Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been using grep to run a few PII scans and while it's finding results, it's indeed finding too many false positives.

Is there a way that I can tell grep not to trigger a match for a file unless it contains other data?

For instance, can I tell it not to trigger an alert on a regex for a SSN unless the file includes text like "ssn" or "social security number" somewhere else in the file?

share|improve this question

2 Answers 2

up vote 1 down vote accepted
grep -lZ ssn files_to_search | xargs -0 grep what_to_search_for
share|improve this answer

Sure, just pipe the first output to another grep. Grep for foo and then grep for bar, so your output will only be lines that have both foo AND bar.

grep SSN filename.txt | grep -e "ssn|social security number"

This only hits on uppercase SSN, then passes any lines with either sss OR social security number. lower case. Add -i for any case. If you reall want both SSN and ssn try this;

grep -i SSN filename.txt | grep social.security.number

Another one I like is to only shows lines that don't have bar. Do Grep for foo then grep -v bar. Only lines with foo, that also do not have bar. Using GNU grep 2.5.4 in windows

share|improve this answer
    
The OP said "somewhere else in the file" not "on the same line". –  Dennis Williamson Mar 17 '10 at 18:17
    
how far away? You can set 10 lines before and 3 lines after, or on a file by file basis. Grep lets you set a window around the mask. What do you need? –  RedBarn Mar 17 '10 at 18:22
    
Pretty much anywhere in the file. –  tearman Mar 17 '10 at 19:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.