grep and find: Searching Like a Pro

In one line

grep searches INSIDE files for matching text; find searches the FILESYSTEM for matching files — two different kinds of search that together cover almost everything you'll ever need to locate.

0/4 · 0%

Think of it like this

Real-life example: grep is like scanning every page of a book for a specific word; find is like scanning a library's shelves for books matching certain criteria (title, author, size) without opening a single one. Different questions, different tools.

Key ideas

01
grep "pattern" file.txt prints every LINE in the file containing that pattern. grep -i makes the search case-insensitive, grep -r searches recursively through an entire directory tree, grep -n shows line numbers, and grep -v INVERTS the match — showing only lines that DON'T contain the pattern.
02
grep -E (or egrep) enables extended regular expressions — real pattern matching beyond a literal string, like grep -E "error|fail" matching lines containing EITHER word. Regex is a deep topic on its own; knowing grep accepts it, and a handful of basics (., *, |, ^, $), covers most real use.
03
find <path> -name "*.log" searches a directory tree for files matching a name pattern. find <path> -type f finds only regular files, -type d only directories. find <path> -mtime -1 finds files modified in the last day — genuinely useful for 'what changed recently' investigations.
04
find can EXECUTE a command on every match: find . -name "*.tmp" -delete removes every matching file directly, and find . -name "*.log" -exec grep -l ERROR {} \; runs grep against every matching file, printing the names of ones that contain 'ERROR' — a genuinely powerful combination worth knowing exists, even if the exact syntax needs a lookup each time.
05
grep and find combine naturally: find . -name "*.log" | xargs grep -l ERROR pipes find's file list into xargs, which then runs grep against each one — xargs is the tool that turns a LIST of things (piped in as text) into ARGUMENTS for another command.

In your stack

→
A very common real Java debugging move: grep -rn "NullPointerException" /var/log/myapp/ — recursively search every log file in a directory for a specific exception, with line numbers, to quickly find every occurrence across potentially dozens of rotated log files.

Code & diagrams

grep-and-find.shmarkdown

Try these against real directories on your machine — /etc is a safe, read-only playground.

# grep: search INSIDE files
grep -i "root" /etc/passwd
grep -n "bash" /etc/passwd
grep -v "nologin" /etc/passwd | head -5

# find: search for FILES matching criteria
find /etc -name "*.conf" -type f | head -10
find /etc -type d -name "ssh*"

# Combine them: find files, then search inside each
find /etc -name "*.conf" | xargs grep -l "root" 2>/dev/null | head -5

# find can act directly on matches
find /tmp -name "*.tmp" -type f
# find /tmp -name "*.tmp" -delete   # (destructive — only run when you mean it)

Explain it without notes

You need to know which files in a project were modified in the last 24 hours. Is that a job for grep or find, and why?

Why would you ever pipe find's output into xargs instead of just using find's own -exec flag?

Practice

Use find to locate every file larger than 10MB somewhere on your system (find / -size +10M -type f 2>/dev/null — the 2>/dev/null hides permission-denied noise from directories you can't read).

Use grep -rn to search an entire project directory for a specific function or variable name and count how many files reference it.

Trade-offs

↔
grep and find are fast and universally available on every Linux system with zero setup, but for genuinely large-scale code search across a big repository, purpose-built tools (ripgrep/rg, an IDE's own search) are meaningfully faster — worth knowing plain grep/find work everywhere as a reliable fallback, even after you've adopted faster specialized tools day to day.

Done when you can

I know grep searches file contents and find searches the filesystem for matching files.
I can use grep with -i, -r, -n, and -v confidently.
I can build a find command that filters by name, type, or modification time.

Command Palette