What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

UpGuard checks and validates configurations for every major OS, network device, and cloud provider.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



May 19, 2015 - A Look At The New Commandlinefu
I've put together a short writeup on what kind of newness you can expect from the next iteration of clfu. Check it out here.
March 2, 2015 - New Management
I'm Jon, I'll be maintaining and improving clfu. Thanks to David for building such a great resource!

Top Tags



Commands tagged grep from sorted by
Terminal - Commands tagged grep - 360 results
whatinstalled() { which "$@" | xargs -r readlink -f | xargs -r dpkg -S ;}
whatinstalled () { local cmdpath=$(realpath -eP $(which -a $1 | grep -E "^/" | tail -n 1) 2>/dev/null) && [ -x "$cmdpath" ] && dpkg -S $cmdpath 2>/dev/null | grep -E ": $cmdpath\$" | cut -d ":" -f 1; }
2016-11-08 16:13:10
User: lordtoran
Functions: cut grep tail which

Put this one-line function somewhere in your shell init, re-login and try

whatinstalled <command>

This is an elaborate wrapper around "dpkg -S", with numerous safeguards. Symlinks and command aliases are resolved. If the searched command is not an existing executable file or was installed by some other means than dpkg/apt, nothing is printed to stdout, otherwise the package name.

ps auxw | grep -E 'sbin/(apache|httpd)' | awk '{print"-p " $2}' | xargs strace -F
2016-08-04 10:59:58
User: gormux
Functions: awk grep ps strace xargs
Tags: awk grep ps strace

Will open strace on all apache process, on systems using sbin/apache (debian) or sbin/httpd (redhat), and will follow threads newly created.

curl http://url/rss | grep -o '<enclosure url="[^"]*' | grep -o '[^"]*$' | xargs wget -c
egrep -v '^\s*($|#)' $(git grep -l '#!/bin/.*sh' *) | wc -l
2016-02-15 11:15:48
User: Natureshadow
Functions: egrep grep wc
Tags: git grep count code

Uses git grep for speed, relies on a valid she-bang, ignores leading whitespace when stripping comments and blank lines

pdf2txt myfile.pdf | grep mypattern
2015-11-23 17:46:22
User: grinob
Functions: grep
Tags: pipe grep pdf

This is a good alternative to pdf2text for Ubuntu. To install it:

sudo apt-get install python-pdfminer

curl $1 | grep -E "http.*\.mp3" | sed "s/.*\(http.*\.mp3\).*/\1/" | xargs wget
2015-09-17 13:19:53
User: theodric
Functions: grep sed xargs

The difference between the original version provided and this one is that this one works rather than outputting a wget error

find /proc/*/fd -xtype f -printf "%l\n" | grep -P '^/(?!dev|proc|sys)' | sort | uniq -c | sort -n
2015-08-18 17:58:21
User: flatcap
Functions: find grep sort uniq
Tags: sort uniq find grep

List all open files of all processes.


find /proc/*/fd

Look through the /proc file descriptors


-xtype f

list only symlinks to file


-printf "%l\n"

print the symlink target


grep -P '^/(?!dev|proc|sys)'

ignore files from /dev /proc or /sys


sort | uniq -c | sort -n

count the results


Many processes will create and immediately delete temporary files.

These can the filtered out by adding:

... | grep -v " (deleted)$" | ...
git log -i --grep='needle'
2015-08-11 23:07:55
User: sudopeople
Tags: git grep git-log

Normally, searching git log comments is case sensitive. The -i luckily applies to the --grep switch.

grep -v -e '^$' -e '^[#\[]' -e '\/' some_file
2015-07-17 21:28:14
User: abhikeny
Functions: grep
Tags: grep no-match

Grep for:

>> non-empty lines : denoted by -v -e '^$'

>> that do not start with # (comments) or : denoted by -v -e '^[#\]'

>> and does not include : denoted by -v -e '\'

(Note that we use -v only once)

2015-04-20 13:09:44
User: pooderbill
Functions: ps
Tags: grep function ps

ps and grep is a dangerous combination -- grep tries to match everything on each line (thus the all too common: grep -v grep hack). ps -C doesn't use grep, it uses the process table for an exact match. Thus, you'll get an accurate list with: ps -fC sh rather finding every process with sh somewhere on the line.

lsof -i -n -P | grep -e "$(ps aux | grep node | grep -v grep | awk -F' ' '{print $2}' | xargs | awk -F' ' '{str = $1; for(i = 2; i < NF; i++) {str = str "\\|" $i} print str}')"
2015-02-14 23:24:00
User: hochmeister
Functions: grep

us lsof, grep for any pid matching a given name such as "node".

psgrep() ... func to long, please look under "description"
2015-01-01 02:58:48
User: Xk2c
Functions: look
Tags: grep function ps

David thanks for that grep inside!

here is mine version:



case ${1} in

( -E | -e )


shift 1






if [[ -z ${*} ]]


echo "psgrep - grep for process(es) by keyword" >&2

echo "Usage: psgrep [-E|-e] ... " >&2

echo "" >&2

echo "option [-E|-e] enables full extended regexp support" >&2

echo "without [-E|-e] plain strings are looked for" >&2

return 1


\ps -eo 'user,pid,pcpu,command' w | head -n1

local ARG=''

if (( ${EXTENDED_REGEXP} == 0 ))


while (( ${#} > 0 ))



shift 1

local STRING=${ARG}

local LENGTH=$(expr length ${STRING})

local FIRSCHAR=$(echo $(expr substr ${STRING} 1 1))

local REST=$(echo $(expr substr ${STRING} 2 ${LENGTH}))

\ps -eo 'user,pid,pcpu,command' w | grep "[${FIRSCHAR}]${REST}"



\ps -eo 'user,pid,pcpu,command' w | grep -iE "(${*})"



psg(){ ps aux | grep -E "[${1:0:1}]${1:1}|^USER"; }
2015-01-01 00:12:45
User: flatcap
Functions: grep ps
Tags: grep function ps

Function that searchs for process by its name:

* Shows the Header for reference

* Hides the process 'grep' from the list

* Case sensitive

The typical problem with using "ps | grep" is that the grep process shows up the in the output.

The usual solution is to search for "[p]attern" instead of "pattern".

This function turns the parameter into just such a [p]attern.

${1:0:1} is the first character of $1


${1:1} is characters 2-end of $1
psg(){ ps aux | grep -v grep | egrep -e "$1|USER"; }
2014-12-31 22:27:27
Functions: egrep grep ps
Tags: grep function ps

Function that searchs a process by its name and shows in the terminal.

* Shows the Header for reference

* Hides the process 'grep' from the list

* Case sensitive

nmap -sP | grep -v "Host" | tail -n +3 | tr '\n' ' ' | sed 's|Nmap|\nNmap|g' | grep "MAC Address" | cut -d " " -f5,8-15
2014-12-26 18:31:53
User: jaimerosario
Functions: cut grep sed tail tr

In the field, I needed to script a process to scan a specific vendor devices in the network. With the help of nmap, I got all the devices of that particular vendor, and started a scripted netcat session to download configuration files from a tftp server.

This is the nmap loop (part of the script). You can however, add another pipe with grep to filter the vendor/manufacturer devices only. If want to check the whole script, check in http://pastebin.com/ju7h4Xf4

grep VmHWM /proc/$(pgrep -d '/status /proc/' FOO)/status
2014-11-05 15:06:29
User: michelsberg
Functions: grep

Show the maximum amount of memory that was needed by a process at any time. My use case: Having a long-running computation job on $BIG_COMPUTER and judging whether it will also run on $SMALL_COMPUTER.


VmHWM: Peak resident set size ("high water mark")

grep -Eoa "\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" Filetosearch.txt
2014-11-02 19:50:54
User: jsbrown
Functions: grep

Command returns valid IP addresses. Append the following regex to additionally filter out NAT and reserved IP addresses

| grep -Ev "^0|\.0[0-9]|^10\.|^127\.|^169\.|^172\.(1[6-9]|2[0-9]|3[01])|^192.168.|^2(2[4-9]|3[0-9])|^2(4[0-9]|5[0-5])"

ls | tr '[[:punct:][:space:]]' '\n' | grep -v "^\s*$" | sort | uniq -c | sort -bn
2014-10-14 09:52:28
User: qdrizh
Functions: grep ls sort tr uniq
Tags: sort uniq ls grep tr

I'm sure there's a more elegant sed version for the tr + grep section.

gcloud components list | grep "^| Not" | sed "s/|\(.*\)|\(.*\)|\(.*\)|/\2/" | xargs echo gcloud components update
2014-10-13 20:52:25
User: wires
Functions: echo grep sed xargs

Google Cloud SDK comes with a package manager `gcloud components` but it needs a bit of `sed` to work. Modify the "^| Not" bit to change the package selection. (The gcloud --format option is currently broken)

firefox "$(grep -i ^url=* file.url | cut -b 5-)"
2014-10-08 05:56:27
User: nachos117

This command will use grep to read the shortcut (which in the above examle is file.url), and filter out all but the only important line, which contains the website URL, and some extra characters that will need to be removes (for example, URL=http://example.com). The cut command is then used to get rid of the URL= at the beginning. The output is then piped into Firefox, which should interpret the it as a web URL to be opened. Of course, you can replace Firefox with any other broswer. Tested in bash and sh.

egrep -wi --color 'warning|error|critical'
git reflog --date=local | grep "Oct 2 .* checkout: moving from .* to" | grep -o "[a-zA-Z0-9\-]*$" | sort | uniq
2014-10-03 15:12:22
User: Trindaz
Functions: grep sort

Replace "Oct 2" in the first grep pattern to be the date to view branch work from

tail -f LOG_FILE | grep --line-buffered SEARCH_STR | cut -d " " -f 7-
2014-08-07 10:40:45
User: pjsb
Functions: cut grep tail
Tags: grep cut tail -f

Outputs / monitors the content of the LOG_FILE , which matches the SEARCH_STR. The output is cutted by spaces (as delimiter) starting from column 7 till the end.

tail -f *.log | grep --color=always '|==>.+<=='
2014-07-11 07:47:27
User: danimath
Functions: grep tail
Tags: grep tail -f

This shows the the filenames of tail output in color. Helpful if you have many log files to tail