10 ways to use grep to hunt files in Linux

Windows hunt is not though certain charms, though when we need to find files or their contents, or hunt for specific complement information, a grep authority in Linux never ceases to dazzle me by a energy and versatility.

There are mixed versions of grep; plain unchanging grep, egrep (extended grep) and fgrep (fixed prep). The latter dual have opposite methods for operative with characters and hunt strings. I’ll concentration on unchanging grep for a purpose of this article, that is dictated as a commencement educational for this accessible and arguable command.

The syntax of grep is as follows:

grep [options] settlement [files]

The options and patterns we can use with grep are sundry and diverse. Here are 10 examples to assistance whet your skills.

1. Search a record for a specific word

This is unequivocally one of a many facile uses for grep. Let’s contend we wish to check a essence of a /var/log/secure record for any instances of a failure. we would type:

grep disaster /var/log/secure

This is an instance of what grep competence afterwards return:

Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8

Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k

Add a -i switch (e.g. grep -i) to control a box unresponsive search. In a instance above this would lapse a lowercase “failure,” uppercase “FAILURE” or any mixed thereof, such as “Failure.”.

2. Search a record for mixed words

This authority permits we to check for mixed difference in a record – note a use of a singular quotes, a backslash and a siren authority between them:

grep ‘opened|closed’ /var/log/secure

This is what grep competence return:

Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101

Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

3. Get an instance count

You competence not wish to indeed see a outlay of a grep authority though have it tell we how many matches your hunt found. This is achieved regulating a -c (count) switch:

grep disaster /var/log/secure -c

Grep will lapse a series like this:

12

You can do some crafty things with this switch. For instance, if we wish to know how many processors are in my complement we could type:

grep -c processor /proc/cpuinfo

4. Display a line numbers of any match

It can be useful to know that line series your hunt formula seem on. To do so, supplement a -n (number) switch:

grep -n disaster /var/log/secure

Grep would afterwards lapse something like this:

1601:Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8

1612:Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k

5. Return usually a specific series of matches

Let’s contend we wish to usually see a initial 5 hunt results. we can slight these down regulating a -m (maximum count) switch:

grep -m5 disaster /var/log/secure

Here’s an instance of a results:

Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8

Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k

Note there can't be a space between “-m” and your limit count value.

6. Display all entries that are NOT a match.

There are some scenarios in that we competence wish to do a retreat hunt and uncover formula that do NOT compare your input. Just supplement a -v switch here. For instance, to see entries in a /var/log/secure record that do not paint a word “failure” type:

grep -v disaster /var/log/secure

And afterwards we would get formula like this:

Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101

Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

Of march we can mix strings such as -v and -n:

grep -v -n disaster /var/log/secure

Which would uncover we all a non-matching entries with their compared line numbers:

1:Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101

2:Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

3:Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1

4:Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)

5:Apr 2 03:46:48 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1

7. Search opposite mixed files

Grep can do most some-more than usually hunt a essence of a specific file. You can use what’s famous as a recursive hunt to cover whole directories, subdirectories, or a whole record complement and get formula arrangement any filename that contains your hunt value.

This is achieved regulating a -r switch, that I’ll use to hunt for my user comment name in a /etc directory:

grep -r “smatteso” /etc

Here’s an instance of a results:

/etc/hosts:10.1.52.237 smatteso-vm1.dwi.testdomain.com smatteso-vm1

/etc/sysconfig/network-scripts/ifcfg-eth0:HOSTNAME=”smatteso-vm1″

/etc/sysconfig/rhn/systemid:valuestringsmatteso-vm1.dwi.testdomain.com/string/value

/etc/sysconfig/network:HOSTNAME=smatteso-vm1

You can hunt a whole record complement by changing that “/etc” to “/”:

grep -r “smatteso” /

(note this can be utterly a time-consuming operation!)

8. Display usually a filenames that compare a search

I’m not a fan of clutter, so to get usually a list of filenames that compare my hunt (and not a essence of a files themselves) we can supplement a -l switch:

grep -rl “smatteso” /etc

Which would lapse formula like this:

/etc/hosts

/etc/sysconfig/network-scripts/ifcfg-eth0

/etc/sysconfig/rhn/systemid

/etc/sysconfig/network

Just as discussed earlier, we can flip this to arrangement a filenames that do not enclose your hunt term(s), regulating a -L switch rather than -l:

grep -rL “smatteso” /etc

9. Search for messages logged by date