grep (search text patterns) in Linux CLI - Commands & Configuration

Introduction

Sometimes you need to find specific words or phrases inside files or command outputs. The grep command helps you search for text patterns quickly and easily in Linux.

When you want to find all lines containing a certain word in a log file to troubleshoot an error

When you want to check if a configuration file contains a specific setting

When you want to filter the output of another command to see only relevant information

When you want to count how many times a word appears in a file

When you want to search multiple files for a pattern at once

Commands

This command searches the file /var/log/syslog for lines containing the word 'error'. It helps you quickly find error messages in system logs.

Terminal

grep error /var/log/syslog

Expected Output

Jun 10 10:15:42 myserver systemd[1]: Failed to start Network Manager.

Jun 10 10:16:01 myserver kernel: [12345.678901] error: device not found

This command lists all running processes and filters the list to show only those related to 'sshd'. It helps you check if the SSH service is running.

Terminal

ps aux | grep sshd

Expected Output

root       1234  0.0  0.1  123456  2345 ?        Ss   10:00   0:00 /usr/sbin/sshd -D

user      56789  0.0  0.0  234567  1234 pts/0    S+   10:20   0:00 grep sshd

The -i flag makes the search case-insensitive, so it finds 'warning', 'Warning', or 'WARNING' in the file. This helps catch all variations of the word.

Terminal

grep -i warning /var/log/syslog

Expected Output

Jun 10 10:17:00 myserver app[123]: Warning: low disk space

Jun 10 10:18:00 myserver app[123]: warning: high memory usage

→

-i - Makes the search ignore case differences

The -r flag searches recursively inside the /etc directory and all its subdirectories for the word 'timeout'. Useful to find settings spread across many files.

Terminal

grep -r 'timeout' /etc

Expected Output

/etc/ssh/sshd_config:ClientAliveTimeout 300

/etc/network/interfaces:timeout 30

→

-r - Searches recursively in directories

The -c flag counts how many lines contain the word 'failed' in the auth.log file. This helps you quickly see how many failed login attempts happened.

Terminal

grep -c 'failed' /var/log/auth.log

Expected Output

7

→

-c - Counts matching lines instead of showing them

Key Concept

If you remember nothing else from grep, remember: it finds lines with your search word quickly inside files or command outputs.

Common Mistakes

Running grep without specifying a file or input

Grep waits for input from the keyboard and seems to hang because it has nothing to search

Always provide a filename or pipe input from another command to grep

Not using quotes around search patterns with spaces or special characters

Shell interprets spaces or special characters and grep gets wrong input, causing errors or no matches

Put the search pattern inside single or double quotes

Forgetting the -r flag when searching directories

Grep only searches files directly named, not inside folders, so you miss matches in subfolders

Use grep -r to search inside all files in directories recursively

Summary

Use grep to find lines containing specific words or patterns in files or command outputs.

Common flags include -i for case-insensitive, -r for recursive directory search, and -c to count matches.

Always specify a file or pipe input to grep to avoid it waiting for keyboard input.