Grep not honoring --exclude-dir

Solution 1:

I think it's probably because you're explicitly asking grep to search recursively from /var, and /var/run does not match a SUBDIRECTORY under /var.

See grep man page, which states:

--exclude-dir=glob
    [..] skip any subdirectory whose base name matches glob.  [..]

FIX

Therefore, to fix your command, change the exclude pattern, i.e.:

sudo grep -IR --exclude-dir="run" '45.78.157.165' /var | egrep -v '(audit|access)'