What is a linux command to find files containing some strings but not another?

Question

I'm trying to search a lot of .xml files for certain strings but not other strings and I'm having trouble putting a command together to do it. I only want it to list the file names that match the inclusion/exclusion criteria. I've been trying:

find . -name *.xml -exec grep -li "string1\|string2" {} \; | xargs grep -Li "string3\|string4"

But I'm having trouble because the file names that are returned from the find have spaces in their names and the second grep breaks them all into little chunks and of course doesn't find such files. I've tried adding -0 to the xargs and it removes the errors but it says "File name too long" and only executes the first grep.

Please let me know how to tweak this command to have it work properly on files with spaces in the names.

Thanks in advance

Answer 1

There's more than one way to do it. This should keep the total number of processes executed to a minimum:

find . -name \*.xml -print0          \   # List of *.xml files (NUL-terminated)
  | xargs -0 grep -Zli 'string[12]'  \   # is input to first grep, which sends (NUL-term'd)
  | xargs -0 grep -Li  'string[34]'      # file list to second grep

Thanks Matt Gibson for reminding us of the -Z flag to GNU grep.

Answer 2

You can do it all in one find which avoids all the problems with spaces in filenames. Something like

find . -exec grep -liq "string1\|string2" {} \; -not -exec grep -liq "string3\|string4" {} \; -print

The "-q" suppresses all grep output. The -exec primary returns true when the process exits with 0 status, as grep does when it finds a match, and the -not primary reverses that. So we directly place two conditions on the find, and as a result we only print the filenames that satisfy both -- no pipe required!

Answer 3

As mentioned in my comment, I think all you're missing is the -Z flag on the first grep to go along with the -0 that you were trying on your xargs:

find . -name "*.xml" -exec grep -liZ "string1\|string2" {} \; | xargs -0 grep -Li "string3\|string4"

Answer 4

If the limiting factor is CPU (i.e. your disk is fast) and you have more CPU cores, you can use GNU Parallel:

find . -type f| parallel grep -Lq foo {} '||' grep -l bar {}

By running the two greps immediately after eachother chances are that the files are still in the disk cache. If the disk seeks are slow, you can add -j1 to disable the parallelism.

Watch the intro video to learn more: http://www.youtube.com/watch?v=OpaiGYxkSuQ