Linux command: grep

Sooner or later you need to find something in a haystack of text. A single error hides in a log of a million lines. A setting lives somewhere in a folder of hundreds of config files. A word appears across a whole source tree and you have no idea where. For all of these, one small command does the work in a fraction of a second: grep.

2. Where the Name Comes From

The name looks like random letters, but it is an acronym with a precise meaning. It comes from a command in the old ed line editor:

g/re/p     =     Global / Regular Expression / Print

In ed, you could type g/re/p to say: globally, across the whole file, find every line matching this regular expression, and print it. That single editor command was so useful that it grew into a program of its own, and the program kept the name.

So grep is not a made-up word. Every time you type it, you are spelling out exactly what it does: search everywhere for a pattern and print what you find.

Understanding the name gives you the mental model for free: global (all lines), regular expression (a pattern, not just a word), print (show the matches). That is the entire command in three letters.

4. Simple Use Cases

4.1 The Simplest Possible Use

Give grep a pattern and a file. It prints every line that contains the pattern.

$ grep "root" /etc/passwd
root:x:0:0:root:/root:/bin/bash

Wrap the pattern in double quotes as a habit. It is not always required, but it protects patterns that contain spaces or special characters from the shell, which would otherwise try to interpret them before grep ever sees them.

4.2 Ignore Upper and Lower Case

By default grep is case-sensitive, so Error and error are different. The -i flag (short for ignore-case) makes the search match either:

$ grep -i "warning" application.log
WARNING: disk almost full
Warning: retrying connection

4.3 Show Line Numbers

The -n flag (short for line-number) puts the line number in front of every match. This is what you want when searching source code, because you can then jump straight to that line in an editor:

$ grep -n "TODO" main.c
42:  // TODO: handle the empty case
87:  // TODO: free this buffer

4.4 Count the Matches

Sometimes you want the number, not the lines. The -c flag (short for count) prints how many lines matched:

$ grep -c "404" access.log
128

This says 128 lines contain 404, without printing all 128 of them. Note that it counts matching lines, not total matches, so two hits on one line still count as one.

4.5 Invert the Match

The -v flag (short for invert-match) turns the question around: it prints the lines that do not match. A classic use is reading a config file without its comments and blank lines:

$ grep -v "^#" /etc/ssh/sshd_config | grep -v "^$"
Port 22
PermitRootLogin no
PasswordAuthentication no

The first grep drops lines that start with #, the second drops empty lines, and you are left with only the settings that are actually active.

6. Advanced Use Cases

6.1 Regular Expressions: Describing the Shape of Text

The "re" in the name is the real power. Instead of a fixed word, a regular expression describes the shape of the text you want. A few building blocks cover most needs:

$ grep "^root" /etc/passwd     # lines that START with root
root:x:0:0:root:/root:/bin/bash

6.2 Basic Versus Extended Regular Expressions

grep has two regex dialects. In the default basic syntax, the characters +, ?, {, |, (, and ) are ordinary text, and you must put a backslash in front of them to make them special. The extended syntax, turned on with the -E flag (short for extended-regexp), makes them special without the backslash, which is far easier to read.

$ grep    "colou\?r" file.txt     # basic: the ? must be escaped
$ grep -E "colou?r"  file.txt     # extended: no backslash needed

Both match color and colour. Most people reach for -E as soon as a pattern grows past a plain word. The | character, meaning "or", is the most common reason:

$ grep -E "error|warning|critical" app.log

This finds every line containing any of the three words in a single pass.

There is a second, more portable way to search for several patterns that needs no regex at all. The -e flag (short for regexp) lets you give each pattern separately, and you can repeat it:

$ grep -e "error" -e "warning" -e "critical" app.log

When the list of patterns grows long, put them in a file, one per line, and read them with the -f flag (short for file). This is how you check a log against a whole list of known-bad IP addresses or terms at once:

$ grep -f blocklist.txt access.log

6.3 Quantifiers and Real Patterns

Quantifiers say how many times something may repeat: + means one or more, ? means zero or one, and {2,4} means between two and four times. Put together, they describe real things like an IP address:

$ grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" access.log

Read it as: one to three digits followed by a dot, three times over, then one to three more digits.

6.4 Perl-Compatible Regular Expressions

GNU grep offers a third, more powerful engine with the -P flag (short for perl-regexp). It adds shortcuts like \d for a digit and \w for a word character, plus advanced features such as look-ahead:

$ grep -P "\d{4}-\d{2}-\d{2}" app.log     # match an ISO date like 2026-07-07

This is a GNU feature and is not present in the BSD grep that ships with macOS, so keep it out of scripts that must run everywhere.

6.5 grep in Pipelines

If you give grep no file name, it reads whatever is piped into it. This turns it into a universal filter for the output of any other command. The pipe symbol | sends one command's output into the next:

$ ps aux | grep "nginx"
www-data  1243  0.0  0.5  nginx: worker process
www-data  1244  0.0  0.5  nginx: worker process

You can chain several stages, each narrowing what the last one kept:

$ grep "Googlebot" access.log | grep " 404 "

The first stage keeps requests from Google's crawler, the second keeps only those that returned a 404. And paired with sort and uniq, grep becomes a small reporting tool:

$ grep -o "GET [^ ]*" access.log | sort | uniq -c | sort -rn | head
    842 GET /index.html
    317 GET /style.css
     96 GET /favicon.ico

The -o flag (short for only-matching) prints just the matched text instead of the whole line, so sort and uniq -c can count how often each URL appears.

6.6 Quiet Mode for Scripts

The -q flag (short for quiet) prints nothing at all. It only reports, through its exit status, whether a match was found. This is how shell scripts ask a yes/no question:

if grep -q "PermitRootLogin no" /etc/ssh/sshd_config; then
    echo "Root login is disabled."
fi

grep stops at the first match with -q, so this is also the fastest way to test whether something exists.

8. Best Practices

• Always quote the pattern. Double quotes, or single quotes when the pattern contains a $, stop the shell from changing your pattern before grep sees it.
• Reach for -rn together in code. Recursive search with line numbers is the everyday combination for finding things in a project.
• Narrow big searches. Use --include and --exclude-dir so a recursive search stays fast and skips .git, caches, and binaries.
• Use -i when case is uncertain and -w when you want a whole word. They remove most "why did it match that" surprises.
• Use -F for literal text. When the pattern contains dots, slashes, or a version number, -F (fixed strings) avoids treating them as regex.
• Switch to -E for anything with |, +, or grouping. It keeps patterns readable instead of a wall of backslashes.
• Remember the exit code in scripts. Use -q for tests, and remember that "no match" is exit code 1, not a crash.

When you need the full detail, the documentation is one command away:

$ man grep        # the full manual page
$ grep --help     # a quick summary of every option

10. Summary

The grep command is how you find things in text on a Linux system, from one error in a giant log to a setting hidden in a tree of config files.

• grep is a filter: text flows in, and only the lines matching your pattern flow out.
• Its name is an acronym for the ed command g/re/p: global, regular expression, print. Ken Thompson wrote it for Unix around 1973.
• It is read-only and safe, and it searches files of any size because it works one line at a time.
• Everyday flags: -i (ignore case), -n (line numbers), -c (count), -v (invert), -w (whole word), -x (whole line).
• -r searches a whole tree; --include and --exclude-dir keep it fast and focused.
• The pattern is a regular expression. Use -E for the easier extended syntax and -F for a literal string.
• With no file, grep reads a pipe, which makes it the central filter in Linux command chains.
• It reports through exit codes 0, 1, and 2, and relatives like zgrep, git grep, and ripgrep extend the same idea.
• When in doubt, type man grep or grep --help.

This is the quick reference worth keeping:

grep "text" file        print lines containing text
grep -i "text" file     ignore upper/lower case
grep -n "text" file     show line numbers
grep -c "text" file     count matching lines
grep -v "text" file     print lines that do NOT match
grep -rn "text" dir/     search a whole tree, with line numbers
grep -rl "text" dir/     list only the file names that match
grep -w "word" file     match whole words only
grep -x "line" file     match whole lines only
grep -A3 -B2 "text" f    show 3 lines after, 2 before each match
grep -o "text" file     print only the matched part
grep -E "a|b|c" file     extended regex (alternation, +, ?)
grep -e a -e b file      several patterns at once
grep -f pats.txt file    read patterns from a file
grep -F "1.5.0" file     literal text, no regex
grep -I "text" dir/      skip binary files while searching
grep -q "text" file      quiet: exit 0 if found, for scripts
ps aux | grep name       filter another command's output
zgrep "text" file.gz     search inside a compressed log

Once grep feels natural, a Linux server stops being a black box. You can find a hidden setting, trace an error through a huge log, and pinpoint one line in a forest of code, all in seconds. If your systems are producing logs and files that someone needs to search, understand, and act on, that is exactly the kind of work I help with.