6.1 Searching Text: grep
grep pattern match karnaarya lines dakhavto. Logs madhe attack shodhayla ha sarvaat jast vaparla jaanara command aahe.
| Option | Meaning |
|---|---|
-i |
Ignore case |
-r / -R |
Recursive search in directories |
-n |
Show line numbers |
-v |
Invert (lines that do NOT match) |
-c |
Count matching lines |
-l |
Only file names |
-w |
Match whole word |
-E |
Extended regex (alternation with a pipe symbol, +, ?) |
-A 3 / -B 3 / -C 3 |
Show 3 lines after / before / around |
grep -i "error" /var/log/nginx/error.log
grep -rn "listen" /etc/nginx/
grep -v "^#" /etc/ssh/sshd_config | grep -v "^$" # hide comments & blank lines
grep -c " 404 " /var/log/nginx/access.log # how many 404s?
grep -E "Failed|Invalid" /var/log/auth.log # Ubuntu SSH failures
sudo grep "Failed password" /var/log/secure # AL2/CentOS (AL2023 uses journalctl)
Why this matters for security
grep "Failed password" on the auth log shows SSH brute-force attempts; grep -E "union|select|<script" access.log finds SQL injection and XSS attempts in web logs. Many SIEM searches are just smarter versions of grep.
Ravindra Bagale's Tip
Many students write grep error and miss "Error" or "ERROR". The case changes in logs – use -i. And if you want to hide the comments in a config and see only the active lines, remember the trick grep -v "^#".
Ravindra Bagale's Tip – मराठी
बरेच students grep error लिहितात आणि "Error" किंवा "ERROR" miss करतात. Logs मध्ये case बदलतो – -i वापरा. आणि config मधल्या comments काढून फक्त active lines बघायच्या असतील तर grep -v "^#" ही trick लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
बहुत से students grep error लिखते हैं और "Error" या "ERROR" छूट जाते हैं. Logs में case बदलता है – -i इस्तेमाल करो. और config के comments हटाकर सिर्फ़ active lines देखनी हों तो grep -v "^#" वाली trick याद रखो.
Practice task
On your server, count failed SSH logins, list all listen lines under /etc/nginx (after Part 3), and show sshd_config without comments and blank lines.