Linux find text in file

If you need to find text in file or multiple files on a Linux system you can use grep (global regular expression print) in a very efficient way to do so.  Here are few examples that I commonly use.

Find text in file into a directory

Use this command to find the text you are looking for within the directory

cd /path/to/directory/
grep "some text" *

If you want to select only those lines containing matches that form whole words use the -w switch (–word-regexp). If you search for “word” this will NOT display words like someword, word123, etc.

grep -w "match text" *

If you don’t know the capitalization of words and want to ignore case distinctions use the -i switch (–ignore-case). If you search for “word” it will display Word, WORD, word, wORD, etc.

grep -i "match text" *

And the most often used command for me is recursive search -r switch (–recursive)

grep -r "match text" .


grep -r "match text" /path/to/directory/

And finally few examples that i use the most:

Recursive search for exact text

Invoke -w (–word-regexp) and -r (–recursive) switch:

grep -wr "my string" /path/to/starting/directory/

Recursive search for case insensitive text

Invoke -i (–ignore-case) and -r (–recursive) switch

grep -ir "my string" /path/to/starting/directory/

This days i use this to search trough logs, mostly apache, nginx and mail logs.

Also don’t forget to use zgrep. Zgrep  invokes  grep  on  compressed  or gzipped files.  All options specified are passed directly to grep.

grep -wi "" /var/log/mail.*
zgrep -wi "" /var/log/mail.*.gz

This will output file and date when the mail was sent to the user, and than you can grep the time to get all the logs for that time:

grep -wi "Feb 11 12:29:" /var/log/mail.log
zgrep -wi "Jan 17 00:05:" /var/log/mail.log.4.gz

You can now easy look at the log:

Feb 11 12:29:54 vmhost postfix/pickup[18821]: D177E38E466C: uid=5022 from=<web24>
Feb 11 12:29:55 vmhost postfix/cleanup[23697]: D177E38E466C: message-id=<>
Feb 11 12:29:55 vmhost postfix/qmgr[26558]: D177E38E466C: from=<>, size=1113, nrcpt=1 (queue active)
Feb 11 12:29:59 vmhost postfix/smtpd[23719]: connect from localhost[]
Feb 11 12:29:59 vmhost postfix/smtpd[23719]: 608F938E4697: client=localhost[]
Feb 11 12:29:59 vmhost postfix/cleanup[23697]: 608F938E4697: message-id=<>
Feb 11 12:29:59 vmhost postfix/qmgr[26558]: 608F938E4697: from=<>, size=1565, nrcpt=1 (queue active)
Feb 11 12:29:59 vmhost postfix/smtpd[23719]: disconnect from localhost[]
Feb 11 12:29:59 vmhost amavis[15551]: (15551-15) Passed CLEAN, <> -> <>, Message-ID: <>, mail_id: xnXNT-pmznB1, Hits: 0.798, size: 1113, queued_as: 608F938E4697, 4153 ms
Feb 11 12:29:59 vmhost postfix/smtp[23700]: D177E38E466C: to=<>, relay=[]:10024, delay=5.3, delays=0.91/0.16/0.13/4.1, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=15551-15, from MTA([]:10025): 250 2.0.0 Ok: queued as 608F938E4697)
Feb 11 12:29:59 vmhost postfix/qmgr[26558]: D177E38E466C: removed

This ware just few command i usually use, look at the man page for more options.

grep man page

Nikola Stojanoski

System Administrator and Developer. Giving back to the community by blogging about my problems, solutions and practical howto's.