• The case study below talks about using recursive searches to locate someone's "lost" e-mail.
• Another very important use is for finding unresolved externals in a large source tree, or under /usr/include or similar, but see also my find-sym program.
• Another interesting possibility is to use a binary-capable grep like GNU grep to do a recursive search of programs under /bin, /usr/bin, etc. to locate the program that is outputting an error message, when it isn't clear where that error message is coming from. However, with *ix's increasing localization features, where a list of messages from a program are stored in separate files in a large number of languages, the usefulness of this method is decreasing.

• Using "locating lost e-mail" as a sort of case study:
  1. Using GNU grep (disadvantage: May get stuck on named pipes. But the obvious advantage is convenience: there's simply less to type) :
     • cd ~username
     • grep -iRl '^Subject:.*unique subject'
  2. Using a traditional grep with traditional xargs (GNU grep and GNU xargs should traditional usage as well):
     • cd ~username
     • find . -type f -print | xargs grep -il '^Subject:.*unique subject'
  3. Using GNU find and xargs to contend with filenames containing whitespace:
     • cd ~username
     • find . -type f -print0 | xargs -0 grep -il '^Subject:.*unique subject'
  4. Using agrep to conduct a fuzzy search with traditional find and xargs syntax:
     • cd ~username
     • find . -type f -print | xargs agrep -2 -il '^Subject:.*unique subject'
  5. Using a traditional find and xargs to search a user's home directory, except for their ~/src and ~/bin directories:
     • find . -name bin -prune -o -name src -prune -o -type f -print | xargs egrep -il '^From:.*unique sender'
• Using changing a hostname and/or IP address as an example. I'll be assuming you want to change hostname old1.old2.co.com and IP address 128.200.34.3 with a netmask of 255.255.255.0. If you follow what's happening, you'll most likely be able to do this for different kinds of changes too by changing what you search for slightly:
  1. First, fix the hostname:
     • vi `find /etc -type f -print | xargs grep -il old1\.old2\.co\.com`
     • ...and go through and change the occurrences of old1.old2.co.com to new2.new2.co.com. You can use :n to go to the next file
  2. Second, fix the ip address and/or routes:
     • vi `find /etc -type f -print | xargs grep -il '128\.200\.34\.'`
     • ...and go through and change occurrences of your old IP address to your new one Again, you can use :n to go to the next file
  3. Note on *ix's this is known to work on, and known not to work on:
     • Won't work: AIX, because it stores this information in a database called the "ODM", rather than using the traditional flat files under /etc. The ODM is a bit like "the registry" on windows.
     • Will work: Just about any *ix that uses traditional flat files for these things under /etc, including Solaris, Linux, IRIX and Tru64, and probably just about all of the others
• Getting feedback on how long your recursive grep is going to take.
  • Traditional find+xargs when you know the number of files isn't huge:
    • find . -type f -print | count -b | xargs egrep -il pattern > /tmp/results
  • Traditional find+xargs when you know the number of files is quite large:
    • find . -type f -print | count -e $(find . -type f -print | wc -l) | xargs egrep -il pattern > /tmp/results
  • GNU find+xargs, when you know some of your filenames will have whitespace in them:
    • find . -type f -print0 | reblock -p -e $(expr $(find . -type f -print | wc -c) / 1024) $(expr 1024 \* 1024) | xargs -0 egrep -il pattern > /tmp/results
    • Actually, this method could be used with traditional find+xargs too, for a bit of a performance boost on huge numbers of files.

You can e-mail the author with questions or comments: