3.2b grep and Text Extraction Tools

Searching and extracting with the text toolkit (objective 3.2)

With pipes and redirection in place, objective 3.2 centers on grep plus a short list of viewing and shaping tools: less, cat, head, tail, sort, cut, and wc.

---

grep — match lines by pattern

grep (global regular expression print) prints every line that matches a pattern.

grep error app.log
grep "connection refused" /var/log/syslog

First argument: pattern. Remaining arguments: files (or omit files and read from a pipe).

grep -n -i timeout app.log
grep -r "TODO" ~/project/
grep -E "fail|error|fatal" app.log
ps aux | grep nginx

Contents vs names: grep looks inside files. A command like grep backup does not list files named backup — it prints lines containing that text. For name-based discovery you use directory tools (covered elsewhere); for Essentials 3.2, stay sharp on content search.

Quote patterns with spaces. Remember default patterns are regexes: escape dots when you mean a literal period (see the previous section).

Worked log search: Start broad, then narrow — grep -ni timeout app.log | head -n 40 samples numbered hits; pipe through grep -v healthcheck | wc -l to drop noise and count. Multi-file greps prefix each hit with the filename (useful for grep -n Listen /etc/apache2/*.conf).

---

Viewing: cat, less, head, tail

cat readme.txt
less /var/log/syslog
head -n 20 app.log
tail -n 50 app.log
tail -f /var/log/syslog      # follow — print new lines as they arrive

Use less when cat would flood the screen; head/tail for samples; tail -f to follow a growing log (Ctrl+C to stop).

Pipe grep into a pager when hits are numerous:

grep -n -i error app.log | less
grep -n -i error app.log | head -n 30

Exam trap: follow mode is tail -f, not head -f. cat dumps; it does not page like less.

---

sort, cut, and wc

sort names.txt                 # order lines
sort -n numbers.txt            # numeric when needed
cut -d: -f1 /etc/passwd        # field 1, colon-delimited
cut -d',' -f2,3 data.csv
wc -l app.log
grep -i error app.log | wc -l  # count matching lines

-d / -f on cut select delimiter and fields. Prefer cut for neat columns and grep for arbitrary line patterns. Choose by job: matching lines → grep; column → cut; count → wc; order → sort; window into a long file → head/tail/less.

---

Worked pipelines (exam-style)

1. Last errors in a log, case-insensitive

tail -n 200 app.log | grep -i error

2. Unique sorted list of usernames from passwd

cut -d: -f1 /etc/passwd | sort

3. Count HTTP 500 lines in an access log

grep " 500 " access.log | wc -l

4. Top of a frequency-style chain (sort, then inspect)

cut -d' ' -f1 access.log | sort | head

5. Config hunt with line numbers

grep -rn "db.example.com" /etc/myapp/ | less

6. Drop noise, then sample: grep -i error app.log | grep -v "benign_code" | head -n 15

7. Count without a temp file: grep -i exception app.log | wc -l (or redirect to a file first if you need to keep the extract).

---

Tool → purpose map

Common exam traps

Exam tips

• Map stories to flags: ignore case → -i; hide matches → -v; where in the file → -n; whole tree → -r; richer “or” patterns → -E.
• Prefer command | grep pattern over inventing temp files.
• head/tail default to 10 lines; override with -n.
• cut -d… -f… for columns; wc -l after grep for counts.
• Keep content search (grep) separate from “what is this file named?” thinking.

Narrating a one-line pipeline that shows and counts recent errors is exactly what objective 3.2 measures.