Skip to content

Grep

Deep Dive: grep, egrep, and fgrep

grep, egrep, and fgrep are command-line tools in Linux used to search for patterns inside files. While they share the same core functionality, they differ in how they interpret search patterns and handle regular expressions.

1. grep (Global Regular Expression Print)

Purpose:

  • Searches for basic regular expressions (BRE) inside files.
  • Matches patterns line by line and prints results.

Examples:
- Search for "error" in a file:

grep "error" /var/log/syslog
- Case-insensitive search:
grep -i "error" /var/log/syslog
- Search for multiple words (error or failed):
grep -E "error|failed" /var/log/syslog
- Show line numbers where matches occur:
grep -n "error" /var/log/syslog
- Recursive search in all files inside a directory:
grep -r "error" /var/log/

Limitations of grep:

  • Uses Basic Regular Expressions (BRE), which requires backslashes (\\) to escape certain characters.
  • Slower than egrep when dealing with complex patterns.

2. egrep (Extended grep) – Faster and Supports Advanced Regex

Purpose:

  • Uses Extended Regular Expressions (ERE), meaning you don’t need backslashes (\\) for special characters.
  • Faster than grep for complex patterns because it uses a different regex engine.
  • Equivalent to grep -E.

Examples:
- Search for multiple words (error or failed):

egrep "error|failed" /var/log/syslog
(With grep, you'd need `grep -E "error|failed" /var/log/syslog")

  • Search for lines starting with Warning:

    egrep "^Warning" /var/log/syslog
    (With grep, you'd need grep -E "^Warning")

  • Search for lines ending with .log:

    egrep "\.log$" filenames.txt

Advantages of egrep:

  • No need for backslashes (\\) in extended regex.
  • Faster than grep for complex searches.

Why Use grep -E Instead of egrep?

Newer versions of Linux deprecated egrep in favor of grep -E, so you should use:

grep -E "error|failed" /var/log/syslog

3. fgrep (Fixed grep) – Fastest, No Regex

Purpose:

  • Does NOT use regular expressions – it searches for exact string matches only.
  • Faster than grep and egrep since it doesn’t process regex.
  • Equivalent to grep -F.

Examples:
- Search for an exact word, ignoring regex characters:

fgrep "[error]" /var/log/syslog
(Unlike grep, fgrep treats [] as plain text, not a character set.)

  • Search for a literal dot (.) without regex interference:

    fgrep "error.log" filenames.txt
    (With grep, you'd need `grep -F "error.log" filenames.txt")

  • Search for multiple fixed words from a file:

    fgrep -f keywords.txt logs.txt
    (Each line in keywords.txt is treated as a search term.)

Advantages of fgrep:

  • Fastest since it doesn’t interpret regex.
  • Useful when searching for exact words that may contain special regex characters.

Why Use grep -F Instead of fgrep?

Like egrep, fgrep is deprecated in modern Linux. Instead, use:

grep -F "error.log" filenames.txt

4. Performance & Comparison Table

Command Supports Regex? Uses Extended Regex? Fastest? Best For
grep Yes (BRE) No No Simple pattern matching
egrep Yes (ERE) Yes Faster than grep Complex regex searches
fgrep No Regex No Fastest Exact string matching

Use Cases Recommendation:
- Use grep for simple searches with basic regex.
- Use grep -E (egrep) for more complex regex patterns.
- Use grep -F (fgrep) for literal string matching when speed is important.

5. Practical Use Cases

1. Finding Specific Log Entries

Search for error messages in logs while ignoring case:

grep -i "error" /var/log/syslog

2. Filtering Logs for Multiple Keywords

Find logs that contain either "error" or "failed":

grep -E "error|failed" /var/log/syslog

3. Extracting IP Addresses

Find all occurrences of IPv4 addresses in a file:

grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" access.log

4. Searching Code for TODO Comments

Find all TODO comments inside a project directory:

grep -r "TODO" /home/user/project/

5. Exact Match for [INFO] Without Regex Interference

grep -F "[INFO]" logs.txt

Conclusion

  • Use grep for simple searches.
  • Use grep -E (egrep) for more advanced regex matching.
  • Use grep -F (fgrep) for fast, exact string matches.

With egrep and fgrep now deprecated, it’s best to use grep -E and grep -F instead.