LFCS 16 🐧 Text Processing — grep Basics
grep is the command-line equivalent of the find function in a text editor: it searches input for lines that match a pattern and prints the matching lines to standard output. It is one of the most frequently used commands in Linux administration, and the LFCS exam tests it as part of the “Search files and content” objective . The name comes from the ed editor’s command g/re/p — “globally search a regular expression and print” — and that origin explains the default behavior: it works line by line, and it prints the whole line, not just the matched fragment .
The command is line-oriented. It reads input from files or from standard input, processes one line at a time, and selects the lines that match. A line either matches or it does not; there is no partial selection at the default output. This makes grep the natural tool for filtering logs, finding configuration entries, and extracting records from structured text. It is also the first stage in a pipeline: grep finds the lines, and other tools like cut, sort, and awk process them further .
This chapter covers three areas. First, why grep exists and how it fits into text processing — the problem of finding lines in large files and the pipeline model. Second, how the basic command and its core options work — the pattern argument, the file arguments, and the options for case, inversion, counting, and line numbers. Third, how to search multiple files and directories — the filename prefix behavior, recursive search, and the exit status that makes grep useful in scripts. The chapter ends with a complete example session, a quick reference, best practices, common pitfalls, real-world examples, and diagrams showing the grep pipeline.
Key point: grep searches input for lines matching a pattern and prints matching lines. The basic syntax is grep [options] pattern [file...]. If no files are given, it reads standard input. Exit status is 0 if any lines matched, 1 if none matched, and 2 if an error occurred .
Why grep exists
The line-filtering problem. Text files contain many lines, and most tasks require finding a subset. A log file has thousands of entries; the administrator needs the errors. A configuration file has hundreds of settings; the administrator needs the one that controls a specific parameter. grep solves this by reading the file line by line and printing only the lines that match a pattern. The pattern can be a literal string or a regular expression, which gives it the power to describe complex conditions .
The pipeline problem. grep is designed to be one stage in a pipeline. Its output is lines, and its input is lines, so it can be composed with other line-oriented tools. grep finds the relevant lines, cut extracts fields, sort orders them, and uniq removes duplicates. The LFCS exam scenarios reflect this: extracting usernames from /etc/passwd that use a specific shell is a grep | cut | sort pipeline . The command is not a complete solution; it is a filter that fits into a larger workflow.
The exit-status problem. grep is not just an interactive tool. Its exit status makes it useful in scripts. A return code of 0 means at least one line matched. A return code of 1 means no lines matched. A return code of 2 means an error occurred, such as a file that could not be read . A script can test the return code with if grep -q ...; then to make a decision based on whether a pattern exists. The -q option suppresses output and exits immediately on the first match, which is the efficient way to test for existence .
The case-sensitivity problem. By default, grep is case-sensitive. A search for error does not match Error or ERROR. This is correct for precise searches, but many practical searches need to be case-insensitive. The -i option makes the match case-insensitive, which is useful for log files and user input where the case is not consistent .
The inversion problem. Sometimes the goal is to find lines that do not match a pattern. A configuration file might need to be checked for the absence of a setting, or a list of users might need to exclude a specific account. The -v option inverts the match, selecting lines that do not match the pattern . This is the complement of the default behavior, and it is useful in pipelines where the exclusion is easier to describe than the inclusion.
The trade-off. grep is a filter, not a query language. It does not understand the structure of the files it searches; it only sees lines. A search for a pattern that appears in multiple contexts will return all of them, and the administrator must read the output to determine which are relevant. The pattern language (regular expressions) is powerful but can be complex, and a poorly written pattern can match more or less than intended. The trade-off is between the simplicity of a line-oriented filter and the precision of a structured query. For the majority of text-processing tasks, the simplicity is an advantage.
a. The basic command
The basic invocation is grep pattern file. The pattern is the first non-option argument, and the remaining arguments are the files to search .
grep "error" /var/log/syslogThis searches /var/log/syslog for lines containing the string error and prints each matching line. The pattern is quoted to prevent the shell from interpreting special characters. If the pattern contains spaces or shell metacharacters, quoting is required .
If no files are specified, grep reads from standard input:
cat /var/log/syslog | grep "error"This is equivalent to grep "error" /var/log/syslog, but it demonstrates the filter model. grep reads from the pipe, processes the lines, and writes matching lines to standard output.
The pattern is treated as a basic regular expression (BRE) by default. In BRE, the metacharacters are ^ (start of line), $ (end of line), . (any character), * (zero or more of the previous), [...] (character class), and \ (escape) . A literal search for a string that contains these characters requires escaping them. The -F option disables regular-expression interpretation entirely and treats the pattern as a fixed string, which is faster when no regex features are needed .
b. Core options for output control
The options fall into a few categories: matching control determines which lines are selected, and output control determines what is printed.
Matching control:
-iignores case.grep -i "error" filematcheserror,Error, andERROR.-vinverts the match.grep -v "error" fileprints lines that do not containerror.-wmatches whole words only.grep -w "cat" filematchescatbut notconcatenate.-xmatches whole lines only.grep -x "exact line" filematches only lines that are exactlyexact line.
Output control:
-cprints only a count of matching lines.grep -c "error" fileprints the number of lines containingerror.-nprefixes each matching line with its line number.grep -n "error" fileprints3:error message.-lprints only the names of files that contain matches.grep -l "error" *.logprints the filenames, not the matching lines .-oprints only the matched part of the line, not the whole line.grep -o "error" fileprintserrorfor each match .-qsuppresses all output and exits with status 0 if any match is found. This is the option for scripting .-ssuppresses error messages about nonexistent or unreadable files .
Context control:
-A nprintsnlines of context after each match.-B nprintsnlines of context before each match.-C nprintsnlines of context before and after .
Context control is useful for understanding the surrounding code or log entry, not just the matching line itself.
c. Searching multiple files and directories
When multiple files are given, grep prefixes each matching line with the filename:
grep "error" /var/log/syslog /var/log/auth.logThe output is:
/var/log/syslog:error message
/var/log/auth.log:authentication errorThe filename prefix is automatic when more than one file is searched. To force the prefix when searching a single file, add /dev/null as a second file argument:
grep "error" /var/log/syslog /dev/nullThis is a common trick to get consistent output format regardless of the number of files .
For recursive search, the -r option searches all files in a directory and its subdirectories:
grep -r "error" /var/logThe -R option does the same but follows symbolic links. The --include and --exclude options filter which files are searched:
grep -r --include='*.conf' "error" /etcThis searches only files ending in .conf .
The -r option is useful but can be slow on large directory trees. For more control over which files are searched, the recommended pattern is to use find to generate the file list and pipe it to grep:
find /etc -name '*.conf' -exec grep -H "error" {} +The -H option forces the filename prefix, and -exec ... + batches multiple files into a single grep invocation for efficiency .
Complete Example Session
# ============================================
# PART 1: BASIC SEARCH
# ============================================
# Search a file for a literal string
grep "error" /var/log/syslog
# Search multiple files (filename prefix automatic)
grep "error" /var/log/syslog /var/log/auth.log
# ============================================
# PART 2: CASE-INSENSITIVE SEARCH
# ============================================
grep -i "error" /var/log/syslog
# Matches: error, Error, ERROR
# ============================================
# PART 3: INVERTED MATCH
# ============================================
grep -v "error" /var/log/syslog
# Prints lines that do NOT contain "error"
# ============================================
# PART 4: COUNT AND LINE NUMBERS
# ============================================
grep -c "error" /var/log/syslog
# Output: 42 (number of matching lines)
grep -n "error" /var/log/syslog
# Output: 15:error message
# 42:another error
# ============================================
# PART 5: WHOLE WORD AND WHOLE LINE
# ============================================
grep -w "cat" animals.txt
# Matches "cat" but not "concatenate"
grep -x "exact line" file.txt
# Matches only lines that are exactly "exact line"
# ============================================
# PART 6: RECURSIVE SEARCH
# ============================================
grep -r "error" /var/log
# Searches all files under /var/log
grep -r --include='*.conf' "error" /etc
# Searches only *.conf files
# ============================================
# PART 7: FILE NAMES ONLY
# ============================================
grep -l "error" *.log
# Output: app.log
# system.log
# ============================================
# PART 8: QUIET MODE FOR SCRIPTING
# ============================================
if grep -q "error" /var/log/syslog; then
echo "Errors found"
else
echo "No errors"
fi
# -q exits immediately on first match
# ============================================
# PART 9: CONTEXT LINES
# ============================================
grep -C 2 "panic" /var/log/kern.log
# Prints 2 lines before and after each match
# ============================================
# PART 10: THE LFCS PIPELINE
# ============================================
# Extract usernames from /etc/passwd that use /bin/bash
grep "/bin/bash" /etc/passwd | cut -d: -f1 | sort > /root/bash-users.txt
# Verify
cat /root/bash-users.txtThe ten parts show basic search, case-insensitive search, inverted match, count and line numbers, whole word and whole line, recursive search, file names only, quiet mode for scripting, context lines, and the LFCS pipeline scenario .
Quick Reference
Basic Syntax
| Form | Meaning |
|---|---|
grep pattern file | Search file for pattern |
grep pattern file1 file2 | Search multiple files |
command | grep pattern | Search standard input |
grep -e pattern file | Pattern starts with - |
Matching Control
| Option | Effect |
|---|---|
-i | Ignore case |
-v | Invert match (non-matching lines) |
-w | Match whole words only |
-x | Match whole lines only |
-F | Treat pattern as fixed string |
Output Control
| Option | Effect |
|---|---|
-c | Count matching lines |
-n | Prefix with line number |
-l | Print file names only |
-o | Print only matched part |
-q | Quiet; exit status only |
-s | Suppress error messages |
Context Control
| Option | Effect |
|---|---|
-A n | n lines after match |
-B n | n lines before match |
-C n | n lines before and after |
Exit Status
| Status | Meaning |
|---|---|
| 0 | At least one line matched |
| 1 | No lines matched |
| 2 | Error occurred |
Best Practices
✅ Do This:
# Quote the pattern
grep "error message" file.log # ✅
# Use -q for existence tests in scripts
if grep -q "pattern" file; then ... # ✅
# Use -F for literal strings with special chars
grep -F "a.b.c" file.txt # ✅
# Use find + grep for complex file selection
find /etc -name '*.conf' -exec grep -H "pattern" {} + # ✅
# Use /dev/null to force filename prefix
grep "pattern" file.txt /dev/null # ✅❌ Don’t Do This:
# Don't forget to quote patterns with spaces
grep error message file.log # searches for "error" in "message" and "file.log" # ❌
# Don't parse grep output when exit status suffices
grep -q "pattern" file && echo "found" # not: grep "pattern" file | wc -l # ✅
# Don't use grep for structured queries
# Use awk or cut for field extraction # ✅
# Don't use -r on / without exclusions
grep -r "pattern" / # slow and noisy # ❌Common Pitfalls
| Pitfall | Why It Happens | Fix |
|---|---|---|
| Pattern with special chars matches wrong | Regex interpretation | Use -F or escape |
grep returns 1 in script | No match found | Handle exit status |
| Filename prefix missing | Single file searched | Add /dev/null |
| Recursive search too slow | Large directory tree | Use find + grep |
| Binary file output garbled | Binary file matched | Use -I to skip binary |
| Case-sensitive miss | Pattern case differs | Use -i |
Real-World Examples
1. Search a Log File
grep "error" /var/log/syslog2. Case-Insensitive Search
grep -i "error" /var/log/syslog3. Count Matches
grep -c "error" /var/log/syslog4. Invert Match
grep -v "error" /var/log/syslog5. Show Line Numbers
grep -n "error" /var/log/syslog6. Recursive Search with Filter
grep -r --include='*.conf' "error" /etc7. File Names Only
grep -l "error" *.log8. Quiet Mode for Scripts
grep -q "pattern" file && echo "found"9. Context Lines
grep -C 3 "panic" /var/log/kern.log10. Extract Usernames
grep "/bin/bash" /etc/passwd | cut -d: -f1 | sortVisual
The grep Pipeline
┌──────────────────────────────────────────────────────────────┐
│ THE GREP PIPELINE │
│ │
│ Input (file or stdin) │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ grep pattern │ │
│ │ │ │
│ │ Reads line by line │ │
│ │ Tests each line against the pattern │ │
│ │ Prints matching lines to stdout │ │
│ └──────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ Output (matching lines) │
│ │ │
│ ├──► Terminal (interactive) │
│ │ │
│ └──► Pipe to next command (cut, sort, uniq, awk) │
│ │
│ Exit status: 0 (match), 1 (no match), 2 (error) │
│ │
└──────────────────────────────────────────────────────────────┘Matching Options
┌──────────────────────────────────────────────────────────────┐
│ MATCHING OPTIONS │
│ │
│ Input lines: │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ error occurred │ │
│ │ Error occurred │ │
│ │ no problem │ │
│ │ concatenate │ │
│ │ cat │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ grep "error" → error occurred │
│ grep -i "error" → error occurred, Error occurred │
│ grep -v "error" → no problem, concatenate, cat │
│ grep -w "cat" → cat │
│ grep -w "error" → error occurred, Error occurred │
│ │
└──────────────────────────────────────────────────────────────┘Output Control
┌──────────────────────────────────────────────────────────────┐
│ OUTPUT CONTROL │
│ │
│ grep -n "error" file.txt │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ 3:error occurred │ │
│ │ 15:another error │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ grep -c "error" file.txt │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ 2 │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ grep -l "error" *.log │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ app.log │ │
│ │ system.log │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ grep -o "error" file.txt │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ error │ │
│ │ error │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
└──────────────────────────────────────────────────────────────┘Exit Status for Scripting
┌──────────────────────────────────────────────────────────────┐
│ EXIT STATUS FOR SCRIPTING │
│ │
│ grep "pattern" file │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Match found → exit 0 │ │
│ │ No match → exit 1 │ │
│ │ Error (no file) → exit 2 │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ if grep -q "pattern" file; then │
│ echo "Pattern exists" │
│ else │
│ echo "Pattern not found" │
│ fi │
│ │
│ -q suppresses output and exits immediately on first match. │
│ │
└──────────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
grep | Search input for lines matching a pattern |
| Basic syntax | grep [options] pattern [file...] |
| Default input | Standard input if no files given |
| Default pattern | Basic regular expression (BRE) |
-i | Case-insensitive |
-v | Invert match |
-c | Count matching lines |
-n | Show line numbers |
-l | File names only |
-q | Quiet; exit status only |
-r | Recursive search |
| Exit status | 0 match, 1 no match, 2 error |
Key takeaways:
grepis a line-oriented filter. It reads input line by line, tests each line against a pattern, and prints the lines that match. The default output is the whole line, not the matched fragment. This makes it the natural tool for filtering logs, configuration files, and structured text .- The pattern is a basic regular expression by default. The metacharacters
^,$,.,*,[...], and\have special meaning. The-Foption disables regex interpretation and treats the pattern as a fixed string. The-Eoption enables extended regular expressions . - The core matching options are
-i,-v,-w, and-x.-iignores case,-vinverts the match,-wmatches whole words, and-xmatches whole lines. These four options cover the majority of matching-control needs . - The core output options are
-c,-n,-l,-o, and-q.-ccounts,-nnumbers lines,-llists files,-oprints only the match, and-qsuppresses output for scripting. The choice depends on what the next stage of the pipeline needs . - The exit status makes
grepuseful in scripts. 0 means a match was found, 1 means no match, and 2 means an error. The-qoption is the efficient way to test for existence, because it exits immediately on the first match . - Multiple files produce a filename prefix. The prefix is automatic when more than one file is searched. To force it for a single file, add
/dev/nullas a second file argument. This is a common pattern for consistent output format . - Recursive search uses
-r. The--includeand--excludeoptions filter which files are searched. For complex file selection, the recommended pattern isfindpiped togrep, which gives more control over the file list . grepis the first stage in a pipeline. The LFCS exam tests text-processing pipelines, such as extracting usernames from/etc/passwdwithgrep | cut | sort. The command is not a complete solution; it is a filter that fits into a larger workflow .
Remember: grep is the standard tool for finding lines in text. It reads input line by line, tests each line against a pattern, and prints the lines that match. The pattern can be a literal string or a regular expression, and the options control which lines are selected and what is printed. The exit status makes it useful in scripts, and the pipeline model makes it composable with other text-processing tools. For the LFCS exam, the key options are -i, -v, -c, -n, -l, -q, and -r. The command is simple, but it is the foundation of text processing on Linux, and fluency with it is assumed in every subsequent text-processing topic.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!