grep是用来查找文件内容的
grep -e
就是egrep，使用正则表达式进行查找
grep -f
就是fgrep，文件中预先存放了正则表达式
所以只需要学会如何使用grep就足够了。
grep -n
用来搜索结果在文件中的行号
如果要多对某个目录递归查找里面的文件，还需要用-R参数
下面有几个例子：
第一个例子：用普通字符串到日志文件中查找
- grep -n 'login succeed' ./message_log
- 6:2012-12-01 22:48:37; login, notice: login succeed. this:0x22b1770 address:000000000017 (sign.cc:186)
- 49:2012-12-01 22:49:44; login, notice: login succeed. this:0x22b1e00 address:000000000084 (sign.cc:186)
- 56:2012-12-01 22:49:50; login, notice: login succeed. this:0x22b2dd0 address:121030000007 (sign.cc:186)
- 66:2012-12-01 22:49:56; login, notice: login succeed. this:0x22b1770 address:000000000124 (sign.cc:186)
第二个例子：用-R参数在当前目录下所有文件中递归查找
- grep -n -R 'login_succeed' ./
结果和上面类似
第三个例子：用正则表达式进行查找
- grep -n -P '^2012-12-02 10:20:43' ./message_log
- 348680:2012-12-02 10:20:43; head, notice: read head succeeded. (sign.cc:343)
- 348681:2012-12-02 10:20:43; head, notice: reading beatheart body..D1 this:0x22bcd00 address:121030000007 (sign.cc:366)
- 348682:2012-12-02 10:20:43; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bcd00 address:121030000007 (sign.cc:453)
- 348683:2012-12-02 10:20:43; login, notice: receive login request succeed, this:0x22b80c0 address: (sign.cc:124)
- 348684:2012-12-02 10:20:43; login, notice: login succeed. this:0x22b80c0 address:121030000013 (sign.cc:186)
-P 是指使用了perl风格的正则表达式.
^代表以2012...开头
grep支持三种正则表达式:
basic(BRE)
extended(ERE)
perl(PRCE)，这种功能比较强。
第四个例子：用正则表达式文件进行查找
第三个例子的正则表达式存入文件中
- echo '^2012-12-02 10:20:43' > time_search
然后用下面的命令查找
- grep -n -f ./time_search ./message_log
- 348680:2012-12-02 10:20:43; head, notice: read head succeeded. (sign.cc:343)
- 348681:2012-12-02 10:20:43; head, notice: reading beatheart body..D1 this:0x22bcd00 address:121030000007 (sign.cc:366)
- 348682:2012-12-02 10:20:43; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bcd00 address:121030000007 (sign.cc:453)
- 348683:2012-12-02 10:20:43; login, notice: receive login request succeed, this:0x22b80c0 address: (sign.cc:124)
- 348684:2012-12-02 10:20:43; login, notice: login succeed. this:0x22b80c0 address:121030000013 (sign.cc:186)
- 348685:2012-12-02 10:20:43; login, notice: ReadLoginRequestTimer was canceled, this:0x22b80c0 (sign.cc:100)
第五个例子：查找43分以后的日志
- grep_cmds$ grep -n -P '^2012-12-02 10:20:4[456789]' ./message_log
- 348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
- 348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
- 348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
- 348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
- 348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348701:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b1770 address:000000000124 (sign.cc:366)
- 348702:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b1770 address:000000000124 (sign.cc:453)
[456789] 用来匹配大于3的数字，方括号就是数学里面的集合的意思。
第六个例子：查找44分到46分的日志
- grep_cmds$ grep -n -P '^2012-12-02 10:20:4[456]' ./message_log
- 348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
- 348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
- 348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
- 348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
- 348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
这是在第五个例子的基础上，使用了更小的查找范围[456]
这个例子给出了时间范围查找的用法。很实用。
第七个例子：查找44-46分钟的包含某特定地址的日志
- grep -n -P '^2012-12-02 10:20:4[456].+address:000000000123' ./message_log
- 348737:2012-12-02 10:20:46; head, notice: reading beatheart body..D1 this:0x22b5030 address:000000000123 (sign.cc:366)
- 348738:2012-12-02 10:20:46; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b5030 address:000000000123 (sign.cc:453)
.+ 代表时间和地址之间可以有至少一个字符。
第八个例子：查找44分到51分的日志
- grep -n -P '^2012-12-02 10:20:(4[456789]|5[01])' ./message_log
- 348694:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348695:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b6960 address:121030000014 (sign.cc:366)
- 348696:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b6960 address:121030000014 (sign.cc:453)
- 348697:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348698:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22bc8e0 address:121030000006 (sign.cc:366)
- 348699:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22bc8e0 address:121030000006 (sign.cc:453)
- 348700:2012-12-02 10:20:44; head, notice: read head succeeded. (sign.cc:343)
- 348701:2012-12-02 10:20:44; head, notice: reading beatheart body..D1 this:0x22b1770 address:000000000124 (sign.cc:366)
- 348702:2012-12-02 10:20:44; heartbeat_response, notice: write heartbeat response succeeded, this:0x22b1770 address:000000000124 (sign.cc:453)
这里用到了| 表示逻辑或，左边的匹配条件4[456789] 表示44-49分，右边的匹配条件表示50-51
() 圆括号用来限定| 操作符的作用范围。
可以看到，正则表达式是grep的核心查找引擎，下面有几个正则的网址，供参考：
http://zh.wikipedia.org/wiki/%E6%AD%A3%E5%88%99%E8%A1%A8%E8%BE%BE%E5%BC%8F
http://www.cs.tut.fi/~jkorpela/perl/regexp.html
原文地址：http://blog.csdn.net/sheismylife/article/details/8248117