{"id":4601,"date":"2017-04-08T07:05:36","date_gmt":"2017-04-08T07:05:36","guid":{"rendered":"https:\/\/www.rsoftsolution.com\/blog\/10-ways-to-use-grep-to-search-files-in-linux.html"},"modified":"2017-04-08T07:05:36","modified_gmt":"2017-04-08T07:05:36","slug":"10-ways-to-use-grep-to-search-files-in-linux","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/10-ways-to-use-grep-to-search-files-in-linux.html","title":{"rendered":"10 ways to use grep to hunt files in Linux"},"content":{"rendered":"
\"ss2.jpg\"<\/span>
<\/figure>\n

Windows hunt is not though certain charms, though when we need to find files or their contents, or hunt for specific complement information, a grep authority in Linux never ceases to dazzle me by a energy and versatility.<\/p>\n

There are mixed versions of grep; plain unchanging grep, egrep (extended grep) and fgrep (fixed prep). The latter dual have opposite methods for operative with characters and hunt strings. I’ll concentration on unchanging grep for a purpose of this article, that is dictated as a commencement educational for this accessible and arguable command.<\/p>\n

The syntax of grep is as follows:<\/p>\n

grep [options] settlement [files]<\/strong><\/p>\n

The options and patterns we can use with grep are sundry and diverse. Here are 10 examples to assistance whet your skills.<\/p>\n

1.\tSearch a record for a specific word<\/h2>\n

This is unequivocally one of a many facile uses for grep. Let’s contend we wish to check a essence of a \/var\/log\/secure record for any instances of a failure. we would type:<\/p>\n

grep disaster \/var\/log\/secure<\/strong><\/p>\n

This is an instance of what grep competence afterwards return:<\/p>\n

\n

Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8<\/p>\n

Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k<\/p>\n<\/blockquote>\n

Add a -i switch (e.g. grep -i) to control a box unresponsive search. In a instance above this would lapse a lowercase “failure,” uppercase “FAILURE” or any mixed thereof, such as “Failure.”.<\/p>\n

2.\tSearch a record for mixed words<\/h2>\n

This authority permits we to check for mixed difference in a record – note a use of a singular quotes, a backslash and a siren authority between them:<\/p>\n

grep ‘opened|closed’ \/var\/log\/secure<\/strong><\/p>\n

This is what grep competence return:<\/p>\n

\n

Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101<\/p>\n

Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1<\/p>\n

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n<\/blockquote>\n

3.\tGet an instance count<\/h2>\n

You competence not wish to indeed see a outlay of a grep authority though have it tell we how many matches your hunt found. This is achieved regulating a -c (count) switch:<\/p>\n

grep disaster \/var\/log\/secure -c<\/strong><\/p>\n

Grep will lapse a series like this:<\/p>\n

12<\/p>\n

You can do some crafty things with this switch. For instance, if we wish to know how many processors are in my complement we could type:<\/p>\n

grep -c processor \/proc\/cpuinfo<\/strong><\/p>\n

4.\tDisplay a line numbers of any match<\/h2>\n

It can be useful to know that line series your hunt formula seem on. To do so, supplement a -n (number) switch:<\/p>\n

grep -n disaster \/var\/log\/secure<\/strong><\/p>\n

Grep would afterwards lapse something like this: <\/p>\n

\n

1601:Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8<\/p>\n

1612:Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k<\/p>\n<\/blockquote>\n

5.\tReturn usually a specific series of matches<\/h2>\n

Let’s contend we wish to usually see a initial 5 hunt results. we can slight these down regulating a -m (maximum count) switch:<\/p>\n

grep -m5 disaster \/var\/log\/secure<\/strong><\/p>\n

Here’s an instance of a results:<\/p>\n

\n

Apr 4 06:45:29 smatteso-vm1 sshd[14836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=8boa5lv2rn8pso8<\/p>\n

Apr 4 06:45:31 smatteso-vm1 sshd[14844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=qualys-corp.lowell.litle.com user=13hr26mnm8wo4k<\/p>\n<\/blockquote>\n

Note there can't be a space between “-m” and your limit count value.<\/p>\n

6.\tDisplay all entries that are NOT a match.<\/h2>\n

There are some scenarios in that we competence wish to do a retreat hunt and uncover formula that do NOT compare your input. Just supplement a -v switch here. For instance, to see entries in a \/var\/log\/secure record that do not paint a word “failure” type:<\/p>\n

grep -v disaster \/var\/log\/secure<\/strong><\/p>\n

And afterwards we would get formula like this: <\/p>\n

\n

Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101<\/p>\n

Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1<\/p>\n

Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n<\/blockquote>\n

Of march we can mix strings such as -v and -n:<\/p>\n

grep -v -n disaster \/var\/log\/secure<\/strong><\/p>\n

Which would uncover we all a non-matching entries with their compared line numbers:<\/p>\n

\n

1:Apr 2 03:45:07 smatteso-vm1 sshd[16278]: Connection sealed by 10.1.7.101<\/p>\n

2:Apr 2 03:46:42 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n

3:Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1<\/p>\n

4:Apr 2 03:46:45 smatteso-vm1 su: pam_unix(su-l:session): event non-stop for user phxinst1 by (uid=0)<\/p>\n

5:Apr 2 03:46:48 smatteso-vm1 su: pam_unix(su-l:session): event sealed for user phxinst1<\/p>\n<\/blockquote>\n

7.\tSearch opposite mixed files<\/h2>\n

Grep can do most some-more than usually hunt a essence of a specific file. You can use what’s famous as a recursive hunt to cover whole directories, subdirectories, or a whole record complement and get formula arrangement any filename that contains your hunt value. <\/p>\n

This is achieved regulating a -r switch, that I’ll use to hunt for my user comment name in a \/etc directory:<\/p>\n

grep -r “smatteso” \/etc<\/strong><\/p>\n

Here’s an instance of a results:<\/p>\n

\n

\/etc\/hosts:10.1.52.237 smatteso-vm1.dwi.testdomain.com smatteso-vm1<\/p>\n

\/etc\/sysconfig\/network-scripts\/ifcfg-eth0:HOSTNAME=”smatteso-vm1″<\/p>\n

\/etc\/sysconfig\/rhn\/systemid:valuestringsmatteso-vm1.dwi.testdomain.com\/string\/value<\/p>\n

\/etc\/sysconfig\/network:HOSTNAME=smatteso-vm1<\/p>\n<\/blockquote>\n

You can hunt a whole record complement by changing that “\/etc” to “\/”:<\/p>\n

grep -r “smatteso” \/<\/strong><\/p>\n

(note this can be utterly a time-consuming operation!)<\/p>\n

8.\tDisplay usually a filenames that compare a search<\/h2>\n

I’m not a fan of clutter, so to get usually a list of filenames that compare my hunt (and not a essence of a files themselves) we can supplement a -l switch:<\/p>\n

grep -rl “smatteso” \/etc<\/strong><\/p>\n

Which would lapse formula like this:<\/p>\n

\n

\/etc\/hosts<\/p>\n

\/etc\/sysconfig\/network-scripts\/ifcfg-eth0<\/p>\n

\/etc\/sysconfig\/rhn\/systemid<\/p>\n

\/etc\/sysconfig\/network<\/p>\n<\/blockquote>\n

Just as discussed earlier, we can flip this to arrangement a filenames that do not enclose your hunt term(s), regulating a -L switch rather than -l:<\/p>\n

grep -rL “smatteso” \/etc<\/strong><\/p>\n

9.\tSearch for messages logged by date<\/strong><\/h2>\n

One generally useful component when regulating grep is to brush by record files acid for messages that were logged on a certain date. Say we wish to see all logged on Apr 5th:<\/p>\n

grep “Apr 5” \/var\/log\/messages<\/strong><\/p>\n

I would get formula like this:<\/p>\n

\n

Apr 5 00:00:01 smatteso-vm1 audispd: node=smatteso-vm1 type=USER_ACCT msg=audit(1491364801.741:135867): user pid=50149 uid=0 auid=4294967295 ses=4294967295 msg=’op=PAM:accounting acct=”phxinst1″ exe=”\/usr<\/p>\n

\/sbin\/crond” hostname=? addr=? terminal=cron res=success’<\/p>\n

Apr 5 00:00:01 smatteso-vm1 audispd: node=smatteso-vm1 type=USER_ACCT msg=audit(1491364801.741:135866): user pid=50143 uid=0 auid=4294967295 ses=4294967295<\/p>\n<\/blockquote>\n

This works for a specific timeframe too if we supplement that in, of course. To see usually a messages logged during 6 a.m. we can supplement “06:00” to a command:<\/p>\n

grep “Apr 5 06:00” \/var\/log\/messages<\/strong><\/p>\n

\n

Apr 5 06:00:01 smatteso-vm1 audispd: node=smatteso-vm1 type=USER_ACCT msg=audit(1491386401.774:143444): user pid=33946 uid=0 auid=4294967295 ses=4294967295 msg=’op=PAM:accounting acct=”phxinst1″ exe=”\/usr\/sbin\/crond” hostname=? addr=? terminal=cron res=success’<\/p>\n

Apr 5 06:00:01 smatteso-vm1 audispd: node=smatteso-vm1 type=USER_ACCT msg=audit(1491386401.774:143445): user pid=33945 uid=0 auid=4294967295 ses=4294967295 msg=’op=PAM:accounting acct=”phxinst1″ exe=”\/usr\/sbin\/crond” hostname=? addr=? terminal=cron res=success’<\/p>\n<\/blockquote>\n

10.\tUse grep with other commands<\/h2>\n

Grep can be used with any other authority we like. Let’s contend we wish to find any record files containing a word spice. we can use a find authority and siren a formula to grep as follows:<\/p>\n

find . -name “*.log” | grep -i spice<\/strong><\/p>\n

Here’s an instance of a results:<\/p>\n

.\/spice-vdagent.log<\/p>\n

The story file, that contains a list of recently-typed commands, is one of a best elements of Linux. It’s also probable to grep a story record for specific terms (for example, “pam_tally2”) to see when they were final used and what a suitable syntax is:<\/p>\n

history | grep pam_tally2<\/strong><\/p>\n

\n

324 2017-04-06 13:50:25 pam_tally2<\/p>\n

325 2017-04-06 13:50:29 pam_tally2 -u smatteso -r<\/p>\n

350 2017-04-06 14:05:44 story | grep pam_tally2<\/p>\n<\/blockquote>\n

You can use grep with “netstat” to demeanour during listening ports, contend pier 22 for instance:<\/p>\n

netstat -anp | grep 22<\/strong><\/p>\n

\n

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2154\/sshd<\/p>\n

tcp 0 0 10.1.52.237:22 10.1.13.63:51704 ESTABLISHED 40441\/sshd<\/p>\n

tcp 0 32 10.1.52.237:22 10.1.13.63:51701 ESTABLISHED 40434\/sshd<\/p>\n

tcp 0 0 :::22 :::* LISTEN 2154\/sshd<\/p>\n<\/blockquote>\n

You can also demeanour for a specific routine identifier. In this instance I’ll check to see if any processes called “spice” are running:<\/p>\n

ps -aux | grep spice<\/strong><\/p>\n

\n

root 2179 0.0 0.0 15900 1076 ? Ss Mar31 0:00 \/usr\/sbin\/spice-vdagentd<\/p>\n

root 2855 0.0 0.0 103328 888 pts\/0 S+ 12:41 0:00 grep spice<\/p>\n

gdm 5430 0.0 0.0 34488 1604 ? Ss Mar31 0:00 \/usr\/bin\/spice-vdagent<\/p>\n<\/blockquote>\n

This is usually a simple tip of a iceberg representing a capabilities of grep. In a follow-up essay I’ll plead some some-more modernized methods for regulating a authority to get even some-more useful and granular results.<\/p>\n

To learn some-more about grep, use a authority “man grep” or “grep \u2014help.” You can also download a chronicle of grep for Windows<\/a>.<\/p>\n

Also see<\/strong><\/p>\n

How to giveaway hoop space on Linux systems<\/a>
How to resize a practical Red Hat Enterprise Linux partition<\/a>
How to supplement chronicle control for your Linux \/etc directory<\/a>
How to use a ramdisk on Linux<\/a><\/p>\n

Article source: http:\/\/www.techrepublic.com\/article\/10-ways-to-use-grep-to-search-files-in-linux\/#ftag=RSS56d97e7<\/p>","protected":false},"excerpt":{"rendered":"

Windows hunt is not though certain charms, though when we need to find files or their contents, or hunt for specific complement information, a grep authority in Linux never ceases <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-4601","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t