文本三剑客之 grep：搜索与正则过滤

grep 模式 文件              # 打印文件中包含"模式"的行
grep error app.log         # 找出含 error 的行
grep -i error app.log      # -i 忽略大小写（error/Error/ERROR 通吃）
grep -n error app.log      # -n 显示行号
grep -c error app.log      # -c 只输出匹配行数
grep -v debug app.log      # -v 反选：输出**不**含 debug 的行
grep -w on app.log         # -w 整词匹配：匹配 on 但不匹配 config

ps | grep nginx            # 从进程列表里找 nginx
history | grep ssh         # 从历史命令里找 ssh 相关

cat > app.log << 'EOF'
2026-07-31 10:00:01 INFO  server started on port 8080
2026-07-31 10:00:05 DEBUG cache warmed up
2026-07-31 10:01:12 ERROR db connection refused
2026-07-31 10:01:13 error retrying db connection
2026-07-31 10:01:15 INFO  db connected
2026-07-31 10:02:30 WARN  slow query took 1200ms
2026-07-31 10:03:00 ERROR timeout calling payment api
EOF
 
echo '$ grep ERROR app.log'
grep ERROR app.log
 
echo '$ grep -i error app.log   # 大小写都要'
grep -i error app.log
 
echo '$ grep -in error app.log  # 加上行号'
grep -in error app.log
 
echo '$ grep -c -i error app.log   # 只数个数'
grep -c -i error app.log
 
echo '$ grep -v DEBUG app.log   # 排除调试噪音'
grep -v DEBUG app.log

grep -r 'TODO' src/                  # 递归搜索目录
grep -rn 'listen 80' /etc/nginx/     # 带行号，定位配置
grep -rl 'deprecated_api' src/       # -l 只列出含匹配的文件名
grep -r --include='*.py' 'import requests' .    # 只搜某类文件

mkdir -p src/api src/web
cat > src/api/user.py << 'EOF'
# TODO: add rate limit
def get_user(uid):
    return db.find(uid)
EOF
cat > src/web/views.py << 'EOF'
def home():
    # TODO: cache this page
    return render()
EOF
echo 'nothing here' > src/notes.txt
 
echo '$ grep -rn TODO src/'
grep -rn TODO src/
 
echo '$ grep -rl TODO src/   # 只要文件名'
grep -rl TODO src/
 
echo '$ grep -rn --include="*.py" def src/   # 只搜 python 文件'
grep -rn --include='*.py' def src/

cat > access.log << 'EOF'
192.168.1.10 GET /index.html 200 12ms
192.168.1.11 POST /api/login 401 35ms
10.0.0.3 GET /api/users 200 210ms
192.168.1.10 GET /favicon.ico 404 2ms
10.0.0.7 POST /api/orders 500 1520ms
10.0.0.3 DELETE /api/users/9 204 18ms
EOF
 
echo '$ grep -E " (4|5)[0-9][0-9] " access.log   # 4xx 与 5xx'
grep -E ' (4|5)[0-9][0-9] ' access.log
 
echo '$ grep -E "^10[.]" access.log   # 10. 开头的内网 IP（[.] 表示字面点号）'
grep -E '^10[.]' access.log
 
echo '$ grep -E "(POST|DELETE)" access.log   # 写操作'
grep -E '(POST|DELETE)' access.log
 
echo '$ grep -oE "[0-9]+ms" access.log   # -o 只输出匹配片段'
grep -oE '[0-9]+ms' access.log

grep -A 3 'ERROR' app.log     # After：匹配行 + 后 3 行
grep -B 2 'ERROR' app.log     # Before：前 2 行 + 匹配行
grep -C 2 'ERROR' app.log     # Context：前后各 2 行

cat > svc.log << 'EOF'
10:00:01 INFO  request id=1001 received
10:00:01 INFO  querying db for user=42
10:00:04 WARN  db latency high: 3000ms
10:00:04 ERROR request id=1001 timeout
10:00:04 INFO  sending 504 to client
10:00:05 INFO  request id=1002 received
10:00:05 INFO  request id=1002 done in 8ms
EOF
 
echo '$ grep ERROR svc.log   # 只看这行，不知道为什么超时'
grep ERROR svc.log
 
echo '$ grep -B 2 -A 1 ERROR svc.log   # 带上前 2 行后 1 行，原因一目了然'
grep -B 2 -A 1 ERROR svc.log

# 统计今天各类错误出现次数（-o 提取 + 排序计数，第 20 章详解）
grep -oE 'ERROR [a-z_]+' app.log | sort | uniq -c | sort -rn
 
# 多条件：先粗筛再精筛，逐级缩小范围
grep 'ERROR' app.log | grep -v 'retrying' | grep '2026-07-31 10:'
 
# 固定字符串搜索（-F 不解释正则，搜含特殊字符的内容更快更安全）
grep -F '[cache]' app.conf