Searching files with grep and find

Most Linux support tickets start with a search. Someone reports an error and you need to find which file mentions it, or a disk is full and you need the files that grew overnight. Two commands do most of this work: grep searches inside files, and find locates files by their properties. Screenings test both with short tasks, and the flags below cover almost every one.

grep: search inside files

The basic form is grep "pattern" file. The flags that matter: -i ignores case, -n shows line numbers, -r searches a directory tree, -l lists only matching file names, -c counts matching lines, -v shows lines that do not match, and -E enables extended regular expressions.

grep -rn "ERROR" /var/log/app/
grep -i "timeout" app.log | wc -l
grep -rl "db_password" /etc/app/
grep -E "5[0-9]{2} " access.log | tail -20

The first command lists every error line with file name and line number. The second counts timeouts regardless of case. The third names the files that contain a setting, which is what you want before editing. The fourth pulls HTTP 5xx lines from a web log.

find: locate files by property

The form is find [where] [tests] [action]. Common tests are -name (glob, quote it), -type f or -type d, -mtime -1 (modified in the last day), -mtime +7 (older than seven days), -size +100M and -user.

find /var/log -name "*.log" -mtime -1
find / -type f -size +500M 2>/dev/null
find /tmp -name "*.tmp" -mtime +7 -print
find /var/www -type f -name "*.php" -exec grep -l "eval(" {} +

The second command finds large files anywhere and hides permission errors. The fourth hands each PHP file to grep, which is the usual way to combine the two tools. Run a destructive search with -print first, confirm the list, and only then replace it with -delete.

Common mistakes and a practice habit

• Leaving the pattern unquoted. The shell expands *.log before find sees it, so the search silently targets the wrong names.
• Forgetting -type f, so directories appear in results and break the next command in the pipe.
• Reading -mtime -1 and -mtime +1 as the same thing. Minus means newer than, plus means older than.
• Searching the whole disk without 2>/dev/null and losing the real result in permission errors.
• Using grep without -r on a directory, which returns nothing useful.

Practice habit. Once a day, set yourself one question on your own machine, such as "which config files changed this week" or "how many warnings are in this log", and answer it with a single grep or find line. Keep the lines in a notes file. After two weeks you will type the flags without looking them up.