Linux grep and find Commands with Examples

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. Quick revision: networking

Why: grep and find are mostly used on servers to answer networking and access questions from logs: which IP connected, which port failed. You need the basics fresh to read those lines.

2. Linux user types and UIDs

Why: Linux decides what you may do by who you are. Every user has a number, the UID (user ID), and Linux checks that number, not the name.

What: there are three kinds of users.

1. root, UID 0. The superuser. It can read, change and delete everything.
2. System users, UID 1 to 999. Linux and installed software create them to run services, for example sshd or nginx. Most can't log in.
3. Normal users, UID 1000 and up. These are people. The first user on an EC2 instance (ec2-user on Amazon Linux, ubuntu on Ubuntu) is 1000; the next user you create gets 1001.

A sudo user is not a fourth type. It is a normal user who is allowed to run commands as root, through the wheel group on Amazon Linux or the sudo group on Ubuntu.

How: check your own user.

1. Run id.
2. Read uid=1000(ec2-user): your UID and name.
3. Read groups=...: wheel (or sudo on Ubuntu) means you can use sudo.
4. Run sudo id. Now it shows uid=0(root), because sudo runs the command as root.

3. /etc/passwd and /etc/shadow

Why: when you need to know which users exist on a server, their UID, home folder or shell, it's all in one file.

What:

1. /etc/passwd is the list of users. One line = one user. Everyone can read it.
2. /etc/shadow holds the password hashes. Only root can read it.
3. A hash can't be turned back into the password. A forgotten password is never "read back"; it is reset with sudo passwd USERNAME.

A line of /etc/passwd has seven fields separated by :

ec2-user:x:1000:1000:EC2 Default User:/home/ec2-user:/bin/bash

1. ec2-user: the user name.
2. x: the password is kept in /etc/shadow.
3. 1000: the UID.
4. 1000: the group ID.
5. EC2 Default User: a comment.
6. /home/ec2-user: the home folder.
7. /bin/bash: the login shell. /sbin/nologin here means the account can't log in, which is normal for system users.

How:

1. Run cat /etc/passwd. Every user is listed.
2. Run cat /etc/shadow. You get Permission denied: a normal user can't read it.
3. Run sudo cat /etc/shadow. As root it works.

4. grep: find text without opening the file

Why: a log file can have millions of lines. Opening it in an editor is slow and can even freeze the terminal, and scrolling up looking for one error wastes your time.

What: grep searches a file for a word (a pattern) and prints only the lines that contain it. The file is never opened in an editor.

How: make a practice file, search it in vi, then with grep.

1. Connect to your EC2 instance with SSH.
2. Run vi demo (vim demo works the same).
3. Press i and paste a few lines of text about Linux.
4. Press Esc, type :wq and press Enter.
5. Open it again with vi demo.
6. Type /Linux and press Enter. The cursor jumps to the first match.
7. Press n for the next match and N for the previous one.
8. Type :q to leave the editor.
9. Now run grep "Linux" demo. Only the lines with Linux are printed, and the word is highlighted.

More examples:

1. grep ec2-user /etc/passwd prints your own user line.
2. grep nologin /etc/passwd lists the accounts that can't log in.
3. sudo grep -i "error" /var/log/httpd/error_log shows the errors in the Apache log (on Amazon Linux).

5. The pipe: one command's output into the next

Why: some commands print a lot. Instead of reading all of it, you can pass it straight to grep and keep only what you need.

What: the pipe sign | takes everything the left command prints and gives it to the right command as its input.

How:

1. Run cat /etc/passwd. Every user line scrolls past.
2. Run cat /etc/passwd | grep ec2-user. Only your line is left.
3. Run grep ec2-user /etc/passwd. Same result: grep can also read the file itself.
4. Run ls /etc | grep conf. Only the names in /etc that contain conf.

6. grep options: -i, -r and -n

Why: you don't always know the exact spelling, or which file has the word.

What:

1. Case matters. Linux and linux are different words for grep.
2. -i ignores case: Linux, linux and LINUX all match.
3. -r (recursive) searches every file in a folder and in the folders inside it.
4. -n adds the line number in front of every match.
5. Options can be joined: -irn = ignore case + recursive + line numbers.

How:

1. grep -r "Linux" ~/ searches every file in your home folder. Each line starts with the file name.
2. grep -r "linux" ~/ finds other lines: case matters.
3. grep -i "linux" ~/ stops with Is a directory: grep reads files, and a folder is not a file.
4. grep -ir "linux" ~/ works: -r lets grep go into the folder.
5. grep -irn "linux" ~/ also shows the line numbers, as file:line:text.
6. man grep opens the full manual (press q to quit). grep --help prints a short list of options.

One more listing trick: ls -R lists a folder and every folder inside it, like a tree. Try ls -R ~/.

7. find: find the file itself

Why: grep needs to know where to look. When you don't know where a file is, you need find.

What: find walks through a folder and every folder below it and prints the path of each match.

find WHERE -type f|d|l -name "NAME"

1. WHERE: the folder to start from: . (here), ~/, /home or / (the whole server). find always needs a starting folder; it doesn't read a list from a pipe.
2. -type f = files, -type d = folders (directories), -type l = links.
3. -name "NAME": the exact name. * is a wildcard: "*.log" = every name ending in .log.
4. -perm 644: files with exactly that permission.

How:

1. find . -name "demo" finds demo in the current folder and below.
2. find /home -name "demo" starts from /home.
3. find . -name "*.log" lists all .log files here and below.
4. find / -name "passwd" from the whole server, as a normal user, prints a flood of Permission denied lines for folders you may not read.
5. sudo find / -name "passwd" reads every folder and lists every match.
6. find / -name "passwd" 2>/dev/null is another way: it hides the error lines and keeps the results.
7. sudo find / -type f -name "passwd" lists files only; a folder called passwd is skipped.
8. sudo find / -type d -name "nginx" lists folders only.
9. sudo find /var/www -perm 644 lists files with permission 644.

If you forget -name before the name, find stops with paths must precede expression. Add -name and run it again.

8. find | grep, and counting with wc -l

Why: sometimes you want every path that has a word anywhere in it, or you just want to know how many there are.

What:

1. find prints full paths. grep then keeps the lines (paths) that contain the word.
2. grep matches the word anywhere in the path, folder names included.
3. wc -l counts lines.

How:

1. sudo find / -type f | grep "passwd" lists every file whose path contains passwd.
2. Look closer: a file such as /usr/share/doc/passwd/copyright is listed only because a folder in its path is called passwd.
3. For files whose own name contains passwd, use find alone: sudo find / -type f -name "*passwd*".
4. Add | wc -l to count: sudo find / -type f -name "*passwd*" | wc -l.

9. Why admins grep logs

Why: Logs are the server's diary. When a site goes down or someone tries to break in, grep turns millions of lines into the five that matter.

On your own servers (on-premises, in a company data centre) or on EC2, someone has to answer questions like "who logged in last night?" and "did anyone try to break in?". The answers are in log files, and grep finds them in seconds.

1. On Amazon Linux: sudo journalctl -u sshd | grep "Accepted" shows successful SSH logins.
2. sudo journalctl -u sshd | grep -E "Failed|Invalid" shows failed attempts.
3. On Ubuntu the same lines are also in /var/log/auth.log: sudo grep "Accepted" /var/log/auth.log.

Linux is a multi-user system: many people can be logged in over SSH at the same time, each doing their own work. Run who to see who is logged in right now.

10. The whole flow on one page

1. id shows your UID: root 0, system users 1 to 999, normal users 1000+.
2. cat /etc/passwd lists users; sudo cat /etc/shadow shows hashes (root only); reset passwords with sudo passwd USERNAME.
3. grep "word" file prints matching lines; in vi, /word, n, N.
4. command | grep word filters another command's output.
5. -i ignore case, -r whole folder, -n line numbers; Is a directory means add -r.
6. find WHERE -type f -name "NAME"; sudo for the whole server, or 2>/dev/null.
7. find ... | grep word matches anywhere in the path; -name matches the name only; | wc -l counts.
8. journalctl -u sshd | grep "Accepted" (Amazon Linux) or grep "Accepted" /var/log/auth.log (Ubuntu) shows who logged in.

11. Hands-on lab: find users, text and files from the terminal

Why this lab. On a server you can't scroll through every file. This lab answers real questions (who am I, which users exist, where is a file, which file mentions a word) with grep, find and the pipe.

1. Check your UID
   • Command: id
   • You should see: A line starting with uid=1000(ec2-user) gid=1000(ec2-user), with wheel among the groups.
   • Check: id root → uid=0(root) gid=0(root) groups=0(root)
   • Why: Linux decides what you may do by your number: 0 is root, 1 to 999 are system users, 1000 and up are people. wheel is why sudo works for you.
2. Find your line in /etc/passwd
   • Command: grep ec2-user /etc/passwd
   • You should see: ec2-user:x:1000:1000:EC2 Default User:/home/ec2-user:/bin/bash
   • Check: Seven fields separated by :; the last is the shell.
   • Why: grep prints only matching lines, so you get one line instead of the whole file.
3. Try to read /etc/shadow
   • Command: cat /etc/shadow
   • You should see: cat: /etc/shadow: Permission denied
   • Check: sudo grep ec2-user /etc/shadow prints one line starting with ec2-user:.
   • Why: Password hashes live in /etc/shadow, readable only by root. Everyone can read /etc/passwd because it holds no passwords.
4. Ignore case and number the lines
   • Command: grep -in ROOT /etc/passwd
   • You should see: Lines such as 1:root:x:0:0:root:/root:/bin/bash, each with its line number.
   • Check: Without -i, grep ROOT /etc/passwd prints nothing.
   • Why: -i helps when you don't know the exact spelling; -n tells you which line to open in an editor.
5. Search a whole folder
   • Command: mkdir -p ~/lab/logs && echo "error disk full" > ~/lab/logs/a.log && echo "all good" > ~/lab/logs/b.log && grep -r error ~/lab
   • You should see: /home/ec2-user/lab/logs/a.log:error disk full
   • Check: Only a.log is listed.
   • Why: -r looks inside every file in every subfolder, and prints the file name in front of each match.
6. Count with a pipe
   • Command: grep -c bash /etc/passwd
   • You should see: A small number, such as 2 (root and ec2-user).
   • Check: grep bash /etc/passwd | wc -l prints the same number.
   • Why: The pipe | sends one command's output into the next. Here both ways count the users who can log in with bash.
7. Find a file by name
   • Command: sudo find / -type f -name passwd
   • You should see: Paths such as /etc/passwd, /etc/pam.d/passwd and /usr/bin/passwd.
   • Check: Each line is a full path ending in exactly passwd.
   • Why: find searches for the file itself, starting at /. sudo avoids hundreds of Permission denied lines; -type f skips folders.
8. Find by pattern, then filter
   • Command: find ~/lab -name "*.log"
   • You should see: /home/ec2-user/lab/logs/a.log and /home/ec2-user/lab/logs/b.log.
   • Check: find ~/lab -name "*.log" | grep a.log keeps only the first.
   • Why: Quotes stop the shell from expanding *.log before find sees it. Piping into grep filters the paths by any word.
9. Clean up
   • Command: rm -r ~/lab
   • You should see: Nothing.
   • Check: ls ~ no longer shows lab. Stop the instance.
   • Why: Practice files left on a server confuse the next search you run.

12. Try at home

Recap

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.