grep command usage examples.

grep is one of the most widely and frequently used command by linux administrators for their day to day work. Be it finding a specific line among thousands of lines in a code orsearching a log file for errors and warnings, we depend on grep. Following are some examples on typical usages of grep command.


#1  
To search and display lines which contains the pattern "apples" in  dictionary word file /usr/share/dict/words

grep apples /usr/share/dict/words

Sample Output

apples
applesauce
applesnits
dapples
grapples
mayapples
pineapples
sapples
scrapples

#2
To Search and display lines which starts with the pattern "apples" in  dictionary word file /usr/share/dict/words

grep ^apples /usr/share/dict/words

Sample Output

apples
applesauce
applesnits

#3
To Search and display lines which ends with the pattern "apples" in  dictionary word file /usr/share/dict/words

grep apples$ /usr/share/dict/words

Sample Output

apples
dapples
grapples
mayapples
pineapples
sapples
scrapples

#4
To Search and display users with /bin/bash as their startup shell in /etc/passwd file

grep '/bin/bash' /etc/passwd

Sample Output

root:x:0:0:root:/root:/bin/bash
mysql:x:492:488:MySQL server:/var/lib/mysql:/bin/bash
postgres:x:502:503:PostgreSQL:/opt/PostgreSQL/9.1:/bin/bash
nagios:x:503:504::/home/nagios:/bin/bash
calypso:x:504:506::/home/calypso:/bin/bash
foo:x:505:507::/home/foo:/bin/bash

#5
To search and display the total count of users with /bin/bash as their startup shell in /etc/passwd file

grep -c '/bin/bash' /etc/passwd

Sample Output

7

#6
To Search and display all users except those using /bin/bash as their startup shell in /etc/passwd file

grep -v '/bin/bash' /etc/passwd

Sample Output

bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin

#7
To Search and display all warning messages from /var/log/messages file irrespective of the case.

grep -i warning /var/log/messages

Sample Output

Aug 26 08:15:31 FREESED-SA kernel: WARNING: CPU: 0 PID: 10258 at fs/sysfs/group.c:214 sysfs_remove_group+0xb9/0xc0()

Aug 26 08:15:31 FREESED-SA kernel: [2321938.702105] WARNING: CPU: 0 PID: 10258 at fs/sysfs/group.c:214 sysfs_remove_group+0xb9/0xc0()

#8
To search for patterns recursively, i.e. to search all the files and sub-directories inside a directory,  and display the lines containing the pattern helloworld_handle_data inside a directory named module

grep -R helloworld_handle_data module/

Sample Output

module/helloworld.c:int helloworld_handle_data(int, void *);

module/helloworld.c:neb_register_callback(NEBCALLBACK_AGGREGATED_STATUS_DATA, helloworld_module_handle, 0, helloworld_handle_data);

module/helloworld.c:neb_deregister_callback(NEBCALLBACK_AGGREGATED_STATUS_DATA, helloworld_handle_data);

module/helloworld.c:int helloworld_handle_data(int event_type, void *data) {

In the above example the pattern  helloworld_handle_data is appearing 4 times in a file named helloworld.c inside a directory named module.

#9
To display the above output with line numbers

grep -nR helloworld_handle_data module/

Sample Output

module/helloworld.c:43:int helloworld_handle_data(int, void *);

module/helloworld.c:77:neb_register_callback(NEBCALLBACK_AGGREGATED_STATUS_DATA, helloworld_module_handle, 0, helloworld_handle_data);

module/helloworld.c:88:neb_deregister_callback(NEBCALLBACK_AGGREGATED_STATUS_DATA, helloworld_handle_data);

module/helloworld.c:113:int helloworld_handle_data(int event_type, void *data) {

#10
grep can be used to filter patterns from the standard output of another command using shell pipes

(a) To filter the details of the audio device installed from the lspci command output 

lspci | grep -i audio

Sample Output

00:1b.0 Audio device: Intel Corporation NM10/ICH7 Family High Definition Audio Controller (rev 01)

(b) To filter Segmentation Fault messages from dmesg command output

dmesg |grep segfault

Sample Output

[  792.974646] gnome-control-c[3486]: segfault at 60 ip 0816bc3d sp bf7ffde0 error 4 in gnome-control-center[803d000+398000]

[53670.515801] Chrome_ChildThr[19748]: segfault at 0 ip b3c24425 sp b2602a00 error 6 in libmozalloc.so[b3c23000+2000]

(c) To Search and display users with /bin/bash as their startup shell in /etc/passwd file (An alternate methode to example #4)

cat /etc/passwd | grep '/bin/bash'

Sample Output

root:x:0:0:root:/root:/bin/bash
mysql:x:492:488:MySQL server:/var/lib/mysql:/bin/bash
postgres:x:502:503:PostgreSQL:/opt/PostgreSQL/9.1:/bin/bash
nagios:x:503:504::/home/nagios:/bin/bash
calypso:x:504:506::/home/calypso:/bin/bash
foo:x:505:507::/home/foo:/bin/bash

#11
To check apache web server log to see all the activities from a particular  IP address and highlighting the IP address in color

grep '10.124.0.236' /etc/httpd/logs/access_log --color

Sample Output

click to enlarge

#12
To filter more than one pattern and highlighting the patterns in color

grep -E 'seconds|minutes|hours' /usr/share/dict/words --color

Sample Output

click to enlarge