grep usage

grep usage

Table of Contents

• 1. variant programs
  • 1.1. grep -E
  • 1.2. grep -F
  • 1.3. grep -r
• 2. options
  • 2.1. Output Line Prefix Control
    • 2.1.1. -n
  • 2.2. File and Directory Selection
    • 2.2.1. -R
  • 2.3. Matcher Selection
• 3. examples
  • 3.1. 普通字符串查找
  • 3.2. 递归目录查找
  • 3.3. 正则表达式查找
  • 3.4. use regualar expression from file to search
  • 3.5. search all logs after 43 seconds
  • 3.6. 查找44秒到46秒的日志
  • 3.7. 查找44-46秒的包含某特定地址的日志
  • 3.8. 查找44秒到51秒的日志
• 4. others

We use grep to search file content usually.

1 variant programs

1.1 grep -E

same as egrep，使用正则表达式进行查找

1.2 grep -F

same as fgrep

1.3 grep -r

same as rgrep

2 options

2.1 Output Line Prefix Control

2.1.1 -n

Prefix each line of output with the 1-based line number within its input file.

2.2 File and Directory Selection

2.2.1 -R

Read all files under each directory, recursively. Follow all symbolic links, unlike -r.

2.3 Matcher Selection

Interpret PATTERN as a Perl regular expression (PCRE, see below). This is highly experimental and grep -P may warn ofunimplemented features.

grep supports three kinds of regular expressions, basic(BRE), extended(ERE), perl(PRCE). Wu usually use -P.

3 examples

3.1 普通字符串查找

output 1-based line number

grep -n 'login succeed' ./message_log 
6:2012-12-01 22:48:37; login, notice: login succeed. this:0x22b1770 address:000000000017 (sign.cc:186)
49:2012-12-01 22:49:44; login, notice: login succeed. this:0x22b1e00 address:000000000084 (sign.cc:186)
56:2012-12-01 22:49:50; login, notice: login succeed. this:0x22b2dd0 address:121030000007 (sign.cc:186)
66:2012-12-01 22:49:56; login, notice: login succeed. this:0x22b1770 address:000000000124 (sign.cc:186)

3.2 递归目录查找

用-R参数在当前目录下所有文件中递归查找

grep -n -R 'login_succeed' ./

3.3 正则表达式查找

-P 是指使用了perl风格的正则表达式. ^代表以2012…开头

grep -n -P '^2012-12-02 10:20:43' ./message_log 
348680:2012-12-02 10:20:43; head, notice: read head succeeded. (sign.cc:343)
348681:2012-12-02 10:20:43; head, notice: reading beatheart body..D1 this:0x22bcd00 address:121030000007 (sign.cc:366)
348682:2012-12-02 10:20:43; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bcd00 address:121030000007 (sign.cc:453)
348683:2012-12-02 10:20:43; login, notice: receive login request succeed, this:0x22b80c0 address: (sign.cc:124)
348684:2012-12-02 10:20:43; login, notice: login succeed. this:0x22b80c0 address:121030000013 (sign.cc:186)

3.4 use regualar expression from file to search

echo '^2012-12-02 10:20:43' > time_search
grep -n -f ./time_search ./message_log 
348680:2012-12-02 10:20:43; head, notice: read head succeeded. (sign.cc:343)
348681:2012-12-02 10:20:43; head, notice: reading beatheart body..D1 this:0x22bcd00 address:121030000007 (sign.cc:366)
348682:2012-12-02 10:20:43; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bcd00 address:121030000007 (sign.cc:453)
348683:2012-12-02 10:20:43; login, notice: receive login request succeed, this:0x22b80c0 address: (sign.cc:124)
348684:2012-12-02 10:20:43; login, notice: login succeed. this:0x22b80c0 address:121030000013 (sign.cc:186)
348685:2012-12-02 10:20:43; login, notice: ReadLoginRequestTimer was canceled, this:0x22b80c0 (sign.cc:100)

3.5 search all logs after 43 seconds

grep -n -P '^2012-12-02 10:20:4[456789]' ./message_log 
348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348701:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b1770 address:000000000124 (sign.cc:366)
348702:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b1770 address:000000000124 (sign.cc:453)

用来匹配大于3的数字，方括号就是数学里面的集合的意思

3.6 查找44秒到46秒的日志

grep -n -P '^2012-12-02 10:20:4[456]' ./message_log 
348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)

使用了更小的查找范围

3.7 查找44-46秒的包含某特定地址的日志

grep -n -P '^2012-12-02 10:20:4[456].+address:000000000123' ./message_log 
348737:2012-12-02 10:20:46; head, notice: reading beatheart body..D1 this:0x22b5030 address:000000000123 (sign.cc:366)
348738:2012-12-02 10:20:46; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b5030 address:000000000123 (sign.cc:453)

.+ 代表时间和地址之间可以有至少一个字符。

3.8 查找44秒到51秒的日志

grep -n -P '^2012-12-02 10:20:(4[456789]|5[01])' ./message_log 
348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
348701:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b1770 address:000000000124 (sign.cc:366)
348702:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b1770 address:000000000124 (sign.cc:453)

这里用到了| 表示逻辑或，左边的匹配条件表示44-49分，右边的匹配条件表示50-51

() 圆括号用来限定| 操作符的作用范围

可以看到，正则表达式是grep的核心查找引擎，供参考：baiduzhidao

4 others

对当前目录html文件查找，要用参数 *.html

对子目录下的html文件查找，要用*/**.html

Author: Dean Chen

Created: 2016-02-01 一 14:27

Validate