The grep command

print lines that match patterns 53 examples from the lessons of the IVski Linux Playground — try them in the terminal next to them.

Options in the examples

-E, --extended-regexp
Interpret PATTERNS as extended regular expressions (EREs, see below).
-i, --ignore-case
Ignore case distinctions in patterns and input data, so that characters that differ only in case match each other.
-r, --recursive
Read all files under each directory, recursively, following symbolic links only if they are on the command line.
-v, --invert-match
Invert the sense of matching, to select non-matching lines.
-c, --count
Suppress normal output; instead print a count of matching lines for each input file.
-l, --files-with-matches
Suppress normal output; instead print the name of each input file from which output would normally have been printed.
-A NUM, --after-context=NUM
Print NUM lines of trailing context after matching lines.
-B NUM, --before-context=NUM
Print NUM lines of leading context before matching lines.
-C NUM, -NUM, --context=NUM
Print NUM lines of output context. Places a line containing a group separator (--) between contiguous groups of matches.
-n, --line-number
Prefix each line of output with the 1-based line number within its input file.
-P, --perl-regexp
Interpret PATTERNS as Perl-compatible regular expressions (PCREs).
-w, --word-regexp
Select only those lines containing matches that form whole words.

Examples

grep 'student' /etc/passwd
grep 'error' /var/log/syslog
grep -i 'Error' file.txt

Case-insensitive

grep -n 'word' file.txt

Show line numbers

grep -c 'word' file.txt

Count matching lines

grep -v 'word' file.txt

Invert: lines that DON'T match

grep -l 'word' *.txt

List files that match

grep -r 'word' directory/

Recursive search

grep -w 'word' file.txt

Match whole words only

grep -A 3 'error' file.txt

3 lines After match

grep -B 3 'error' file.txt

3 lines Before match

grep -C 3 'error' file.txt

3 lines Context (both)

grep '^root' /etc/passwd

Lines starting with 'root'

grep 'bash$' /etc/passwd

Lines ending with 'bash'

grep '[0-9]' file.txt

Lines containing digits

grep -E 'cat|dog' file.txt

Extended regex: OR

ps aux | grep nginx
history | grep ssh
ls -la | grep '.txt'

List only .txt files

cat /etc/passwd | grep '/bin/bash'

Find bash users

ps aux | grep nginx | wc -l

Count nginx processes

ps aux | grep -v grep | grep python
grep -r "$1" .
history | grep apt
grep 'pattern' file

Basic regex

grep -E 'pattern' file

Extended regex

grep -P 'pattern' file

Perl-compatible regex

grep '^[A-Z]' file

Lines starting with uppercase

grep '[0-9]\{3\}-[0-9]\{4\}' file

Phone numbers

grep -E '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' emails.txt
grep -E '\b[0-9]{1,3}(\.[0-9]{1,3}){3}\b' file.txt
grep -E '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]+' file.txt
grep -E '^.{5}$' file.txt
apt list --installed | grep nginx
dpkg -l | grep nginx
dpkg -l | grep python
sudo ss -tlnp | grep :80
grep -i bot /var/log/nginx/access.log
curl -s http://app.test | grep '<p>'

What do visitors see?

ps aux | grep -v grep | grep <name>
cat /etc/passwd | grep -E '/bin/(bash|sh)$'

Users with shell access

cat /etc/passwd | grep ana
journalctl -u sshd | grep -i fail

Filter for failure mentions

grep CRON /var/log/syslog

The same story in the classic syslog

grep -r "sk_live_" /var/log/app

Which files, which lines?

grep -c "sk_live_" /var/log/app/app.log

How many times in one file?

grep -rl "sk_live_" /var/log/app

Just the file names

tar -tzf /backups/FILE.tar.gz | grep website

Narrow it down

curl -s http://localhost | grep -i title

What does the server answer?

journalctl -u sshd | grep maria

What does the server say?

sudo grep maria /var/log/auth.log

The same in the classic auth log

sudo lsof | grep deleted

The same, the long way

ps aux | grep trace

The process behind it

Lessons that use grep

Related commands