What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Universal configuration monitoring and system of record for IT.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.

Top Tags



Commands tagged grep from sorted by
Terminal - Commands tagged grep - 352 results
sudo apt-get remove $(dpkg -l|awk '/^ii linux-image-/{print $2}'|sed 's/linux-image-//'|awk -v v=`uname -r` 'v>$0'|sed 's/-generic*//'|awk '{printf("linux-headers-%s\nlinux-headers-%s-generic*\nlinux-image-%s-generic*\n",$0,$0,$0)}')
2012-08-15 10:02:12
User: mtron
Functions: awk sed sudo

Remove old kernels (*-generic and *-generic-pae) via apt-get on debian/ubuntu based systems. Tested on ubuntu 10.04 - 12.04.

egrep_escape() { echo "$1" |sed -re 's/([\\.*+?(|)^$[])/\\\1/g' -e 's/\{/[{]/g'; }
2012-08-02 16:54:43
User: regnarg
Functions: echo sed
Tags: grep escape

Use if you want to include untrusted literal strings in your grep regexes.

I use it to list all mounts below a directory:

dir=/mnt/gentoo; cat /proc/mounts |awk '{print $2}' |egrep "^$(egrep_escape "$dir")(/|$)"






Works even if $dir contains dangerous characters (e.g. comes from a commandline argument).

egrep '.*(("STATUS)|("HEAD)).*' http_access.2012.07.18.log | awk '{sum+=$11; ++n} END {print "Tot="sum"("n")";print "Avg="sum/n}'
2012-07-27 12:18:29
User: fanchok
Functions: awk egrep

Depending on your Apache access log configuration you may have to change the sum+=$11 to previous or next awk token.

Beware, usually in access log last token is time of response in microseconds, penultimate token is size of response in bytes. You may use this command line to calculate sum and average of responses sizes.

You can also refine the egrep regexp to match specific HTTP requests.

sudo apt-get remove $(dpkg -l|awk '/^ii linux-image-/{print $2}'|sed 's/linux-image-//'|awk -v v=`uname -r` 'v>$0'|sed 's/-generic-pae//'|awk '{printf("linux-headers-%s\nlinux-headers-%s-generic*\nlinux-image-%s-generic*\n",$0,$0,$0)}')
grep -c "^$" filename
2012-06-26 17:43:17
User: ankush108
Functions: grep
Tags: grep count empty

This pattern matches empty lines in the file and -c gives the count

netstat -tn | grep :80 | awk '{print $5}'| grep -v ':80' | cut -f1 -d: |cut -f1,2,3 -d. | sort | uniq -c| sort -n
2012-06-26 08:29:37
User: krishnan
Functions: awk cut grep netstat sort uniq

cut -f1,2 - IP range 16

cut -f1,2,3 - IP range 24

cut -f1,2,3,4 - IP range 24

find /path/to/dir -type f -print0 | xargs -0 grep -l "foo"
tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
2012-06-18 19:27:54
User: jseidl
Functions: egrep ftp tcpdump

Simple TCPDUMP grepping for common unsafe protocols (HTTP, POP3, SMTP, FTP)

svn status | grep "^M" | while read entry; do file=`echo $entry | awk '{print $2}'`; echo $file; svn revert $file; done
2012-06-17 16:01:06
User: wsams
Functions: awk echo grep read

This command allows you to revert every modified file one-by-one in a while loop, but also after "echo $file;" you can do any sort of processing you might want to add before the revert happens.

grep -r -Z -l "<text>" . | xargs -0 echo rm
2012-06-14 08:09:46
User: limonte
Functions: echo grep xargs
Tags: grep

-r recursively

-Z zero byte after each file name instead of the usual newline

-l only filenames

ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
mysqlbinlog <logfiles> | grep exec | grep end_log_pos | cut -d' ' -f2- | cut -d: -f-2 | uniq -c
2012-05-30 09:42:21
User: theist
Functions: cut exec grep uniq

shows number of mysql bin log events (which are mysql server events) per minute, useful to check stress times postmortem

mysqlbinlog <logfiles> | grep exec | grep end_log_pos | grep -v exec_time=0 | sed 's/^\(.*exec_time=\([0-9]\+\).*\)/\2 - \1 /' | sort -n
2012-05-30 09:38:02
User: theist
Functions: exec grep sed sort

Shows sorted by query time, the headers of mysqlbinlog entries. Then is easy to locate the heavier events on the raw log dump

cal 04 2012 | awk 'NF <= 7 { print $7 }' | grep -v "^$" | tail -1
2012-05-03 16:57:45
User: javidjamae
Functions: awk cal grep tail

This is a little trickier than finding the last Sunday, because you know the last Sunday is in the first position of the last line. The trick is to use the NF less than or equal to 7 so it picks up all the lines then grep out any empty lines.

while true; do iptables -nvL > /tmp/now; diff -U0 /tmp/prev /tmp/now > /tmp/diff; clear; cat /tmp/diff; mv /tmp/now /tmp/prev; slee p 1; done
2012-04-15 00:02:33
Functions: cat diff iptables mv

this alternative shows the differences as they occur so that they are made plain

find ./src -type d -name "Entity" | xargs ls -A | cut -d . -f1 | sed 's_^_app/console doctrine:generate:entities YourOwnBundleName:_'
2012-04-11 21:28:02
User: renoirb
Functions: cut find ls sed xargs

When I do a major change in my entities, I want to find a way to find all my Entities names and create the commande for me.

So instead of doing ls src/Your/OwnBundle... and then do it manually, this helps a lot.

egrep "([_a-zA-Z][_a-zA-Z0-9]*) *= *\1 *[*/+-] *[0-9]+ *;"
2012-04-09 12:42:07
User: aandre
Functions: egrep

Search for java explicit incrementation in order to replace it with postfix or assignment operator

find /some/path -type f -and -printf "%f\n" | egrep -io '\.[^.]*$' | sort | uniq -c | sort -rn
2012-04-02 19:25:35
User: kyle0r
Functions: egrep find sort uniq
Tags: uniq ls grep


find -printf "%f\n" prints just the file name from the given path. This means directory paths which contain extensions will not be considered.
sudo apt-get remove $(dpkg -l|awk '/^ii linux-image-/{print $2}'|sed 's/linux-image-//'|awk -v v=`uname -r` 'v>$0'|sed 's/-generic//'|awk '{printf("linux-headers-%s\nlinux-headers-%s-generic\nlinux-image-%s-generic\n",$0,$0,$0)}')
2012-04-02 10:53:40
User: mtron
Functions: awk sed sudo

small update for this command to work with linux kernels 3.x

curl -s -d "CSField=Name" -d "CSInput=BostonUCompSci" http://torstatus.blutmagie.de/index.php | grep -oP "ip=\K(\d+)(\.\d+){3}"
2012-03-09 16:52:27
User: JisSey
Functions: grep

Reciprocally, we could get the node name from a give Tor IP address =>

ip2node() { curl -s -d "QueryIP=$1" http://torstatus.blutmagie.de/tor_exit_query.php | grep -oP "Server name:.*'>\K\w+" ; }



alias sortfast='sort -S$(($(sed '\''/MemF/!d;s/[^0-9]*//g'\'' /proc/meminfo)/2048)) $([ `nproc` -gt 1 ]&&echo -n --parallel=`nproc`)'

sort is way slow by default. This tells sort to use a buffer equal to half of the available free memory. It also will use multiple process for the sort equal to the number of cpus on your machine (if greater than 1). For me, it is magnitudes faster.

If you put this in your bash_profile or startup file, it will be set correctly when bash is started.

sort -S1 --parallel=2 <(echo) &>/dev/null && alias sortfast='sort -S$(($(sed '\''/MemF/!d;s/[^0-9]*//g'\'' /proc/meminfo)/2048)) $([ `nproc` -gt 1 ]&&echo -n --parallel=`nproc`)'


echo|sort -S10M --parallel=2 &>/dev/null && alias sortfast="command sort -S$(($(sed '/MemT/!d;s/[^0-9]*//g' /proc/meminfo)/1024-200)) --parallel=$(($(command grep -c ^proc /proc/cpuinfo)*2))"
grep $'\t' sample.txt
cmdfu(){ local t=~/cmdfu;echo -e "\n# $1 {{{1">>$t;curl -s "commandlinefu.com/commands/matching/$1/`echo -n $1|base64`/plaintext"|sed '1,2d;s/^#.*/& {{{2/g'>$t;vim -u /dev/null -c "set ft=sh fdm=marker fdl=1 noswf" -M $t;rm $t; }
2012-02-21 05:43:16
User: AskApache
Functions: echo rm sed vim

Here is the full function (got trunctated), which is much better and works for multiple queries.

function cmdfu () {

local t=~/cmdfu;

until [[ -z $1 ]]; do

echo -e "\n# $1 {{{1" >> $t;

curl -s "commandlinefu.com/commands/matching/$1/`echo -n $1|base64`/plaintext" | sed '1,2d;s/^#.*/& {{{2/g' | tee -a $t > $t.c;

sed -i "s/^# $1 {/# $1 - `grep -c '^#' $t.c` {/" $t;



vim -u /dev/null -c "set ft=sh fdm=marker fdl=1 noswf" -M $t;

rm $t $t.c


Searches commandlinefu for single/multiple queries and displays syntax-highlighted, folded, and numbered results in vim.

rgrep <searchterm> *
grep -r <searchterm> .
2012-02-08 11:59:17
Functions: grep
Tags: grep directory

You don't need to use "*", it will fail if the working directory has too many fails due parameter extension, you can simply pass the working directory using ".".