What is grep?
grep is a command-line tool on Linux, Unix and macOS that reads text and prints every line matching a pattern. The name comes from a command in the old ed text editor, g/re/p: globally search for a regular expression and print the result. For security work it is the quickest way to pull the relevant lines out of a large log, find a string across a directory full of web files, or confirm what a configuration file really says.
Options worth knowing
| Option | Effect |
|---|---|
| -i | Ignore case |
| -v | Invert: print the lines that don't match |
| -r | Search directories recursively |
| -E | Use extended regular expressions, with alternation, +, ? and counts |
| -F | Treat the pattern as fixed text rather than a regular expression |
| -c | Count matching lines instead of printing them |
| -n | Show line numbers |
| -o | Print only the matching part of each line |
| -w | Match whole words only |
| -l | List the names of files that contain a match |
| -A, -B, -C | Show lines after, before or around each match |
Rotated logs that have been compressed, such as auth.log.2.gz, can be searched without unpacking them by using zgrep.
Examples from an investigation
Count login attempts against a WordPress site's login page in a web server log:
grep -c 'POST /wp-login.php' /var/log/nginx/access.log
List the client addresses behind those attempts, busiest first, by passing the matches to other tools:
grep 'POST /wp-login.php' access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
Find PHP files containing a string common in web shells, with file names and line numbers:
grep -rn 'eval(base64_decode' /var/www/html/
Show only the active lines of the SSH server configuration, skipping comments and blank lines:
grep -Ev '^(#|$)' /etc/ssh/sshd_config
Common mistakes
- Forgetting that the pattern is a regular expression by default. A dot matches any character, and a plain search also matches inside longer strings, so searching for 10.0.0.1 finds 10.0.0.15 too. Add -F to treat dots literally and -w to require a whole word.
- Quoting. Patterns containing spaces, pipes or dollar signs need single quotes so the shell doesn't interpret them first.
- Searching only the current log. Older rotated and compressed files often hold the start of an incident.
- Trusting a zero result. grep finds only what was logged; if logging was off or an attacker cleared the file, the absence of a match proves nothing.
grep vs. other search tools
- findstr and Select-String: the Command Prompt and PowerShell equivalents for searching text files on Windows. Windows event logs are binary, though, so they are filtered with Get-WinEvent or Event Viewer instead.
- awk and sed: awk splits lines into fields and sed edits text as it streams past. grep only selects lines, so the three are often chained together.
- SIEM search: filters every source at once, with parsed fields and long retention. grep is for the file in front of you, including logs that never reached the SIEM.
grep on the CompTIA Security+ exam
SY0-801 objective 4.8 includes parsing logs to support an investigation, and grep is the standard Linux tool for that job. Be ready to read a short command and say what it returns: -i ignores case, -v excludes matches, -c counts, -r searches a directory tree, and a pipe into sort and uniq -c turns matches into a frequency count. A scenario about quickly finding every failed login from one address in a text log points to grep; one about filtering Windows event logs points to PowerShell instead. grep also appears in A+ Core 2 (220-1202) objective 1.9.