In this article, we are going to provide you with useful examples of Linux grep command including the two variant programs: egrep and fgrep. grep (global regular expression print) is used to search for text strings and regular expressions line by line which match a specified pattern within one or more files.
Listed below are some simple and useful examples of how to use the grep command on Linux and search for a string in one/multiple files.
Search for lines containing ‘DB_USER’ in WordPress configuration file (wp-config.php):
# grep 'DB_USER' wp-config.php
define('DB_USER', 'wpuser');
Search for all PHP files containing ‘str_replace’ text inside the ‘wp-admin’ directory of a WordPress installation:
# # grep "str_replace" admin*.php admin-ajax.php: add_action( 'wp_ajax_' . $_GET['action'], 'wp_ajax_' . str_replace( '-', '_', $_GET['action'] ), 1 ); admin-ajax.php: add_action( 'wp_ajax_' . $_POST['action'], 'wp_ajax_' . str_replace( '-', '_', $_POST['action'] ), 1 ); admin-header.php:$admin_body_class .= ' branch-' . str_replace( array( '.', ',' ), '-', floatval( $wp_version ) ); admin-header.php:$admin_body_class .= ' version-' . str_replace( '.', '-', preg_replace( '/^([.0-9]+).*/', '$1', $wp_version ) ); admin-header.php:$admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
If you want to add line numbers to search results, use the following command:
# grep -n "str_replace" admin*.php admin-ajax.php:73: add_action( 'wp_ajax_' . $_GET['action'], 'wp_ajax_' . str_replace( '-', '_', $_GET['action'] ), 1 ); admin-ajax.php:76: add_action( 'wp_ajax_' . $_POST['action'], 'wp_ajax_' . str_replace( '-', '_', $_POST['action'] ), 1 ); admin-header.php:157:$admin_body_class .= ' branch-' . str_replace( array( '.', ',' ), '-', floatval( $wp_version ) ); admin-header.php:158:$admin_body_class .= ' version-' . str_replace( '.', '-', preg_replace( '/^([.0-9]+).*/', '$1', $wp_version ) ); admin-header.php:160:$admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
Search for all PHP files whose contents mention ‘str_replace’ text which has either capital or small letters in it, located in the ‘wp-admin’ directory recursively (i.e. read all files under each directory) and list the file names only:
# grep -ril "str_replace" admin*.php admin-ajax.php admin-header.php
grep command is often used in a Unix/Linux pipeline with other commands. Listed below are some more advanced examples of how to use the grep command on Linux:
Search for lines containing ‘eval’ in all PHP files located in the current directory:
#find . -name '*.php' -exec grep -l 'eval' {} ;
./wp-admin/includes/image.php
./wp-admin/includes/class-wp-upgrader.php
./wp-admin/includes/class-pclzip.php
./wp-admin/includes/media.php
./wp-admin/includes/update-core.php
./wp-admin/includes/ajax-actions.php
./wp-admin/includes/class-wp-automatic-updater.php
./wp-admin/includes/class-wp-posts-list-table.php
./wp-admin/user-edit.php
./wp-admin/edit-tag-form.php
List all Apache processes:
# ps aux | grep http root 1259 0.0 0.0 114644 984 pts/0 S+ 01:37 0:00 grep --color=auto http root 1471 0.0 2.3 502008 24508 ? Ss Jun27 0:03 /usr/sbin/httpd -k start nobody 31256 0.0 3.8 510140 40412 ? S 00:00 0:01 /usr/sbin/httpd -k start nobody 31257 0.0 4.2 510220 44404 ? S 00:00 0:02 /usr/sbin/httpd -k start nobody 31258 0.0 4.5 511156 47924 ? S 00:00 0:02 /usr/sbin/httpd -k start nobody 31259 0.0 5.4 514240 56648 ? S 00:00 0:02 /usr/sbin/httpd -k start nobody 31260 0.0 3.9 510388 41668 ? S 00:00 0:01 /usr/sbin/httpd -k start nobody 31585 0.0 4.2 511156 44188 ? S 00:13 0:01 /usr/sbin/httpd -k start
See which sockets belong to process ID 31585:
# lsof -p 31585 | grep -Ei 'cwd|unix|sock' httpd 31585 nobody cwd DIR 144,142 4096 35120509 / httpd 31585 nobody mem REG 8,18 38427466 /opt/cpanel/ea-php56/root/usr/lib64/php/modules/sockets.so (path dev=144,142) httpd 31585 nobody mem REG 8,18 36064050 /usr/lib64/apache2/modules/mod_unixd.so (path dev=144,142)
Display total number of Apache connections on port 80:
# netstat -an | grep :80 |wc -l 1627
Remove all frozen messages in Exim mail queue immediately:
#exim -bpr | grep frozen | awk {'print $3'} | xargs exim -Mrm
Message 1dPhFh-0000t6-D0 has been removed
Message 1dPenR-0000Ls-S8 has been removed
Message 1dPexx-0000OD-A6 has been removed
Find files containing a text pattern (e.g. hello):
find . -iname "*.txt" -exec grep -l "hello" {} +
To search for multiple patterns at one time, you can simply use the egrep command. egrep is the same as grep -E.
#egrep 'cachedir|exclude' /etc/yum.conf cachedir=/var/cache/yum/$basearch/$releasever exclude=lm_sensors*
The fgrep searches a file or list of files for a fixed pattern string. fgrep is the same as grep –F.
#fgrep 'cachedir' /etc/yum.conf cachedir=/var/cache/yum/$basearch/$releasever