Grep Command Cheat Sheet
Search logs, filter patterns, and find the exact text you need without drowning in output.
Before you start
Basic Text Search
The simplest grep usage is searching a file for a keyword or phrase. This is the foundation for almost everything else.
grep "error" /var/log/app.log
grep "listen 80" /etc/nginx/nginx.conf
grep "DB_HOST" .envThe goal is not just to search text. It is to quickly confirm whether a file contains the exact setting, error, or keyword you care about.
Case-Insensitive Search
Use case-insensitive matching when letter case is inconsistent or unknown. This is common in logs, mixed configuration, or copied data.
grep -i "warning" /var/log/app.log
grep -i "mysql" /etc/* 2>/dev/null
If case sensitivity is not important for the task, -i saves time and reduces missed matches caused by capitalization differences.
Recursive Search in Directories
When you need to search across many files or an entire project, use recursive search. This is common when tracing configuration or locating where a keyword appears in application code.
grep -r "localhost" /var/www/project
grep -r "proxy_pass" /etc/nginx
grep -r "TODO" /home/example/appRecursive search is powerful, but can produce a lot of noise if the path includes logs, cache, vendor libraries, or generated assets. Use exclusions when needed.
Show Line Numbers and Context
A match without context is often not enough. Line numbers and surrounding lines make the result much more useful when reading logs or code.
grep -n "server_name" /etc/nginx/sites-enabled/default
grep -nC 3 "ERROR" /var/log/app.log
grep -nA 5 "location /api" /etc/nginx/nginx.conf
-n adds line numbers, -C shows both before and after context, and -A shows lines after a match. This is especially useful when a single matched line does not explain enough by itself.
Search Logs Efficiently
Log searching is one of the most valuable real-world uses of grep. The key is to search for the right term, in the right file, at the right level of specificity.
grep "ERROR" /var/log/app.log
grep "Connection refused" /var/log/messages
grep " 500 " /var/log/nginx/access.log
grep "PHP Fatal error" /var/log/php-fpm/error.logDo not just search for generic words like error everywhere. Search by actual symptoms such as status codes, exception phrases, database failures, or service-specific messages.
Exclude Noise in Large Searches
When searching large codebases or system directories, excluding irrelevant paths can make grep dramatically more useful.
grep -r --exclude="*.log" "password" /home/example/app
grep -r --exclude-dir="vendor" "DB_HOST" /var/www/project
grep -r --exclude-dir="node_modules" "axios" /home/example/frontendWithout exclusions, recursive grep often returns results from files you do not care about. Excluding bulky or irrelevant directories makes the result operationally meaningful.
Combine Grep with Other Commands
In real troubleshooting, grep is often used as a filter on command output rather than on a static file. This is where it becomes especially powerful.
ps aux | grep nginx
ss -tuln | grep 3306
journalctl -u nginx | grep "failed"
tail -f /var/log/app.log | grep "timeout"This pattern is ideal when the source data is generated dynamically, such as process lists, open ports, service logs, or live log streams.
Real example
A service keeps failing, but the full log file is too large to review manually. Instead of opening the entire file, an administrator uses grep -nC 3 "Connection refused" /var/log/app.log and immediately sees the exact error with useful context around it. That makes it possible to identify the related dependency failure much faster than reading the file line by line.
This is why grep is so useful in operations: it reduces huge text output into small, actionable evidence.
Possible causes
- You need to locate an error, warning, or status code inside a log
- You need to find where a configuration value appears in project or server files
- You need to confirm whether a string or environment variable exists in a file set
- You need to reduce command output to only relevant matching lines
- You need to inspect code or configuration across many directories quickly
Common mistakes
- Using recursive grep on a huge path without exclusions
- Searching for overly broad terms that produce meaningless noise
- Ignoring context and line numbers when the result needs interpretation
- Forgetting case-insensitive search when capitalization is inconsistent
- Using grep alone when the real issue requires better path selection or time filtering first
Environment tips
- For logs, search for precise phrases, status codes, or known failure patterns instead of generic words.
- For projects, use exclusions to skip vendor, node_modules, cache, compiled assets, and generated directories.
- For troubleshooting, combine grep with journalctl, ps, ss, tail, or cat output in a pipeline.
- For deeper interpretation, use line numbers and surrounding context rather than isolated matched lines only.
About this guide
This is a complete grep reference for real Linux troubleshooting and text search work. It covers the command patterns most people actually use in production: searching logs, filtering errors, locating keywords in project files, doing recursive searches, excluding noise, and combining grep with other commands in a practical workflow.
How to follow this guide
- Start with a simple grep search to confirm the target text exists.
- Use case-insensitive or recursive search options only when they are truly needed.
- Combine grep with log or process commands when troubleshooting server issues.
- Use line numbers and context output to understand where and how a match appears.
- Reduce noise with exclusion options instead of scanning everything blindly.
Why use this method?
grep is one of the most useful commands on Linux because real server work often comes down to finding the right line in the right file at the right time. Whether you are checking logs, tracing configuration, confirming errors, or searching application code, grep turns large text output into something operationally usable.
Frequently Asked Questions
What is grep used for?
grep searches text for matching patterns. In practice it is heavily used for logs, configuration files, source code, process output, and pipeline filtering.
What is the difference between grep and find?
grep searches inside file content, while find searches for files and directories based on file attributes. Many real workflows use find to locate files and grep to inspect their contents.
Why does grep sometimes return too much noise?
Because the search pattern may be too broad, the path may be too large, or recursive searches may include irrelevant directories, binary files, or generated assets.
Should I use grep for logs?
Yes. grep is one of the fastest ways to filter logs for specific errors, keywords, status codes, user IDs, or timestamps when investigating incidents.