)NtBuildNumber;
./SOURCE1A.782_disc1/PRIVATE/NTOS/KD/KDAPI.C:2385:    m->u.GetVersion.MajorVersion = (short)((NtBuildNumber >> 28) & 0xFFFFFFF);
./SOURCE1A.782_disc1/PRIVATE/NTOS/CONFIG/CMSYSINI.C:1602:        NtBuildNumber & 0xFFFF
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/ALPHA/DMPSTATE.C:132:            "\nMicrosoft Windows NT [0x%08x]\n", NtBuildNumber);
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/I386/DMPSTATE.C:153:            NtBuildNumber);
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/I386/DMPSTATE.C:219:                    NtBuildNumber & 0xFFFFFFF,
./SOURCE1A.782_disc1/PRIVATE/NTOS/KE/MIPS/DMPSTATE.C:388:           NtBuildNumber);

Use the –color=auto parameter to grep to allow color highlighting for grep output. A very attractive way to use grep. This makes the output faster to read.

Leave a Comment Cancel reply