6.1 Searching Text: grep
grep pattern match karnaarya lines dakhavto. Logs madhe attack shodhayla ha sarvaat jast vaparla jaanara command aahe.
| Option | Meaning |
|---|---|
-i |
Ignore case |
-r / -R |
Recursive search in directories |
-n |
Show line numbers |
-v |
Invert (lines that do NOT match) |
-c |
Count matching lines |
-l |
Only file names |
-w |
Match whole word |
-E |
Extended regex (alternation with a pipe symbol, +, ?) |
-A 3 / -B 3 / -C 3 |
Show 3 lines after / before / around |
grep -i "error" /var/log/nginx/error.log
grep -rn "listen" /etc/nginx/
grep -v "^#" /etc/ssh/sshd_config | grep -v "^$" # hide comments & blank lines
grep -c " 404 " /var/log/nginx/access.log # how many 404s?
grep -E "Failed|Invalid" /var/log/auth.log # Ubuntu SSH failures
sudo grep "Failed password" /var/log/secure # AL2/CentOS (AL2023 uses journalctl)
Why this matters for security
grep "Failed password" on the auth log shows SSH brute-force attempts; grep -E "union|select|<script" access.log finds SQL injection and XSS attempts in web logs. Many SIEM searches are just smarter versions of grep.
Ravindra Bagale's Tip
Khup students grep error lihitat aani "Error" kiwa "ERROR" miss kartat. Logs madhe case badalte – -i vapra. Aani config madhle comments kadhun fakt active lines baghaychya astil tar grep -v "^#" hi trick lakshat theva.
Practice task
On your server, count failed SSH logins, list all listen lines under /etc/nginx (after Part 3), and show sshd_config without comments and blank lines.