search multiple files for a string on AIX

Question

I was trying to search multiple files for a string like this. Using AIX if this matters.

grep -r "gap" /u/user/.History/
/u/user/.History/server/user:
/u/user/.History/server/user:

This mostly worked except when files have strange characters listing the file name but not showing the match. So I added the string command like this. None of these methods worked. None of these commands give any output at all. It is acting like there are no matches even though I know there are.

strings /u/user/.History | grep gap
strings /u/user/.History/* | grep gap
cat /u/user/* | strings | grep gap
cat /u/user/.History/* | strings | grep gap
cat /u/user/.History/ | strings | grep gap

When I grepped on a single file with strings it gave this output. It just will not work when I do it on multiple files.

>strings /u/user/.History/server/user | grep gap
cd gap #▒#1612466141#▒#
gzip -cd gap2021-01-28.log.gz #▒#1612466384#▒#

• Jeff Schaller: What's your desired output? The list of matching filenames?
• cokedude: @JeffSchaller any match of the string gap.
• cokedude: @JeffSchaller added more output information.
• Seamus: Perhaps have a look at this Q&A. Could be that AIX uses a different version of grep?

Answer 1

I believe your grep -r "gap" /u/user/.History/ command was actually finding the right files and displaying the matching lines; it's just that those lines also have non-printable portions that are obscuring the text when the line is written to your terminal.

My recommendation would be to filter the output so that it expands the non-printable portions into printable characters so that you can see the underlying text.

grep -r "gap" /u/user/.History/ | cat -v

or

find /u/user/.History/ -type f -exec grep gap {} + | cat -v

Would do the job. The cat -v command "displays nonprinting characters as visible characters..."

I created some test files to demonstrate the difference:

$ grep -r gap .
./user1/.History/server/user:
./user2/user:gap

compared to:

$ grep -r gap . | cat -v
./user1/.History/server/user:gap^?^?^?
./user2/user:gap

Where the ^?^?^? characters represent three "delete" characters. When printed as-is, those delete characters hide the three-character "gap" string.

Another option would be to pipe the output through od, perhaps ... | od -c.

• cokedude: Are you using AIX? It doesn't seem to working. I am using an ancient version of AIX. grep -r "gap" /u/user/.History/ | cat -v /u/user/.History/server/user: /u/user/.History/server/user: find /u/user/.History/ -type f -exec grep gap {} + | cat -v /u/user/.History/server/user: /u/user/.History/server/user:
• Jeff Schaller: I did test this on an AIX system, yes. I had to "fake" some non-printable characters to try and reproduce your situation, so maybe we have different data. Could you post a sanitized (and perhaps uuencoded?) sample file for us to test against?
• cokedude: How would I post a sanitized file? I thought I did it above with this data: >strings /u/user/.History/server/user | grep gap cd gap #▒#1612466141#▒# gzip -cd gap2021-01-28.log.gz #▒#1612466384#▒#
• Jeff Schaller: I mean review a sample matching file for any private data, then pipe it to some kind of 7-bit-safe encoding like uuencode or od. The #▒#1612466141#▒# characters are a translation of the actual 8-bit character that's actually there.
• cokedude: So od filename? Don't ever use od.

Answer 2

I found a couple of ways to do this.

strings /u/user/.History/*/* | grep gap

With find.

find /u/user -xdev -type f -exec strings {} + | grep gap
find /u/user -xdev -type f -exec strings {} \; | grep gap