How to Search Inside Files (grep)

Prerequisites

Before searching inside files, make sure you have:

• SSH access to your VPS
• Basic understanding of search patterns

Basic grep Syntax

grep [options] pattern [file]

Method 1: Search in a Single File

Connect to your VPS:

ssh hxroot@YOUR_SERVER_IP -p 22

Search for text in a file:

grep "error" /var/log/syslog

Show line numbers:

grep -n "error" /var/log/syslog

Case-insensitive search:

grep -i "error" /var/log/syslog

Show lines BEFORE match:

grep -B 5 "error" /var/log/syslog

Show lines AFTER match:

grep -A 5 "error" /var/log/syslog

Show lines BEFORE and AFTER:

grep -C 5 "error" /var/log/syslog

Method 2: Search in Multiple Files

Search all log files in a directory:

grep "error" /var/log/*.log

Recursive search (all subdirectories):

grep -r "error" /var/log/

Show filename with matches:

grep -H "error" /var/log/*.log

Only show filenames that match:

grep -l "error" /var/log/*.log

Count matches per file:

grep -c "error" /var/log/*.log

Method 3: Search in Command Output (Pipes)

Filter ps output:

ps aux | grep nginx

Filter history:

history | grep ssh

Filter log output in real-time:

tail -f /var/log/syslog | grep error

Useful grep Options

• -i - Case-insensitive search
• -r - Recursive search
• -n - Show line numbers
• -v - Invert match (show lines NOT containing pattern)
• -l - Only show filenames with matches
• -L - Only show filenames WITHOUT matches
• -c - Count matches
• -w - Match whole words only
• -e - Use multiple patterns
• -E - Extended regex (egrep)
• -A NUM - Show NUM lines after match
• -B NUM - Show NUM lines before match
• -C NUM - Show NUM lines before and after
• --color - Highlight matches in color

Pattern Examples

Search for exact word:

grep -w "error" /var/log/syslog

Search for multiple patterns (OR):

grep -e "error" -e "warning" /var/log/syslog

Search for lines NOT containing pattern:

grep -v "debug" /var/log/syslog

Search with regular expressions:

grep "^[0-9]" file.txt  # Lines starting with number
grep "error$" file.txt   # Lines ending with error

Recursive Search with File Type Filter

Search only PHP files:

grep -r --include="*.php" "function" /var/www/

Search only config files:

grep -r --include="*.conf" "port" /etc/

Exclude specific files:

grep -r --exclude="*.log" "error" /var/

Real-World Examples

Find failed SSH login attempts:

grep "Failed password" /var/log/auth.log

Count failed attempts today:

grep "$(date +'%b %e')" /var/log/auth.log | grep "Failed password" | wc -l

Find IP addresses in log file:

grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /var/log/syslog

Find PHP errors in website logs:

grep -r "PHP Error" /var/log/nginx/

Search with Context

Show 3 lines before, 2 lines after:

grep -B 3 -A 2 "error" /var/log/syslog

Show 5 lines around match:

grep -C 5 "error" /var/log/syslog

Color Highlighting

grep --color=auto "error" /var/log/syslog

Make permanent by adding to ~/.bashrc:

alias grep='grep --color=auto'

Search Script with Multiple Patterns

#!/bin/bash
echo "Searching for patterns: $@"
echo "========================="
for pattern in "$@"; do
    echo "--- Matches for '$pattern' ---"
    grep -r "$pattern" /var/log/ 2>/dev/null | head -20
    echo ""
done

Performance Tips

• Use grep -F for fixed strings (faster)
• Use LC_ALL=C grep for faster ASCII search
• Be specific about directories to avoid searching binary files
• Use --exclude-dir to skip node_modules, .git, etc.

grep -r --exclude-dir={node_modules,.git,logs} "function" /var/www/