Command library / grep

Search text for lines that match a pattern

Prints the lines of a file (or of piped input) that match a pattern. It is the analyst's workhorse for logs: filter first, then count, sort or investigate. Quote patterns that contain spaces or special characters, otherwise the shell splits them into separate arguments.

Usage

Options and flags

• pattern

  text or regular expression to look for

• file

  file or directory to search (omit to read piped input)

• -i

  ignore upper/lower case

• -v

  invert: show lines that do NOT match

• -n

  show line numbers

• -c

  print only the number of matching lines

• -r, -R

  search directories recursively

• -E

  extended regular expressions (|, +, ?, ())

• -w

  match whole words only

• -l

  list only the names of files that contain a match

• -o

  print only the matching part of each line

• -F

  treat the pattern as a fixed string, not a regex

• -A NUM

  also print NUM lines After each match

• -B NUM

  also print NUM lines Before each match

• -C NUM

  also print NUM lines of Context around each match

Examples

• grep 'Failed password' /var/log/auth.log

  Every failed SSH login attempt.

• grep -i error app.log

  'error', 'Error' and 'ERROR' all match.

• grep -c 'Failed password' /var/log/auth.log

  Just the count of failed logins.

• grep -rn password /var/www

  Hunt hard-coded passwords, with file and line number.

• grep -v '^#' /etc/ssh/sshd_config

  The config without comment lines.

Common mistakes

Related commands