grep Command Cheat Sheet

grep (Global Regular Expression Print) searches for patterns in text files or output streams. It is the Swiss Army knife of text processing in Linux.

Synopsis

grep [OPTIONS] PATTERN [FILE...]

Basic Usage

Search in a File

grep "error" /var/log/syslog

Search in Multiple Files

grep "config" *.conf

Case Insensitive (-i)

grep -i "Error" /var/log/syslog

Recursive Search (-r)

Search in a directory and all its subdirectories.

grep -r "function_name" /home/user/code

Follow Symlinks (-R)

Like -r, but follows symbolic links to directories.

grep -R "config" /etc

Output Control

Show Line Numbers (-n)

Crucial for finding code.

grep -n "TODO" main.py
# Output: 45:    # TODO: Refactor this

Only Matching Part (-o)

Shows only the part of the line that matches the pattern (not the whole line). Useful for extracting data.

# Extract IP addresses
grep -o "[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" access.log

Quiet Mode (-q)

No output. Used in scripts just to check exit code (0 if found, 1 if not).

if grep -q "success" build.log; then
    echo "Build Passed"
fi

Count Matches (-c)

Print only the count of matching lines.

grep -c "error" /var/log/syslog

Invert Match (-v)

Show lines that do NOT match.

grep -v "debug" /var/log/syslog

Context Control

Sometimes seeing the error isn't enough; you need the lines around it.

• -A n: Print n lines After match.
• -B n: Print n lines Before match.
• -C n: Print n lines around match (Context).

grep -C 5 "exception" app.log

Regular Expressions

Basic Regex

Default grep supports Basic Regex.

grep "^root" /etc/passwd  # Starts with root
grep "bash$" /etc/passwd  # Ends with bash

Extended Regex (-E)

Allows usage of |, +, ?, () without escaping. Equivalent to egrep (deprecated).

grep -E "error|warning|fatal" app.log

Perl-Compatible Regex (-P)

The most powerful mode. Supports lookaheads/lookbehinds.

# Match tab characters (\t)
grep -P "\t" file.tsv

File Filtering

Exclude Directories (--exclude-dir)

Commonly used to ignore version control or build folders.

grep -r "main" . --exclude-dir={.git,node_modules,vendor}

Only Specific Files (--include)

grep -r "def " . --include="*.py"

Exclude Files (--exclude)

grep -r "TODO" . --exclude="*.min.js"

Performance

Searching Binary Files

By default, grep might try to search binary files. - -I: Treat binaries as non-matching (skip them). - -a: Treat binaries as text (force search).

grep -rI "password" .

Fixed Strings (-F)

Interpret PATTERN as a list of fixed strings (not regex). Much faster. Equivalent to fgrep.

grep -F "user.name" config.txt

Practical Examples

Find All Processes Running 'Python'

ps aux | grep "[p]ython"

Search for a Variable Usage in Codebase

grep -rnw '/path/to/project' -e 'MY_VAR'

Extract Email Addresses

grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" database.txt

Exit Status

Notes

• Color: Most distros alias grep to grep --color=auto. If not, use it to highlight matches.
• Pipelines: grep is the best friend of cat, ps, ls, and tail in pipes.