3.2b grep and Text Extraction Tools

LPI Linux Essentials Certificate 010-160

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Study Strategy & Blueprint Weights

2 Topic 1: The Linux Community and a Career in Open Source

1.1 Linux Evolution and Popular Operating Systems 1.2 Major Open Source Applications 1.3 Open Source Software and Licensing 1.4 ICT Skills and Working in Linux

3 Topic 2 Part A: Command Line Basics & Getting Help

2.1a Bash Shell, Command Syntax & Variables 2.1b Quoting, History & Safe Command Syntax 2.2 Using the Command Line to Get Help

4 Topic 2 Part B: Directories, Listing & File Operations

2.3 Using Directories and Listing Files 2.4 Creating, Moving and Deleting Files

5 Topic 3 Part A: Archiving & Searching Data

3.1 Archiving and Compression on the Command Line 3.2a Pipes, Redirection, and Basic Regular Expressions 3.2b grep and Text Extraction Tools

6 Topic 3 Part B: Turning Commands into Scripts

3.3a Script Basics: Shebang, Variables, and Arguments 3.3b Loops, Exit Status, and Simple Conditionals 3.3c Editors, chmod +x, and Running Scripts

7 Topic 4 Part A: Choosing an OS, Hardware & FHS Basics

4.1 Choosing an Operating System 4.2 Understanding Computer Hardware 4.3a Where Programs and Configuration Live (FHS Basics)

8 Topic 4 Part B: Processes, Logs & Networking

4.3b Processes, Memory & Logs 4.4 Your Computer on the Network

9 Topic 5: Security and File Permissions

5.1 Basic Security and Identifying User Types 5.2 Creating Users and Groups 5.3 Managing File Permissions and Ownership 5.4 Special Directories and Files

3.2b grep and Text Extraction Tools

Key Takeaways Explain This Topic AI

grep prints lines that match a pattern; key options include -i, -v, -n, -r/-R, and -E

less pages through text; cat dumps files; head and tail show the start or end (tail -f follows a growing log)

sort orders lines; cut extracts delimited fields; wc counts lines (-l), words (-w), and bytes (-c)

Realistic pipelines chain generate → filter → slice → count without inventing temporary files

• grep searches file contents; do not confuse it with locating files by name alone
• Last updated: July 2026

Searching and extracting with the text toolkit (objective 3.2)

With pipes and redirection in place, objective 3.2 centers on grep plus a short list of viewing and shaping tools: less , cat , head , tail , sort , cut , and wc .

• grep — match lines by pattern
• grep ( global regular expression print ) prints every line that matches a pattern. grep error app.log
• grep "connection refused" /var/log/syslog

First argument: pattern . Remaining arguments: files (or omit files and read from a pipe).

• Option Effect Example
• i Ignore case grep -i error app.log
• v Invert — lines that do not match grep -v "^#" config.conf
• n Show line numbers Jump back into an editor
• r / -R Recurse directories grep -rn TODO ~/project/
• E Extended regex grep -E "fail|error" app.log
• c Count matching lines Quick frequency check grep -n -i timeout app.log
• grep -r "TODO" ~/project/
• grep -E "fail|error|fatal" app.log
• ps aux | grep nginx

Contents vs names: grep looks inside files. A command like grep backup does not list files named backup — it prints lines containing that text. For name-based discovery you use directory tools (covered elsewhere); for Essentials 3.2, stay sharp on content search.

Quote patterns with spaces. Remember default patterns are regexes: escape dots when you mean a literal period (see the previous section).

Worked log search: Start broad, then narrow — grep -ni timeout app.log | head -n 40 samples numbered hits; pipe through grep -v healthcheck | wc -l to drop noise and count. Multi-file greps prefix each hit with the filename (useful for grep -n Listen /etc/apache2/*.conf ).

Viewing: cat, less, head, tail

• Tool Purpose
• cat Write entire file(s) to the terminal
• less Page interactively (scroll, search within the view)
• head Beginning of a file (default first 10 lines)
• tail End of a file (default last 10 lines) cat readme.txt
• less /var/log/syslog
• head -n 20 app.log
• tail -n 50 app.log
• tail -f /var/log/syslog # follow — print new lines as they arrive

Use less when cat would flood the screen; head / tail for samples; tail -f to follow a growing log (Ctrl+C to stop).

• Pipe grep into a pager when hits are numerous: grep -n -i error app.log | less
• grep -n -i error app.log | head -n 30

Exam trap: follow mode is tail -f , not head -f . cat dumps; it does not page like less .

• sort, cut, and wc sort names.txt # order lines
• sort -n numbers.txt # numeric when needed
• cut -d: -f1 /etc/passwd # field 1, colon-delimited
• cut -d',' -f2,3 data.csv
• wc -l app.log
• grep -i error app.log | wc -l # count matching lines

• Option wc counts
• l Lines
• w Words
• c Bytes

-d / -f on cut select delimiter and fields. Prefer cut for neat columns and grep for arbitrary line patterns. Choose by job: matching lines → grep ; column → cut ; count → wc ; order → sort ; window into a long file → head / tail / less .

• Worked pipelines (exam-style)
• 1. Last errors in a log, case-insensitive tail -n 200 app.log | grep -i error
• 2. Unique sorted list of usernames from passwd cut -d: -f1 /etc/passwd | sort
• 3. Count HTTP 500 lines in an access log grep " 500 " access.log | wc -l
• 4. Top of a frequency-style chain (sort, then inspect) cut -d' ' -f1 access.log | sort | head
• 5. Config hunt with line numbers grep -rn "db.example.com" /etc/myapp/ | less
• 6. Drop noise, then sample: grep -i error app.log | grep -v "benign_code" | head -n 15

7. Count without a temp file: grep -i exception app.log | wc -l (or redirect to a file first if you need to keep the extract).

Tool → purpose map

• Tool Purpose
• grep Keep lines matching a pattern
• less Page through text comfortably
• cat Dump file contents
• head / tail First / last lines; tail -f follows
• sort Order lines
• cut Extract delimited fields
• wc Count lines, words, bytes
• Common exam traps

• Story Wrong instinct Better tool
• “Which lines contain ERROR?” Open every file by hand grep -i ERROR
• “Show the last 20 lines” head -n 20 tail -n 20
• “How many matches?” Guess from the screen … | wc -l or grep -c
• “Just the username column” grep the whole line cut -d: -f1
• “Watch the log grow” cat in a loop tail -f
• Exam tips

Map stories to flags: ignore case → -i ; hide matches → -v ; where in the file → -n ; whole tree → -r ; richer “or” patterns → -E .

Prefer command | grep pattern over inventing temp files.

head / tail default to 10 lines; override with -n .

cut -d… -f… for columns; wc -l after grep for counts.

Keep content search ( grep ) separate from “what is this file named?” thinking.

Narrating a one-line pipeline that shows and counts recent errors is exactly what objective 3.2 measures.