The grep command in Linux is a powerful text-search utility that scans files or input streams for lines matching a specified pattern using regular expressions. Short for “Global Regular Expression Print,” grep is indispensable for filtering logs, analyzing code, and extracting specific data.
Basic Text Search
grep "error" logfile.txt
Searches for the word “error” in logfile.txt and prints matching lines.
Case-Insensitive Search
grep -i "warning" logfile.txt-iignores case, matching “Warning”, “WARNING”, etc.
Recursive Search in Directories
grep -r "TODO" /path/to/project-rsearches recursively through all files in the directory.
Display Line Numbers
grep -n "404" access.log-nshows line numbers for matches (e.g.,42:404 Not Found).
5. Highlight Matches
grep --color=auto "success" output.log
Highlights the matched text in color for easier visibility.
Count Matching Lines
grep -c "GET" access.log-creturns the number of lines containing “GET”.
Invert Match (Exclude Lines)
grep -v "debug" app.log-vprints lines not containing “debug”.
8. Search for Whole Words
grep -w "port" config.txt-wmatches “port” as a whole word (ignores substrings like “export”).
Pipe Input from Another Command
cat access.log | grep "POST"
Filters the output of cat to show lines with “POST”.
Use Regular Expressions (Email Pattern)
grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,6}" users.txt-Eenables extended regex to match email addresses.
Search Multiple Files with Wildcards
grep "panic" *.log
Searches for “panic” in all .log files in the current directory.
Combine with find for Advanced Searches
find /var/log -type f -name "*.log" -exec grep "failed" {} \;
Searches for “failed” in all .log files under /var/log.
Search Compressed Files
zgrep "error" /var/log/syslog.1.gz
Searches inside gzipped files without decompressing them.
Display Context Around Matches
grep -C3 "crash" app.log-C3shows 3 lines before and after the matching line.- Use
-B(before) or-A(after) for one-directional context.
Extended Grep (egrep) for Multiple Patterns
egrep "error|warning|critical" system.log
Matches lines containing “error”, “warning”, or “critical”.
Search for a String in Command Output
ps aux | grep "firefox"Filters processes to show only those related to firefox.
Key Notes:
- Regular Expressions: Use
grep -Eoregrepfor advanced patterns. - Performance: Avoid
grepon huge files—use tools likelessorawkinstead. - Exclude Directories: Add
--exclude-dir=.gitto skip specific folders in recursive searches.