How to Search for content in files using grep, egrep, fgrep

Searching for Content in Files

You can search the content of files for either patterns or strings of characters by using the grep, egrep, and fgrep commands. The grep and egrep commands enable you to search the contents of one or more files for a specific character pattern. A pattern can be a single character, a string of characters, a word, or a sentence. A regular expression (RE) is either some plain text or special characters used for pattern-making.

The fgrep command enables you to search the contents of one or more files for a specific string. A string is a literal group of characters. The fgrep command does not use regular expressions.

Using the grep Command

The term grep means to globally search for a regular expression and print all lines containing it. When you use the grep command every line containing a specified character pattern prints to the screen. Using the grep command does not change file content.

The syntax for the grep command is:

$ grep options pattern filenames

The options that you use with the grep command can modify your search. Each option except the -w option can be used with the egrep and fgrep commands. The table below describes the options for the grep command.

Option Definition
-i Searches for both uppercase and lowercase characters
-l Lists the names of files with matching lines
-n Precedes each line with the relative line number in the file
-v Inverts the search to display lines that do not match pattern
-c Counts the lines that contain pattern
-w Searches for the expression as a complete word, ignoring those matches that are substrings of larger words

To search for all lines that contain the pattern root in the /etc/group file and view their line numbers, perform the command:

$ grep -n root /etc/group
1:root::0:root
2:other::1:root
3:bin::2:root,bin,daemon
4:sys::3:root,bin,adm
5:adm::4:root,daemon
6:uucp::5:root
7:mail::6:root
8:tty::7:root,adm
9:lp::8:root,adm
10:nuucp::9:root
12:daemon::12:roo
$

To search for all lines that do not contain the pattern root in the /etc/group file, perform the command:

$ grep -v root /etc/group
staff::10:
sysadmin::14:
smmsp::25:smmsp
gdm::50:
webservd::80:
nobody::60001:
noaccess::60002:
nogroup::65534:
$

To search for the names of the files that contain the pattern root in the /etc directory, perform the command:

$ cd /etc
$ grep -l  root group passwd hosts
group
passwd
$

To count the number of lines containing the pattern root in the /etc/group file, perform the command:

$ grep -c root group
11
$

The grep command supports several regular expression metacharacters to further define a search pattern. The table below describes some of the regular expression metacharacters.

Metacharacter Purpose Example Result
^ Beginning of line anchor ‘^pattern’ Matchesalllinesbeginning with pattern
$ End of line anchor ‘pattern$’ Matches all lines ending with pattern
. Matches one character ‘p…..n’ Matches lines containing a “p,” followed by five characters, and followed by an “n”
* Matches the preceding item zero or more times ‘[a-z]*’ Matches lowercase alphanumeric characters or nothing at all
[ ] Matches one character in the pattern ‘[Pp]attern’ Matches lines containing Pattern or pattern
[^] Matches one character not in the pattern ‘[^a-m]attern’ Matches lines that do not contain “a” through “m” and followed by attern

To print all lines that begin with the letters no in the /etc/passwd file, perform the command:

$ grep ’^no’ /etc/passwd
nobody:x:60001:60001:NFS Anonymous Access User:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:Linux NFS Anonymous Access User:/:
$

To print all lines containing an “A,” followed by three characters, followed by an “n” in the/etc/passwd file, perform the command:

$ grep ’A...n’ /etc/passwd
adm:x:4:4:Admin:/var/adm
lp:x:71:8:Line Printer Admin:/usr/spool/lp
uucp:x:5:5:uucp Admin:/usr/lib/uucp
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls

To print all lines that end with the word adm in the /etc/group file, perform the command:

$ grep ’adm$’ /etc/group
sys::3:root,bin,adm
tty::7:root,adm
lp::8:root,adm

Using the egrep Command

The egrep command searches the contents of one or more files for a pattern using extended regular expression metacharacters. Extended regular expression metacharacters include the regular expression metacharacters that the grep command uses, plus some additional metacharacters. The table below describes the additional metacharacters.

Metacharacter Purpose Sample Result
+ Matchesoneor more of the preceding characters ‘[a-z]+ark’ Matches one or more lowercase letters followed by ark (for example, airpark, bark,dark,landmark,shark, sparkle, or trademark
x/y Matches either x or y ‘apple orange’
( ) Groups characters ‘(1

The syntax for the egrep command is:

$ egrep -options pattern filenames

To search for all lines containing one or more lowercase alphabets followed by the pattern ‘body’ one or more times, perform the command:

$ egrep ’[a-z]+body’ /etc/passwd
nobody:x:60001:60001:NFS Anonymous Access User:/:
nobody4:x:65534:65534:Linux NFS Anonymous Access User:/:

To search for lines containing the pattern Network Admin or uucp Admin, perform the command:

$ egrep ’(Network|uucp) Admin’ /etc/passwd
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:

Using the fgrep Command

You can use the fgrep command to search a file for a literal string or a group of characters. The fgrep command reads all regular expression characters literally. Regular expression metacharacters have no special meaning to the fgrep command, for example, a ? character is interpreted as a question mark, and a $ character is interpreted as a dollar sign.

The syntaxfor the fgrep command is:

$ fgrep options string filenames

To search for all lines in the file containing a literal hash (#) character, perform the command:

$ fgrep '#' /etc/resolv.conf
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#