Guides

Step-by-step tutorials and practical fixes for servers, systems, email, and daily technical work.
Linux Guides

Grep Command Cheat Sheet

Search logs, filter patterns, and find the exact text you need without drowning in output.

Before you start

You need shell access to the Linux server or the relevant working directory.
A narrow path and a specific keyword are usually more useful than a broad recursive search.
For production troubleshooting, combine grep with logs, ps, ss, journalctl, tail, or cat output instead of using it in isolation.

Basic Text Search

The simplest grep usage is searching a file for a keyword or phrase. This is the foundation for almost everything else.

Examples 
grep "error" /var/log/app.log
grep "listen 80" /etc/nginx/nginx.conf
grep "DB_HOST" .env
Why this matters

The goal is not just to search text. It is to quickly confirm whether a file contains the exact setting, error, or keyword you care about.

Case-Insensitive Search

Use case-insensitive matching when letter case is inconsistent or unknown. This is common in logs, mixed configuration, or copied data.

Examples 
grep -i "warning" /var/log/app.log
grep -i "mysql" /etc/* 2>/dev/null
When to use it

If case sensitivity is not important for the task, -i saves time and reduces missed matches caused by capitalization differences.

Recursive Search in Directories

When you need to search across many files or an entire project, use recursive search. This is common when tracing configuration or locating where a keyword appears in application code.

Examples 
grep -r "localhost" /var/www/project
grep -r "proxy_pass" /etc/nginx
grep -r "TODO" /home/example/app
Practical note

Recursive search is powerful, but can produce a lot of noise if the path includes logs, cache, vendor libraries, or generated assets. Use exclusions when needed.

Show Line Numbers and Context

A match without context is often not enough. Line numbers and surrounding lines make the result much more useful when reading logs or code.

Examples 
grep -n "server_name" /etc/nginx/sites-enabled/default
grep -nC 3 "ERROR" /var/log/app.log
grep -nA 5 "location /api" /etc/nginx/nginx.conf
Useful options

-n adds line numbers, -C shows both before and after context, and -A shows lines after a match. This is especially useful when a single matched line does not explain enough by itself.

Search Logs Efficiently

Log searching is one of the most valuable real-world uses of grep. The key is to search for the right term, in the right file, at the right level of specificity.

Examples 
grep "ERROR" /var/log/app.log
grep "Connection refused" /var/log/messages
grep " 500 " /var/log/nginx/access.log
grep "PHP Fatal error" /var/log/php-fpm/error.log
Operational mindset

Do not just search for generic words like error everywhere. Search by actual symptoms such as status codes, exception phrases, database failures, or service-specific messages.

Exclude Noise in Large Searches

When searching large codebases or system directories, excluding irrelevant paths can make grep dramatically more useful.

Examples 
grep -r --exclude="*.log" "password" /home/example/app
grep -r --exclude-dir="vendor" "DB_HOST" /var/www/project
grep -r --exclude-dir="node_modules" "axios" /home/example/frontend
Why this is important

Without exclusions, recursive grep often returns results from files you do not care about. Excluding bulky or irrelevant directories makes the result operationally meaningful.

Combine Grep with Other Commands

In real troubleshooting, grep is often used as a filter on command output rather than on a static file. This is where it becomes especially powerful.

Examples 
ps aux | grep nginx
ss -tuln | grep 3306
journalctl -u nginx | grep "failed"
tail -f /var/log/app.log | grep "timeout"
Real use

This pattern is ideal when the source data is generated dynamically, such as process lists, open ports, service logs, or live log streams.

Real example

A service keeps failing, but the full log file is too large to review manually. Instead of opening the entire file, an administrator uses grep -nC 3 "Connection refused" /var/log/app.log and immediately sees the exact error with useful context around it. That makes it possible to identify the related dependency failure much faster than reading the file line by line.

This is why grep is so useful in operations: it reduces huge text output into small, actionable evidence.

Possible causes

  • You need to locate an error, warning, or status code inside a log
  • You need to find where a configuration value appears in project or server files
  • You need to confirm whether a string or environment variable exists in a file set
  • You need to reduce command output to only relevant matching lines
  • You need to inspect code or configuration across many directories quickly

Common mistakes

  • Using recursive grep on a huge path without exclusions
  • Searching for overly broad terms that produce meaningless noise
  • Ignoring context and line numbers when the result needs interpretation
  • Forgetting case-insensitive search when capitalization is inconsistent
  • Using grep alone when the real issue requires better path selection or time filtering first

Environment tips

  • For logs, search for precise phrases, status codes, or known failure patterns instead of generic words.
  • For projects, use exclusions to skip vendor, node_modules, cache, compiled assets, and generated directories.
  • For troubleshooting, combine grep with journalctl, ps, ss, tail, or cat output in a pipeline.
  • For deeper interpretation, use line numbers and surrounding context rather than isolated matched lines only.