Search file(s) for specific text.
Syntax grep <options> "Search String" [filename] grep <options> [-e PATTERN] [FILE...] grep <options> [-f FILE] [FILE...] A simple example grep "Needle in a Haystack" /etc/*
Grep searches the named input FILEs (or standard input if no files are named, or the file name - is given) for lines containing a match to the given PATTERN. By default, grep prints the matching lines.
In addition, two variant programs egrep and fgrep are available. Egrep is the same as grep -E. Fgrep is the same as grep -F.
Options -A NUM --after-context=NUM Print NUM lines of trailing context after matching lines. Places a line containing -- between contiguous groups of matches. -a --text Process a binary file as if it were text; this is equivalent to the --binary-files=text option. -B NUM --before-context=NUM Print NUM lines of leading context before matching lines. Places a line containing -- between contiguous groups of matches. -b --byte-offset Print the byte offset within the input file before each line of output. --colour[=WHEN] --color[=WHEN] Surround the matching string with the marker from the GREP_COLOR environment variable. WHEN can be 'never', 'always', or 'auto' e.g. --color=always
By default the matched text will be colored red. If grep is made to match several strings, all of the matches will be colored, one exception is the regex ^ (match beginning of every line), the beginning of a line has no length so will not be coloued. So to return all lines and colour only matches: egrep --color=always '^|string1|string2' -C NUM --context=NUM Print NUM lines of output context. Print num lines of leading and trailing context surrounding each match. The default is 2 and is equivalent to -A 2 -B 2. Note: no whitespace may be given between the option and its argument. -c --count Suppress normal output; instead print a count of matching lines for each input file. With the -v, --invert-match option (see below), count non-matching lines. -D ACTION --devices=ACTION If an input file is a device, FIFO or socket, use ACTION to process it. By default, ACTION is read, which means that devices are read just as if they were ordinary files. If ACTION is skip, devices are silently skipped. -d ACTION --directories=ACTION If an input file is a directory, use ACTION to process it. By default, ACTION is read, which means that directories are read just as if they were ordinary files. If ACTION is skip, directories are silently skipped. If ACTION is recurse, grep reads all files under each directory, recursively; this is equivalent to the -R and -r option. -E --extended-regexp Interpret PATTERN as an extended regular expression -e PATTERN --regexp=PATTERN Use PATTERN as the pattern; useful to protect patterns beginning with - -F --fixed-strings Interpret PATTERN as a list of fixed strings, separated by newlines, any of which is to be matched. -f FILE --file=FILE Obtain patterns from FILE, one per line. The empty file contains zero patterns, and therefore matches nothing. -G --basic-regexp Interpret PATTERN as a basic regular expression This is the default. -H --with-filename Print the filename for each match. -h --no-filename Suppress the prefixing of filenames on output when multiple files are searched. --help Output a brief help message. -I Process a binary file as if it did not contain matching data; this is equivalent to the --binary-files=without-match option. -i --ignore-case Ignore case distinctions in both the PATTERN and the input files. --include If specified, only files matching the given filename pattern are searched. Note that --exclude patterns take priority over --include patterns. Patterns are matched to the full path specified, not only to the filename component. --include-dir If -R is specified, only directories matching the given filename pattern are searched. Note that --exclude-dir patterns take priority over --include-dir patterns. -L --files-without-match Suppress normal output; instead print the name of each input file from which no output would normally have been printed. The scanning will stop on the first match. -l --files-with-matches Suppress normal output; instead print the name of each input file from which output would normally have been printed. The scanning will stop on the first match. -m NUM --max-count=NUM Stop reading a file after NUM matching lines. If the input is standard input from a regular file, and NUM matching lines are output, grep ensures that the standard input is positioned to just after the last matching line before exiting, regardless of the presence of trailing context lines. This enables a calling process to resume a search. When grep stops after NUM matching lines, it outputs any trailing context lines. When the -c or --count option is also used, grep does not output a count greater than NUM. When the -v or --invert-match option is also used, grep stops after outputting NUM non-matching lines. -n --line-number Prefix each line of output with the line number within its input file. --null Print a zero-byte after the file name. -O If -R is specified, follow symbolic links only if they were explicitly listed on the command line. The default is not to follow symbolic links. -o --only-matching Show only the part of a matching line that matches PATTERN. -p If -R is specified, no symbolic links are followed. This is the default. -q --quiet --silent Quiet mode: suppress normal output. grep will only search a file until a match has been found, making searches potentially less expensive. -R -r --recursive Read all files under each directory, recursively This is equivalent to the -d recurse option. -s --no-messages Silent mode. Nonexistent and unreadable files are ignored (i.e. their error messages are suppressed). -U --binary Search binary files, but do not attempt to print them. -V --version Display version information and exit. -v --invert-match Selected lines are those not matching any of the specified patterns. -w --word-regexp The expression is searched for as a word (as if surrounded by `[[:<:]]' and `[[:>:]]'; see re_format(7)). -x --line-regexp Only input lines selected against an entire fixed string or regular expression are considered to be matching lines. -y Equivalent to -i. Obsoleted. -Z -z --decompress Force grep to behave as zgrep. --binary-files=value Controls searching and printing of binary files. Options are binary, the default: search binary files but do not print them; without-match: do not search binary files; and text: treat all files as text. --context[=num] Print num lines of leading and trailing context. The default is 2. --line-buffered Force output to be line buffered. By default, output is line buffered when standard output is a terminal and block buffered otherwise.
If no file arguments are specified, the standard input is used.
Grep's behavior can be affected by setting the following environment variables
GREP_OPTIONS - default options LC_ALL, LC_MESSAGES, LANG - language for messages LC_CTYPE - foreign characters POSIXLY_CORRECT - Posix behaviour _N_GNU_nonoption_argv_flags_ - ignore an operand see `info grep' for more
Search the file example.txt, including binary data (-a) for the string 'hunting the snark':
$ sudo grep -a 'hunting the snark' example.txt
Search the whole partition (/disk0), including binary data (-a) for the string 'hunting the snark' return all the lines
starting 25 Before the text found and 50 lines After the matching text found, this can be a way to discover fragments of deleted files:
$ sudo grep -a -B 25 -A 50 'hunting the snark' /dev/disk0> results.txt
Search the file wordlist.txt for any lines that don't include at least one vowel:
$ grep -v [aeiou] wordlist.txt
Remove lines from invoices.txt if they appear in paid.txt:
$ grep -F -x -v -f paid.txt invoices.txt >paidinvoices.txt
Searching an entire hard drive with grep can be very slow, using mdfind to identify files containing text is orders of magnitude faster.
"The most dangerous of all falsehoods is a slightly distorted truth" ~ G. C. Lichtenberg
grep man page - Apple.com
pgrep - List processes by a full or partial name
awk - Find and Replace text within file(s)
mdfind - Spotlight search
tr - Translate, squeeze, and/or delete characters