grep (search text patterns) in Linux CLI - Commands & Configuration

Introduction

Sometimes you need to find specific words or phrases inside files or command outputs. The grep command helps you search for text patterns quickly and easily in Linux.

When you want to find all lines containing a certain word in a log file to troubleshoot an error

When you want to check if a configuration file contains a specific setting

When you want to filter the output of another command to see only relevant information

When you want to count how many times a word appears in a file

When you want to search multiple files for a pattern at once

Commands

This command searches the file /var/log/syslog for lines containing the word 'error'. It helps you quickly find error messages in system logs.

Terminal

grep error /var/log/syslog

Expected Output

Jun 10 10:15:42 myserver systemd[1]: Failed to start Network Manager.

Jun 10 10:16:01 myserver kernel: [12345.678901] error: device not found

This command lists all running processes and filters the list to show only those related to 'sshd'. It helps you check if the SSH service is running.

Terminal

ps aux | grep sshd

Expected Output

root       1234  0.0  0.1  123456  2345 ?        Ss   10:00   0:00 /usr/sbin/sshd -D

user      56789  0.0  0.0  234567  1234 pts/0    S+   10:20   0:00 grep sshd

The -i flag makes the search case-insensitive, so it finds 'warning', 'Warning', or 'WARNING' in the file. This helps catch all variations of the word.

Terminal

grep -i warning /var/log/syslog

Expected Output

Jun 10 10:17:00 myserver app[123]: Warning: low disk space

Jun 10 10:18:00 myserver app[123]: warning: high memory usage

→

-i - Makes the search ignore case differences

The -r flag searches recursively inside the /etc directory and all its subdirectories for the word 'timeout'. Useful to find settings spread across many files.

Terminal

grep -r 'timeout' /etc

Expected Output

/etc/ssh/sshd_config:ClientAliveTimeout 300

/etc/network/interfaces:timeout 30

→

-r - Searches recursively in directories

The -c flag counts how many lines contain the word 'failed' in the auth.log file. This helps you quickly see how many failed login attempts happened.

Terminal

grep -c 'failed' /var/log/auth.log

Expected Output

7

→

-c - Counts matching lines instead of showing them

Key Concept

If you remember nothing else from grep, remember: it finds lines with your search word quickly inside files or command outputs.

Common Mistakes

Running grep without specifying a file or input

Grep waits for input from the keyboard and seems to hang because it has nothing to search

Always provide a filename or pipe input from another command to grep

Not using quotes around search patterns with spaces or special characters

Shell interprets spaces or special characters and grep gets wrong input, causing errors or no matches

Put the search pattern inside single or double quotes

Forgetting the -r flag when searching directories

Grep only searches files directly named, not inside folders, so you miss matches in subfolders

Use grep -r to search inside all files in directories recursively

Summary

Use grep to find lines containing specific words or patterns in files or command outputs.

Common flags include -i for case-insensitive, -r for recursive directory search, and -c to count matches.

Always specify a file or pipe input to grep to avoid it waiting for keyboard input.

Practice

1. What does the grep command do in Linux?

easy

A. Searches text for lines matching a pattern

B. Deletes files matching a pattern

C. Copies files to another directory

D. Lists all files in a directory

Solution

1. Step 1: Understand the purpose of grep

   The grep command is used to search text for lines that match a given pattern.

2. Step 2: Compare options

   Options B, C, and D describe other commands like rm, cp, and ls, not grep.

3. Final Answer:

   Searches text for lines matching a pattern -> Option A

4. Quick Check:

   grep = search text lines [OK]

Hint: grep finds lines with your pattern in text [OK]

Common Mistakes:

• Confusing grep with file commands like rm or cp
• Thinking grep modifies files instead of searching
• Assuming grep lists files instead of searching content

2. Which of the following is the correct syntax to search for the word error in a file named log.txt using grep?

easy

A. grep log.txt error

B. grep -f error log.txt

C. grep error log.txt

D. grep -e log.txt error

Solution

1. Step 1: Recall grep syntax

   The basic syntax is grep [pattern] [file]. So to search for 'error' in 'log.txt', use grep error log.txt.

2. Step 2: Analyze other options

   grep -f error log.txt uses -f which expects a file of patterns, not a pattern string. Options C and D have arguments reversed or incorrect flags.

3. Final Answer:

   grep error log.txt -> Option C

4. Quick Check:

   grep pattern file = grep error log.txt [OK]

Hint: Use grep pattern filename order to avoid errors [OK]

Common Mistakes:

• Swapping pattern and filename positions
• Using -f flag incorrectly for pattern string
• Confusing -e flag usage

3. Given a file data.txt with the following content:

apple
banana
Apple
BANANA
apple pie
banana split

What is the output of the command grep -i 'apple' data.txt?

medium

A. apple
apple pie

B. Apple
BANANA
banana split

C. apple pie
banana split

D. apple
Apple
apple pie

Solution

1. Step 1: Understand -i option

   The -i option makes grep case-insensitive, so it matches 'apple' and 'Apple'.

2. Step 2: Identify matching lines

   Lines containing 'apple' ignoring case are: 'apple', 'Apple', and 'apple pie'.

3. Final Answer:

   apple Apple apple pie -> Option D

4. Quick Check:

   grep -i matches apple and Apple [OK]

Hint: Use -i to ignore case when searching text [OK]

Common Mistakes:

• Ignoring case sensitivity without -i
• Missing lines with partial matches like 'apple pie'
• Confusing output order

4. You run the command grep -c 'fail' report.txt but it returns 0 even though you know the file contains the word 'fail'. What is the most likely reason?

medium

A. The file report.txt is empty

B. The word 'fail' is in uppercase like 'FAIL' and grep is case-sensitive by default

C. The grep command syntax is incorrect

D. The file report.txt does not exist

Solution

1. Step 1: Understand grep -c behavior

   The -c option counts matching lines. If it returns 0, no exact matches were found.

2. Step 2: Consider case sensitivity

   By default, grep is case-sensitive. If the file has 'FAIL' but you search 'fail', it won't match.

3. Final Answer:

   The word 'fail' is in uppercase like 'FAIL' and grep is case-sensitive by default -> Option B

4. Quick Check:

   grep is case-sensitive unless -i used [OK]

Hint: Use -i to ignore case if matches return zero [OK]

Common Mistakes:

• Assuming grep ignores case by default
• Not checking file content carefully
• Mistaking syntax errors for no matches

5. You want to find how many lines in server.log contain the word timeout ignoring case, and display only the count. Which command should you use?

hard

A. grep -i -c timeout server.log

B. grep -i timeout server.log

C. grep timeout -i -c server.log

D. grep -c timeout server.log

Solution

1. Step 1: Identify options needed

   You need to ignore case (-i) and count matching lines (-c).

2. Step 2: Check correct option order

   Options can be combined as -i -c or -c -i. grep -i -c timeout server.log uses both correctly before pattern and file.

3. Step 3: Analyze other options

   grep -c timeout server.log lacks case insensitivity. grep -i timeout server.log shows matches but not count. grep timeout -i -c server.log has incorrect argument order (pattern before options).

4. Final Answer:

   grep -i -c timeout server.log -> Option A

5. Quick Check:

   Use -i and -c together for case-insensitive count [OK]

Hint: Combine -i and -c to count ignoring case [OK]

Common Mistakes:

• Omitting -i for case-insensitive search
• Using pattern before options causing errors
• Expecting output lines instead of count