Skip to content
ohsudo, Home

Module 2: Text and logs

Search logs with grep

When something breaks at 2 a.m., the answer is usually in a log with thousands of lines. grep prints only the lines you ask for.

● Runs 100% in your browser. Nothing here can harm a real system.

Step 1 of 8

Find a word

grep prints the lines containing some text: first what to look for, then where.

Your task

Find the lines with ERROR in logs/app.log.

guest@ohsudo: ~ — Ubuntu 24.04

Starting the terminal…

What you'll practice

  1. Find a word. grep prints the lines containing some text: first what to look for, then where.
  2. Ignore case. grep is case-sensitive, so ERROR misses error. -i ignores case.
  3. Count them. -c prints how many lines match, instead of the lines themselves.
  4. Exclude the noise. -v reverses the search: it prints the lines that don't match.
  5. Line numbers. -n adds the line number, which helps you find the place in a file, or in an editor.
  6. Search a whole folder. -r searches every file in a folder, and prints which file each line came from.
  7. One word or another. -E allows extended patterns, where | means "or". Quote the pattern, or the shell treats | as a pipe.
  8. Failed logins. Logins are recorded in a log only root can read. On Debian and Ubuntu it's /var/log/auth.log. Logins are recorded in a log only root can read. On RHEL, Rocky and AlmaLinux it's /var/log/secure, not auth.log as on Debian and Ubuntu.

See also