Readers like you help support How-To Geek. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.

Quick Links

Key Takeaways

  • The Linux grep command is a useful tool for string and pattern matching, allowing you to search through text files using various options.
  • With grep, you can perform simple searches, recursive searches, search for whole words, use multiple search terms, count matches, add context, and even pipe the output to other commands for further manipulation.

The Linux grep command is a string and pattern matching utility that displays matching lines from multiple files. It also works with piped output from other commands. We show you how.

The Grep Command in Linux

The grep command is famous in Linux and Unix circles for three reasons. Firstly, it is tremendously useful. Secondly, the wealth of options can be overwhelming. Thirdly, it was written overnight to satisfy a particular need. The first two are bang on; the third is slightly off.

Ken Thompson had extracted the regular expression search capabilities from the ed editor (pronounced ee-dee) and created a little program — for his own use — to search through text files. His department head at Bell Labs, Doug Mcilroy, approached Thompson and described the problem one of his colleagues, Lee McMahon, was facing.

McMahon was trying to identify the authors of the Federalist papers through textual analysis. He needed a tool that could search for phrases and strings within text files. Thompson spent about an hour that evening making his tool a general utility that could be used by others and renamed it as grep. He took the name from the ed command string g/re/p , which translates as "global regular expression search."

You can watch Thompson talking to Brian Kernighan about the birth of grep.

Simple Searches with the grep Command

To search for a string within a file, pass the search term and the file name on the command line:

grep dave /etc/password in a terminal widnow

Matching lines are displayed. In this case, it is a single line. The matching text is highlighted. This is because on most distributions grep is aliased to:

alias grep='grep --colour=auto'

Let's look at results where there are multiple lines that match. We'll look for the word "Average" in an application log file. Because we can't recall if the word is in lowercase in the log file, we'll use the -i (ignore case) option:

grep -i Average geek-1.log

grep -i Average geek-1.log ina terminal window

Every matching line is displayed, with the matching text highlighted in each one.

Output from grep -i Average geek-1.log in a terminal window

We can display the non-matching lines by using the -v (invert match) option.

grep -v Mem geek-1.log

grep -v Mem geek-1.log in a terminal window

There is no highlighting because these are the non-matching lines.

output from grep -v Mem geek-1.log in a terminal window

We can cause grep to be completely silent. The result is passed to the shell as a return value from grep. A result of zero means the string was found, and a result of one means it was not found. We can check the return code using the $? special parameters:

grep -q average geek-1.log

echo $?

grep -q howtogeek geek-1.log

echo $?

grep -q average geek-1.log in a terminal window

Recursive Searches Using grep

To search through nested directories and subdirectories, use the -r (recursive) option. Note that you don't provide a file name on the command line, you must provide a path. Here we're searching in the current directory "." and any subdirectories:

grep -r -i memfree .

grep -r -i memfree . in a terminal window

The output includes the directory and filename of each matching line.

output from grep -r -i memfree . in a terminal window

We can make grep follow symbolic links by using the -R (recursive dereference) option. We've got a symbolic link in this directory, called logs-folder. It points to /home/dave/logs.

ls -l logs-folder

ls -l logs-folder in a terminal window

Let's repeat our last search with the -R (recursive dereference) option:

grep -R -i memfree .

grep -R -i memfree . in a terminal window

The symbolic link is followed and the directory it points to is searched by grep too.

Output from grep -R -i memfree . in a terminal window

Searching for Whole Words with the grep Command

By default, grep will match a line if the search target appears anywhere in that line, including inside another string. Look at this example. We're going to search for the word "free."

grep -i free geek-1.log

grep -i free geek-1.log in a terminal window

The results are lines that have the string "free" in them, but they're not separate words. They're part of the string "MemFree."

Output from grep -i free geek-1.log in a terminal window

To force grep to match separate "words" only, use the -w (word regexp) option.

grep -w -i free geek-1.log

echo $?

grep -w -i free geek-1.log in a terminal window

This time there are no results because the search term "free" does not appear in the file as a separate word.

Using Multiple Search Terms

The -E (extended regexp) option allows you to search for multiple words. (The -E option replaces the deprecated egrep version of grep.)

This command searches for two search terms, "average" and "memfree."

grep -E -w -i "average|memfree" geek-1.log

grep -E -w -i

All of the matching lines are displayed for each of the search terms.

Output from grep -E -w -i

You can also search for multiple terms that are not necessarily whole words, but they can be whole words too.

The -e (patterns) option allows you to use multiple search terms on the command line. We're making use of the regular expression bracket feature to create a search pattern. It tells grep to match any one of the characters contained within the brackets "[]." This means grep will match either "kB" or "KB" as it searches.

grep -e MemFree -e [kK]B geek-1.log in a terminal window

Both strings are matched, and, in fact, some lines contain both strings.

Output from grep -e MemFree -e [kK]B geek-1.log in a terminal window

Matching Lines Exactly

The -x (line regexp) will only match lines where the entire line matches the search term. Let's search for a date and time stamp that we know appears only once in the log file:

grep -x "20-Jan--06 15:24:35" geek-1.log

grep -x

The single line that matches is found and displayed.

The opposite of that is only showing the lines that don't match. This can be useful when you're looking at configuration files. Comments are great, but sometimes it's hard to spot the actual settings in amongst them all. Here's the /etc/sudoers file:

Contents of the /etc/sudoers file in a terminal window

We can effectively filter out the comment lines like this:

sudo grep -v "#" /etc/sudoers

sudo grep -v

That's much easier to parse.

Only Displaying Matching Text

There may be an occasion when you don't want to see the entire matching line, just the matching text. The -o (only matching) option does just that.

grep -o MemFree geek-1.log

grep -o MemFree geek-1.log in a terminal window

The display is reduced to showing only the text that matches the search term, instead of the entire matching line.

output from grep -o MemFree geek-1.log in a terminal window

Counting With grep

grep isn't just about text, it can provide numerical information too. We can make grep count for us in different ways. If we want to know how many times a search term appears in a file, we can use the -c (count) option.

grep -c average geek-1.log

grep -c average geek-1.log in a terminal window

grep reports that the search term appears 240 times in this file.

You can make grep display the line number for each matching line by using the -n (line number) option.

grep -n Jan geek-1.log

grep -n jan geek-1.log in a terminal window

The line number for each matching line is displayed at the start of the line.

Output from grep -n jan geek-1.log in a terminal window

To reduce the number of results that are displayed, use the -m (max count) option. We're going to limit the output to five matching lines:

grep -m5 -n Jan geek-1.log

grep -m5 -n Jan geek-1.log in a terminal window

Adding Context with grep

Being able to see some additional lines — possibly non-matching lines —for each matching line is often useful. it can help distinguish which of the matched lines are the ones you are interested in.

To show some lines after the matching line, use the -A (after context) option. We're asking for three lines in this example:

grep -A 3 -x "20-Jan-06 15:24:35" geek-1.log

grep -A 3 -x

To see some lines from before the matching line, use the -B (context before) option.

grep -B 3 -x "20-Jan-06 15:24:35" geek-1.log

grep -B 3 -x

And to include lines from before and after the matching line use the -C (context) option.

grep -C 3 -x "20-Jan-06 15:24:35" geek-1.log

grep -C 3 -x

Showing Matching Files

To see the names of the files that contain the search term, use the -l (files with match) option. To find out which C source code files contain references to the sl.h header file, use this command:

grep -l "sl.h" *.c

grep -l

The file names are listed, not the matching lines.

Output from grep -l

And of course, we can look for files that don't contain the search term. The -L (files without match) option does just that.

grep -L "sl.h" *.c

grep -L

Start and End of Lines

We can force grep to only display matches that are either at the start or the end of a line. The "^" regular expression operator matches the start of a line. Practically all of the lines within the log file will contain spaces, but we're going to search for lines that have a space as their first character:

grep "^ " geek-1.log

grep

The lines that have a space as the first character — at the start of the line — are displayed.

Output grep

To match the end of the line, use the "$" regular expression operator. We're going to search for lines that end with "00."

grep "00$" geek-1.log

grep

The display shows the lines that have "00" as their final characters.

output of grep

Using Pipes with grep

Of course, you can pipe input to grep , pipe the output from grep into another program, and have grep nestled in the middle of a pipe chain.

Let's say we want to see all occurrences of the string "ExtractParameters" in our C source code files. We know there's going to be quite a few, so we pipe the output into less:

grep "ExtractParameters" *.c | less

grep

The output is presented in less.

Output from grep

This lets you page through the file listing and to use less's search facility.

If we pipe the output from grep into wc and use the -l (lines) option, we can count the number of lines in the source code files that contain "ExtractParameters". (We could achieve this using the grep -c (count) option, but this is a neat way to demonstrate piping out of grep.)

grep "ExtractParameters" *.c | wc -l

grep

With the next command, we're piping the output from ls into grep and piping the output from grep into sort . We're listing the files in the current directory, selecting those with the string "Aug" in them, and sorting them by file size:

ls -l | grep "Aug" | sort +4n

ls -l | grep

Let's break that down:

  • ls -l: Perform a long format listing of the files using ls.
  • grep "Aug": Select the lines from the ls listing that have "Aug" in them. Note that this would also find files that have "Aug" in their names.
  • sort +4n: Sort the output from grep on the fourth column (filesize).

We get a sorted listing of all the files modified in August (regardless of year), in ascending order of file size.

grep in Linux: Less a Command, More of an Ally

grep is a terrific tool to have at your disposal. It dates from 1974 and is still going strong because we need what it does, and nothing does it better.

Coupling grep with some regular expressions-fu really takes it to the next level.

Linux Commands

Files

tar · pv · cat · tac · chmod · grep · diff · sed · ar · man · pushd · popd · fsck · testdisk · seq · fd · pandoc · cd · $PATH · awk · join · jq · fold · uniq · journalctl · tail · stat · ls · fstab · echo · less · chgrp · chown · rev · look · strings · type · rename · zip · unzip · mount · umount · install · fdisk · mkfs · rm · rmdir · rsync · df · gpg · vi · nano · mkdir · du · ln · patch · convert · rclone · shred · srm · scp · gzip · chattr · cut · find · umask · wc · tr

Processes

alias · screen · top · nice · renice · progress · strace · systemd · tmux · chsh · history · at · batch · free · which · dmesg · chfn · usermod · ps · chroot · xargs · tty · pinky · lsof · vmstat · timeout · wall · yes · kill · sleep · sudo · su · time · groupadd · usermod · groups · lshw · shutdown · reboot · halt · poweroff · passwd · lscpu · crontab · date · bg · fg · pidof · nohup · pmap

Networking

netstat · ping · traceroute · ip · ss · whois · fail2ban · bmon · dig · finger · nmap · ftp · curl · wget · who · whoami · w · iptables · ssh-keygen · ufw · arping · firewalld