6.6 Regular Expressions & grep, egrep, fgrep (103.7)

6.6 Regular Expressions & grep, egrep, fgrep

Quick Summary: Regular Expressions (Regex) provide a formal pattern-matching grammar for scanning, parsing, and filtering text streams in Linux. POSIX defines two primary dialects: Basic Regular Expressions (BRE) and Extended Regular Expressions (ERE). Administrators use the grep family—comprising standard grep (BRE), egrep / grep -E (ERE), and fgrep / grep -F (fixed literal string matching)—to locate log patterns, extract configuration parameters, and audit system files.

---

1. Regular Expression Flavors: BRE vs. ERE

The fundamental distinction between Basic and Extended Regular Expressions lies in how metacharacters and quantifiers are interpreted by default.

⚠️ LPIC-1 Trap — The Escaping Inversion:

• In BRE (grep): +, ?, { }, ( ), and | are treated as literal characters unless escaped with a backslash (\+, \?, \{ \}, \( \), \|).
• In ERE (grep -E / egrep): +, ?, { }, ( ), and | are metacharacters by default. Escaping them (\+) forces literal matching!

---

2. Anchors, Wildcards & Character Classes

Positional Anchors

• ^ (Caret): Anchors match to the beginning of the line. ^root matches lines starting with root.
• $ (Dollar): Anchors match to the end of the line. bash$ matches lines ending with bash.
• ^$: Matches lines with zero characters between start and end (empty/blank lines).
• ^root$: Matches lines containing only the exact string root and nothing else.

Bracket Expressions (Character Sets)

Bracket expressions define character sets matching any single character contained within the brackets:

• [abc]: Matches either a, b, or c.
• [a-z]: Matches any lowercase alphabetic letter.
• [0-9]: Matches any numeric digit.
• [^abc]: Negation (Inverted Set) — Matches any single character except a, b, or c when ^ is the first character inside the brackets.

POSIX Character Classes

POSIX defines locale-aware character class aliases that must be enclosed inside an outer set of brackets ([[:class:]]):

# Match any line containing a 3-digit number:
$ grep '[[:digit:]][[:digit:]][[:digit:]]' /var/log/syslog

---

3. The grep Family & Command-Line Flags

The GNU grep suite contains three command variants:

1. grep: Searches files using standard POSIX Basic Regular Expressions (BRE).
2. egrep (or grep -E): Searches files using Extended Regular Expressions (ERE).
3. fgrep (or grep -F): Searches for Fixed literal strings. It disables all regex parsing, making it extremely fast when searching for exact strings containing dots, brackets, asterisks, or dollar signs.

Essential grep Command-Line Flags

---

4. Practical Configuration & Log Filtering Recipes

Recipe 1: Stripping Comments and Blank Lines from Config Files

A quintessential system administration task tested on LPIC-1 is inspecting active configuration parameters while filtering out comment lines (starting with #) and empty lines:

# Method 1: Chaining standard grep commands:
$ grep -v '^#' /etc/ssh/sshd_config | grep -v '^$'

# Method 2: Single command using Extended Regular Expressions (ERE):
$ grep -Ev '^(#|$)' /etc/ssh/sshd_config

# Method 3: Handling leading whitespace before comment markers:
$ grep -Ev '^[[:space:]]*(#|$)' /etc/ssh/sshd_config

Input File (/etc/ssh/sshd_config):     Filtered Output (`grep -Ev '^(#|$)'`):
┌───────────────────────────────────┐  ┌───────────────────────────────────┐
│ # OpenSSH Daemon Config           │  │ Port 22                           │
│ Port 22                           │  │ PermitRootLogin no                │
│                                   │  │ PasswordAuthentication yes        │
│ # Security Settings               │  └───────────────────────────────────┘
│ PermitRootLogin no                │
│ PasswordAuthentication yes        │
└───────────────────────────────────┘

Recipe 2: Matching IP Addresses with ERE

# Find IPv4 addresses in access logs using ERE interval quantifiers:
$ grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' /var/log/nginx/access.log

Recipe 3: Fast Fixed-String Search with fgrep

# Search for literal string '$USER[0]' without escaping metacharacters:
$ fgrep '$USER[0]' /opt/scripts/*.sh
# Or using grep -F:
$ grep -F '$USER[0]' /opt/scripts/*.sh

💡 LPIC-1 Exam Fill-in-the-Blank Alert: What grep command option enables Extended Regular Expression (ERE) pattern interpretation? Answer: -E (or --extended-regexp)