grep - Global Regular Expression Print

It basically searches for patterns in text(files or streams) using regular expressions.

grep [option] pattern [file..]

Essential Options

OptionDescription
-iIgnore case
-r/-RRecursive search in directories
-nShow line number
-vInvert match (Shows text that don’t match)
-cCount matching lines
-lList filenames with match
-HShow filename with match (useful when grepping multiple files)
--color=autoHighlight matches
-E / -eUse extended regex (like egrep)
-FFixed string search (no regex + faster)

Example

grep "error" /var/log/syslog # shows text that matches "error"
grep -i "warning" *.log # case insensitive
grep -r "failed password" /var/log
grep -v "^#" /etc/ssh/ssh_config #invert match, in this case it excludes the comments
grep -c "404" access.log #show 404 line precisely

Exercises

  1. Find all case-insensitive matches of the worf failed in /var/log/auth.log.
grep -i failed /var/log/auth.log
  1. Search all .conf files in /etc for lines containing PermitRootLogin.
grep -r PermitRootLogin /etc --include="*.conf"
  1. List files under /var/log that contain the word kernel.
grep -rl kernel  /var/log
  1. Show all non-comment lines from /etc/fstab.
grep -v "^#" /etc/fstab
  1. Count how many times the word sshd appears in /var/log/messages.
grep -c sshd /var/log/messages

find Locate Files Based On Attributes

It basically searches for files and directories based on name, size, date, permissions, etc. In simple terms, it searches using metadata of the files and directories rather than just using the name of the file.

find [path] [expression]

Essential Options

OptionDescription
-name "pattern"Match file/directory name (case-sensitive)
-iname "pattern"Match file/directory name (case-insensitive)
-wholename "pattern"Matches the whole file/directory name (case-insensitive)
-type f/dFile(f) or directory (d)
-size [+/-]N[c/k/M/G]File size
-mtime [+/-N]Modified exactly N days ago (+N older |-N newer)
-newer fileModified after a specific date
-permPermissions (eg: 644/u+w)
-user / -groupOwned by user/group
-exec CMD {} \;Execute command on result
-deleteDelete matching files (not recommended for beginners)
-maxdepth / -mindepthLimit directory traversal

Example

find / -name "iamyaash"
find /etc -type f -iname "*.conf"
find /home -type f -size +100M
find /var/log -mtime -2
find /tmp -type f -user iamyaash
find . -type f -name "*.log" -exec grep -H "error" {} \;

Exercises

  1. Find all .log files modified in the last 2 days in /var/log.
find /var/log -type f -mtime -2 -name "*.log"
  1. Search for files larger than 10MB in your home directory
find /home/iamyash -type f -size +10M
  1. Find all .ssh scripts and list their permissions
find . -type f -name "*.ssh" -exec ls -l {} \;
  1. Delete all .tmp files in /tmp older than 7 days
find /tmp -type f -name "*.tmp" -mtime +7 -exec rm -rf {} \;
  1. Combine find and grep to search for “database” in all .conf files under /etc.
find /etc -type f -name "*.conf" -exec grep "database" {} \;