grep Cheat Sheet

grep -i 'error' app.log              # case-insensitive match
grep -rn 'TODO' src/                 # recursive, with line numbers
grep -v '^#' config.conf             # lines that do NOT match
grep -E 'warn|error|crit' syslog     # extended regex (alternation)
grep -c 'Failed password' auth.log   # count matching lines
grep -C 3 'panic' kern.log           # 3 lines of context around each hit

Syntax: grep [options] PATTERN [file...]. With no file, grep reads standard input, so it works at the end of any pipe. Exit status is 0 if a line matched, 1 if nothing matched and 2 on error, which makes grep useful in scripts. For the commands that usually sit around grep in a pipeline, see the essential Linux commands guide.

Basic matching

Regular expressions

By default grep uses basic regular expressions (BRE), where + ? | ( ) { } need a backslash to be special. -E switches to extended regex (ERE), where they work unescaped. -P uses Perl-compatible regex (PCRE2) for lookarounds, \d and non-greedy matches.

Searching files and directories

Controlling output

Common recipes

Find failed SSH logins and count them by IP (on systemd systems the log may only be in the journal; see the journalctl cheat sheet):

grep 'Failed password' /var/log/auth.log | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -rn | head
journalctl -u ssh --since today | grep -c 'Failed password'

Show a config file without comments and blank lines:

grep -Ev '^\s*(#|$)' /etc/ssh/sshd_config

Find which files define a function, excluding vendored code:

grep -rn --include='*.js' --exclude-dir={node_modules,dist} 'function initApp' .

Check whether a process is running without matching the grep itself:

ps aux | grep '[n]ginx'
pgrep -a nginx     # simpler alternative

Extract all email addresses or IPv4 addresses from a file:

grep -oE '[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}' file.txt | sort -u
grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' access.log | sort | uniq -c | sort -rn

Use grep in a script condition:

if grep -q '^myuser:' /etc/passwd; then
    echo "user exists"
fi

Replace text in every file that contains it (grep finds, sed edits):

grep -rlZ 'old.example.com' /etc/nginx/ | xargs -0 sudo sed -i 's/old\.example\.com/new.example.com/g'

Watch a log live and only show matching lines:

tail -f /var/log/nginx/error.log | grep --line-buffered -i 'upstream'

Gotchas

• Quote your pattern. Without quotes the shell expands *, ? and [ ] before grep sees them. Use single quotes unless you need a shell variable, then use double quotes: grep "$USER" /etc/passwd.
• grep -P is not everywhere. GNU grep on Ubuntu, Debian, Fedora and Arch is built with PCRE2, but BusyBox grep (Alpine, many containers, embedded systems) and BSD/macOS grep lack -P. Stick to -E in portable scripts.
• egrep and fgrep warn. Since GNU grep 3.8 they print "warning: egrep is obsolescent". Use grep -E and grep -F.
• -c counts lines, not matches. A line with three hits counts once. For every occurrence, use grep -o 'x' file | wc -l.
• grep pattern * can fail on huge directories with Argument list too long. Use grep -r pattern . or find with -exec grep ... {} +.
• Buffered output in pipelines. When grep writes to a pipe it buffers output, so tail -f | grep | other seems stuck. Add --line-buffered.
• Locale affects ranges and speed. [a-z] can match accented letters in some locales; prefix LC_ALL=C for byte-wise matching and a large speedup on big files.
• Exit status 1 is not an error. With set -e in a script, a grep that finds nothing stops the script. Use grep ... || true where no match is acceptable.

For a faster recursive search in code trees, ripgrep (rg) is packaged on every major distro and respects .gitignore by default. The full GNU grep reference is in the GNU grep manual.

Frequently asked questions