11

I'm having trouble searching in /var due to a hang at /var/run. I tried to exclude /var/run, but its not producing expected results:

$ sudo grep -IR --exclude-dir="/var/run" '45.78.157.165' /var | egrep -v '(audit|access)'
/var/log/secure:Jun 21 14:08:34 cryptopp sshd[19729]: error: Received disconnect from 199.91.135.157: 3: com.jcraft.jsch.JSchException: reject HostKey: 45.78.157.165 [preauth]
/var/log/secure-20160626:Jun 21 14:08:34 cryptopp sshd[19729]: error: Received disconnect from 199.91.135.157: 3: com.jcraft.jsch.JSchException: reject HostKey: 45.78.157.165 [preauth]
/var/log/secure-20160626:Jun 21 14:08:34 cryptopp sshd[19729]: error: Received disconnect from 199.91.135.157: 3: com.jcraft.jsch.JSchException: reject HostKey: 45.78.157.165 [preauth]
grep: /var/run/saslauthd/mux: No such device or address
grep: /var/run/dbus/system_bus_socket: No such device or address
grep: /var/run/rpcbind.sock: No such device or address
grep: /var/run/udev/control: No such device or address

I've tried both -exclude-dir=/var/run and -exclude-dir="/var/run". Both produce the same results.

Why is my grep failing?

How do I exclude /var/run from a recursive grep?


CentOS 7.2, with Grep:

$ grep --version
grep (GNU grep) 2.20
Copyright (C) 2014 Free Software Foundation, Inc.
  • 1
    Did you try it with just --exclude-dir=/var/run without the quotes? – JakeGould Jul 2 '16 at 18:53
  • @JakeGould - yes; both with and without. Let me get that added to the question. – jww Jul 2 '16 at 18:55
  • @JakeGould It makes no difference: the grep process doesn't see the quotes in either case. Bash expands them, and there is no substitution to be performed, so they are simply removed. This is the case for all shells that I know of. – wchargin Jul 3 '16 at 3:50
17

I think it's probably because you're explicitly asking grep to search recursively from /var, and /var/run does not match a SUBDIRECTORY under /var.

See grep man page, which states:

--exclude-dir=glob
    [..] skip any subdirectory whose base name matches glob.  [..]

FIX

Therefore, to fix your command, change the exclude pattern, i.e.:

sudo grep -IR --exclude-dir="run" '45.78.157.165' /var | egrep -v '(audit|access)'
  • I have a similar question to this. How would you change grep -r --exclude-dir=./root/js sometext . to exclude a subfolder from current location? – psynnott Jul 4 '16 at 11:25
  • 3
    Not sure the /s do anything. grep goes into each folder and begins the search at that point. It is effectively always searching the current folder. If you want to exclude a sub-folder (e.g. /home/me/dev/project1/js) and you're searching from many folders up (e.g. starting at /home/me), then you need to specify the one base folder name you want to exclude (e.g. --exclude-dir=js). Unfortunately, this will also exclude ANY sub-folder of the same name, elsewhere in the hierarchy. If you want something with more control, you can try to look at using find with grep. – jehad Jul 5 '16 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.