VulnTech Searching Text with grep | Learn Linux

grep: show the lines that match

grep prints every line of a file that contains a piece of text. It's one of the most used commands on any server, because logs and settings are plain text. Here's a small log to search:

cat server.log

In the terminal

student@vulntech:~$ cat server.log
2024-06-01 09:00:01 INFO  Server started on port 8080
2024-06-01 09:00:05 INFO  User alice logged in
2024-06-01 09:02:13 WARN  Disk usage at 81%
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:03:41 INFO  Retrying database connection
2024-06-01 09:03:44 INFO  Database connection restored
2024-06-01 09:10:22 INFO  User bob logged in
2024-06-01 09:15:09 error Payment service timed out
2024-06-01 09:20:30 INFO  User alice logged out
2024-06-01 09:25:00 WARN  Disk usage at 90%
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache

grep ERROR server.log

In the terminal

student@vulntech:~$ grep ERROR server.log
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache

The options you'll use every day

Option	What it does
`-i`	Ignore case: `error`, `ERROR` and `Error` all match
`-n`	Show the line number of each match
`-c`	Only count the matching lines
`-v`	Invert: show the lines that do not match
`-w`	Whole words only
`-A 2` / `-B 2`	Also show 2 lines after / before each match

grep -i error server.log
grep -n WARN server.log
grep -c INFO server.log

In the terminal

student@vulntech:~$ grep -i error server.log
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:15:09 error Payment service timed out
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache
student@vulntech:~$ grep -n WARN server.log
3:2024-06-01 09:02:13 WARN  Disk usage at 81%
10:2024-06-01 09:25:00 WARN  Disk usage at 90%
student@vulntech:~$ grep -c INFO server.log
6

grep -v INFO server.log

In the terminal

student@vulntech:~$ grep -v INFO server.log
2024-06-01 09:02:13 WARN  Disk usage at 81%
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:15:09 error Payment service timed out
2024-06-01 09:25:00 WARN  Disk usage at 90%
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache

-w stops data from matching inside Database:

grep -i data server.log
grep -iw data server.log

In the terminal

student@vulntech:~$ grep -i data server.log
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:03:41 INFO  Retrying database connection
2024-06-01 09:03:44 INFO  Database connection restored
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache
student@vulntech:~$ grep -iw data server.log
2024-06-01 09:30:12 ERROR Disk full: cannot write /var/data/cache

Context shows what happened around a match:

grep -B 1 -A 2 "connection lost" server.log

In the terminal

student@vulntech:~$ grep -B 1 -A 2 "connection lost" server.log
2024-06-01 09:02:13 WARN  Disk usage at 81%
2024-06-01 09:03:40 ERROR Database connection lost
2024-06-01 09:03:41 INFO  Retrying database connection
2024-06-01 09:03:44 INFO  Database connection restored

Searching many files

Give grep several files, or a whole folder with -r (recursive), and it shows which file each match is in. -l lists just the file names:

grep port config/web.conf config/db.conf
grep -r password config
grep -rl password config

In the terminal

student@vulntech:~$ grep port config/web.conf config/db.conf
config/web.conf:port=8080
config/db.conf:port=5432
student@vulntech:~$ grep -r password config
config/db.conf:password=changeme
config/mail.conf:password=hunter2
student@vulntech:~$ grep -rl password config
config/db.conf
config/mail.conf

Tip: Security people use grep -ri password to find passwords left in configuration files. Attackers do too, so never leave them lying around.

Remember: grep text file shows matching lines. -i any case, -n line numbers, -c count, -v the opposite, -r whole folders.