In this lecture, I'll show you how to search for a string pattern in a text file. 1
This is especially useful because the Linux configuration and log files are of typed text and it is 2
common to search for a specific option, message or error. 3
We’ll talk about the grep command. 4
Grep is one of the most useful Linux commands even though it was created by Ken Thomson, one of the 5
pioneers of computer science, as a private utility 6
more than 45 years ago. The grep command searches in a text file or output of another command for 7
a pattern referenced to as a regular expression and prints out all lines that contain the pattern. 8
To search for a pattern in a file you write grep, optionally some desired options, the pattern to 9
search for and the name of the file as a correct absolute or relative path. 10
I’m searching in the configuration file of the ssh client for the string `user`: grep the string, 11
the pattern and the file. 12
/etc/ssh/ssh_config 13
And it displayed all the lines that contained the string user. 14
There are two lines. 15
If the pattern contains spaces, you should enclose it in quotes like grep and between double quotes 16
let's say command line and the file, the same file. 17
And it found the lines that contained the pattern. 18
To ignore the latter case, use the -i option. 19
grep "SSH" writen in capitals and the file /etc/ssh/ssh_config 20
And it didn't find a thing. 21
Now I'm going to search it by ignoring the case, so I'm adding the -i option; -i comes from 22
insensitive. 23
And it found a lot of lines. 24
To print the line numbers, on which the pattern was found, at the -n option. 25
So -n and it pointed out the line number as well. 26
Of course, you can group multiple options, like this. 27
It's the same. 28
To search for whole words, use the w option, let's say grep body /etc/passwd 29
And you see that the group searches for any sequence of characters, not only whole words. 30
And it found the line that contains the string "nobody". 31
Now I'm adding the -w option. 32
And it searched for whole words and didn't find a thing. 33
To invert the sense of matching, so to select and non matching lines, use the -v option; v comes 34
from inverse. 35
So grep kernel /var/log/dmesg 36
It found a lot of lines that contained the string kernel 37
and now I'll invert the match. 38
And it found all the lines that do not contain the string kernel. If you want to search for a string 39
in a binary file as if it were a text file, use the -a option grep root /var/log/ 40
auth.log 41
And it says binary file, the name of the file, matches. 42
This is in fact a data file, a special kind of text file. 43
To search for a string in such a file, I have to add the -a option. 44
And it found all the lines that contained the string root. If you want to search for a string in a 45
directory it will return an error. 46
I'm searching for the loopback interface ip address in /etc. 47
So grep the ip address of the loopback interface 127.0.0.1 /etc/ 48
the directory and it says /etc is a directory. 49
What I can do is tell grep to go recursively in /etc and search for the pattern in every text file 50
in that directory and all its subdirectories. I'll use the- R option. 51
And it displayed all files that contain that string, which is the loopbeck interface ip address. Of 52
course, grep doesn't have the permissions to read all the files. 53
But I can run the command is root. 54
By the way, if you want to suppress error messages about the nonexisting or unreadable files add - s 55
option like this. 56
If you just want to see the number of the matches use the -c option. I'm searching for the 57
string error in a log file, so grep-c error 58
the pattern I'm searching for and the file var/ log/ syslog. 59
And it found 9 matches, so they are 9 lines that contain the string error. 60
Of course, I could get the same result by using a pipe and a wc-l command. 61
So grap error, the file 62
These are the lines and I'll pipe the output to wc-l. 63
Now, there are 10 lines; a new line was written to that file. 64
The grep command can be used to search in the output of another command as well. In the next example 65
I'll display the kernel ring buffer for using the dmesg command and then search for possible error messages. 66
dmesg - this is kernel ring buffer. 67
It's printing out the kernel ring buffer. These are kernel logs in the RAM most of them produced by 68
the device drivers; so I'm filtering the lines that contain the string error: 69
dmesg | grep error 70
And there's a single line. 71
If you want to see a context, and that means a few lines before and after the match, I can't run 72
grep -A 73
Let's say 3 and the -B 4 74
It printed out 4 lines before the match and 3 lines after it. 75
This is what the -A and -B do. 76
You can also use -C from context and the number and it will print out the same number of lines 77
before and after the match. 78
I want to see three lines before and after the match so -c 3 79
Lines before and 3 lines after. Another common example is to check what program is listening on a 80
specific port. To display all ports run: 81
netstat with some options; run it as root so sudo netstat -tupan 82
and 83
it has displayed all open ports; and to check if there is something that's listening on port 53, 84
filter the output using grep like this: 85
| grep 53 86
And there are some processes that listen on that port. 87
Let's check if port 80 is open and there is no process listening on port 80. Let's see the last example: 88
ls -RF /etc/ 89
I'm listing the etc directory recursively using the-F option, which adds a character at the 90
end of the file, depending on its type. 91
This is the output. 92
This is an executable file. 93
This is a symlink and these are directories. 94
The output will be piped to grep, which will exclude lines that contain a forward slash. 95
These are the directories. 96
So pipe grep 97
and -v to inverse the match, I want to exclude directories 98
There is no the directory in the output. 99
Then I'll exclude the empty lines; to do that, I'll use something special called the regular expression. 100
So pipe grep -v, I'm excluding the empty lines. 101
And now they're asking for an empty lines. 102
'^ and $' -^ means the beginning of the line and $ means the end of the line. 103
So in fact, I'm excluding the lines that have a character between the beginning and the end. 104
No empty lines. 105
Let's see how many they are;I'll pipe the output to wc -l 106
And there's this number! I can ignore those permission denied errors. 107
or I can run the command as root. 108
And finally, to sort of the files by name, I run the sort command on the output. 109
| sort -r 110
-r will do a reverse sorting. 111
without wc-l help, like this. 112
And the output was sorted by name in reverse alphabetical order. 113
To see it better, I can pipe everything to less. 114
Without the -r option it will sort of the output in ascending alphabetical order. 115
All files that start in A then the files that start in B, C and so on. And they can redirect the entire 116
output to a file is well. 117
See how I am using multiple different commands and pipes to get the data I want. 118
That's all. 119
Take your time to deeply understand how grep works. 120
It's one of the most useful Linux commands.