I've been using grep to run a few PII scans and while it's finding results, it's indeed finding too many false positives.

Is there a way that I can tell grep not to trigger a match for a file unless it contains other data?

For instance, can I tell it not to trigger an alert on a regex for a SSN unless the file includes text like "ssn" or "social security number" somewhere else in the file?

grep -lZ ssn files_to_search | xargs -0 grep what_to_search_for

Sure, just pipe the first output to another grep. Grep for foo and then grep for bar, so your output will only be lines that have both foo AND bar.

grep SSN filename.txt | grep -e "ssn|social security number"

This only hits on uppercase SSN, then passes any lines with either sss OR social security number. lower case. Add -i for any case. If you reall want both SSN and ssn try this;

grep -i SSN filename.txt | grep social.security.number

Another one I like is to only shows lines that don't have bar. Do Grep for foo then grep -v bar. Only lines with foo, that also do not have bar. Using GNU grep 2.5.4 in windows

  • The OP said "somewhere else in the file" not "on the same line". – Dennis Williamson Mar 17 '10 at 18:17
  • how far away? You can set 10 lines before and 3 lines after, or on a file by file basis. Grep lets you set a window around the mask. What do you need? – RedBarn Mar 17 '10 at 18:22
  • Pretty much anywhere in the file. – tearman Mar 17 '10 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.