Sometimes you may need to find a file, containing the specific text or find a line which specific words in a specific file. Linux has several utilities for this purpose, but the most popular is called grep. It allows to search not only strings in files but also filter output of commands and much more.
In this article we will examine what grep command is in Linux, delve into the syntax and possible options of grep, and look at a few examples of using this command.
Table of Contents
What is Grep?
The name of this command stands for "search globally for lines matching the regular expression, and print them". It is one of the most in-demand commands in the Linux terminal and is part of GNU project. Before the GNU project was created, there was a precursor utility named grep too, which was developed in 1973 by Ken Thompson for searching files by content in Unix. Later, a free utility with the same functionality was developed within the GNU project.
The command has pretty much possibilities for text filtering. You can select necessary lines from text files, filter output of other commands, and even search for files in the filesystem, which contain specific words. The utility is very popular because it is pre-installed in almost all distributions.
Grep Syntax and Options
The grep command has the following syntax:
$ grep [options] pattern [/path/to/the/file/or/directory]
Or:
$ command | grep [options] pattern
Here:
- Options are additional parameters that specify various search and output settings, such as the number of lines or inversion mode.
- Pattern is a regular expression or string that the search will be performed on.
- /path/to/the/file/or/directory are the locations where the search will be performed. As you will see later, grep allows searching in multiple files and even in a directory using recursive mode.
The ability to filter standard output can be helpful when you need to select only lines with errors from logs or filter only the necessary information from the output of some other command.
Options
Let's have a look at the most used options of the command which can help you to search text in files more efficiently:
- -E, --extended-regexp - enable extended regular expression mode (ERE);
- -F, --fixed-strings - use the search pattern as a string, not a regular expression;
- -G, --basic-regexp - interpret the search pattern as a basic regular expression (BRE);
- -P, --perl-regexp - interpret the search pattern as a Perl regular expression;
- -e, --regexp - an alternative way to specify the search pattern, the option can be used multiple times, which allows specifying multiple patterns for searching files containing one of them;
- -f, --file - read the search pattern from a file;
- -i, --ignore-case - ignore character case;
- -v, --invert-match - display only those lines in which not match with search pattern;
- -w, --word-regexp - search for the pattern as a word separated by spaces or other punctuation marks;
- -x, --line-regexp - search for the pattern as an entire line, from the beginning to the newline character;
- -c - display the number of lines found;
- --color - enable color mode, available values: never, always, and auto;
- -L, --files-without-match - display only file names, all files where the search is performed will be displayed;
- -l, --files-with-match - similar to the previous one, but only files with at least one match will be displayed;
- -m, --max-count - stop the search after the specified number of lines is found;
- -o, --only-matching - display only the matching part, instead of displaying the entire line;
- -h, --no-filename - do not display the file name;
- -q, --quiet - do not display anything;
- -s, --no-messages - do not display file reading errors;
- -A, --after-content - show the match and n lines after it;
- -B, --before-content - show the match and n lines after it;
- -C - show n lines before and after the match;
- -a, --text - process binary files as text;
- --exclude - skip files which names matching the specified regular expression;
- --exclude-dir - skip all files in the specified directory;
- -I - skip binary files;
- --include - search only in files which names matching the regular expression;
- -r - recursive search in the specified directory through all subfolders;
- -R - recursive search including links.
We have covered all the most basic options and even more, now let's move on to examples of using the grep command in Linux.
Examples of using Grep
Let's move on to practice. First of all, let's have a look at basic examples of filtering text in file in Linux using grep.
1. Searching for Text in a File
In the first example, we will search for information about the root user in the Linux user list file /etc/passwd. To do this enter the following command:
grep root /etc/passwd
As a result, you will get something like this:
Using the -i option, you can specify that the character case should be ignored. For example, let's find all lines containing the word "time" in the same file:
grep -i "time" /etc/passwd
In this case, Time, time, TIME, and other variations of the word will be treated as equivalent. Also, you can specify multiple conditions for searching text in file Linux using the -e option. For example:
grep -e "root" -e "daemon" /etc/passwd
The -n option allows to display the line number where the match is found, for example:
grep -n "root" /etc/passwd
This works well as long as your search query does not contain special characters. For example, if you try to find all lines containing the "[" character in the /etc/grub/00_header file, you will get an error that this regular expression is incorrect. To avoid this, you need to explicitly specify that you want to search for a string using the -F option:
grep -F "[" /etc/grub.d/00_header
2. Filtering Command Output
The grep command also can help to filter output of another command. Simply redirect it into grep using the | operator and do not specify the file in the grep command itself. For example, you can use the following command to find all gnome processes:
ps aux | grep "gnome"
Other options and features work similarly.
3. Basic Regular Expressions
The grep command supports several types of regular expressions. These are basic regular expressions (BRE), which are used by default, and extended (ERE). Basic regular expressions support a set of characters that allow describing each specific character in a string. These are: ., *, [], [^], ^, and $. For example, you can find lines that start with the letter r:
grep "^r" /etc/passwd
Or find lines that contain uppercase letters:
grep "[A-Z]" /etc/passwd
And this way you can find all lines that end with "ready" in the /var/log/dmesg file:
grep "ready$" /var/log/dmesg
But you cannot specify the exact number of these characters, using the basic syntax.
4. Extended Regular Expressions
In addition to all the characters from the basic syntax, the extended syntax also supports the following special characters:
- + - one or more repetitions of the previous character;
- ? - zero or one repetition of the previous character;
- {n,m} - repetition of the previous character from n to m times;
- | - allows combining multiple patterns.
Use the -E option, to activate the extended syntax. For example, you can combine multiple words for searching, instead of using the -e option like this:
grep -E "root|daemon" /etc/passwd
In general, grep regular expressions are a very extensive topic, and I have only shown a few examples in this article. As you can see, searching for text in files using grep becomes even more efficient. But a full explanation of this topic requires an entire article, so let's skip it for now and move on.
5. Output of Context
Sometimes it is necessary to display not only the line that was matched but also the lines before and after it. For example, we want to select all errors from a log file, but we know that the next line after the error may contain useful information, so let's use grep to display several lines. We will search for errors in the /var/log/dmesg file using the "Error" pattern:
grep -A4 "Error" /var/log/dmesg
This will output the line with the occurrence and 4 lines after it:
grep -B4 "Error" /var/log/dmesg
This command will display the target line and 4 lines before it. And the following command will display two lines above and below the occurrence.
grep -C2 "Error" /var/log/dmesg
6. Recursive Search in Grep
So far, we have looked at searching in a specific file or command output. But grep can also search for text in multiple files located in one directory or sub directories. Use the -r option to do this. For example, let's find all files containing the "Kernel" string in the /var/log folder:
grep -r "Kernel" /var/log
The folder with your files may contain binary files, which should be skipped. Use the -I option:
grep -rI "Kernel" /var/log
Some files are only accessible to the superuser, you need to run grep using sudo for searching in them. Or you can simply hide read error messages and skip such files using the -s option:
grep -rIs "Kernel" /var/log
7. Selecting Files for Search
You can filter the files that will be used for searching, using the --include and --exclude options. For example, to search only for files with the .log extension in the /var/log folder, use the following command:
grep -r --include="*.log" "Kernel" /var/log
And to exclude all files with the .journal extension, use the --exclude option:
grep -r --exclude="*.journal" "Kernel" /var/log
8. Searching for Words
When you search for the string abc, grep will also display kbabc, abc123, aafrabc32, and similar combinations. You can make the utility search for content in Linux files only for lines that include the searched whole words using the -w option. For example:
grep -w "root" /etc/passwd
9. Count Matching Lines
The grep utility can report how many lines with specific text were found in the file. Simply use the -c option (counter) option. For example:
grep -c "Kernel" /var/log/dmesg
10. Inverted Search
The grep Linux command can search for lines in a file that do not contain the specified word. For example, display only lines that do not contain the word nologin:
grep -v nologin /etc/passwd
11. Output File Names
You can make grep display only the file names with matches using the -l option. For example, the following command will display all file names from /var/log which contain the "Kernel" word:
grep -lr "Kernel" /var/log/
12. Colored Output
By default, grep will not highlight matches with color. However, most distributions, have defined alias, which enables this feature. But, when you use the command with sudo, it will not work. Use the --color option with the value always to enable highlighting manually:
sudo grep --color=always root /etc/passwd
Wrapping Up
That's it. Now you know what the grep Linux command is and how to use it for searching files and filtering output of commands. This utility can become a powerful tool in your hands when it is used correctly. If you have any questions, feel free to ask in the comments!
