grep Command Cheat Sheet — All Flags & Usage Examples

grep [OPTIONS] PATTERN [FILE...]
  -i        # case-insensitive
  -v        # invert match (lines NOT matching)
  -r / -R   # recursive (R follows symlinks)
  -n        # show line numbers
  -l        # only print filenames with matches
  -L        # only print filenames WITHOUT matches
  -c        # count of matching lines per file
  -o        # print only the matching part
  -w        # match whole words
  -x        # match whole lines
  -E        # extended regex (egrep)
  -F        # fixed string, no regex (fgrep)
  -P        # Perl-compatible regex (PCRE)
  -A N      # N lines after match
  -B N      # N lines before match
  -C N      # N lines of context (before AND after)
  --include='GLOB'   # only search matching files
  --exclude-dir=DIR  # skip directories

# Basic search
grep 'ERROR' /var/log/syslog

# Multiple files
grep 'timeout' /var/log/nginx/*.log

# Read from stdin
journalctl -u sshd | grep 'Failed password'

# Search recursively under a directory
grep -r 'TODO' src/

# Use -e to combine multiple patterns
grep -e 'ERROR' -e 'WARN' -e 'CRITICAL' app.log

# Find IP addresses (basic POSIX regex with -E)
grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' access.log

# Lines starting with ERROR
grep '^ERROR' app.log

# Lines ending in a digit
grep '[0-9]$' data.txt

# Empty lines
grep '^$' file.txt

# Non-empty lines (invert empty)
grep -v '^$' file.txt

# Comments and blanks (typical for cleaning configs)
grep -Ev '^(#|$)' /etc/ssh/sshd_config

# Case-insensitive recursive search with line numbers
grep -rin 'connection refused' /var/log/

# Count occurrences per file
grep -c 'ERROR' /var/log/*.log

# Only print filenames that contain a match
grep -rl 'API_KEY' .

# Exclude vendor and node_modules from a code search
grep -r 'TODO' . --exclude-dir={node_modules,vendor,.git}

# Search only Python files
grep -rn --include='*.py' 'import requests' .

# Show 3 lines of context around each match
grep -C 3 'segfault' /var/log/kern.log

# Find failed SSH logins with usernames
grep 'Failed password' /var/log/auth.log | awk '{print $9, $11}'

# Pull all 5xx responses from an Nginx access log
grep -E ' 5[0-9]{2} ' /var/log/nginx/access.log

# Locate a process listening on a specific port
ss -tnlp | grep ':443'

# Find all files containing a deprecated API call
grep -rln --include='*.go' 'ioutil.ReadAll' .

# Extract just the matching email addresses
grep -oE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+' contacts.txt

# Show 10 lines after every "panic" entry
grep -A 10 'panic:' /var/log/syslog

# Combine -F with a file of fixed strings (huge speedup)
grep -Ff blocked_ips.txt access.log

# Set GREP_COLORS for custom highlight (or use --color=always)
export GREP_COLOR='1;31'   # bright red matches
export GREP_OPTIONS=''     # avoid (deprecated, breaks scripts)

# Use --color=auto in interactive shells, never in scripts
alias grep='grep --color=auto'

# When grep is too slow, switch to ripgrep (rg) — same flags
rg -i 'pattern' .

# Use -P for lookarounds and \d shortcuts (PCRE)
grep -P '(?<=user=)\w+' /var/log/auth.log