What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.




Commands using egrep from sorted by
Terminal - Commands using egrep - 186 results
netstat -nr|egrep -v "Routing|Interface|lo0"|awk '{print $5}'|sort -u| while read l; do ifconfig $l ; echo " Station Addr: `lanscan -ia|grep "$l "|cut -d ' ' -f 1`" ; done
dumpe2fs -h /dev/xvda1 | egrep -i 'mount count|check'
2014-10-22 08:38:43
User: manju712
Functions: dumpe2fs egrep

To check the total number of mounts, maximum number of mounts before performing the fsck and last time when the fsck was performed.

egrep -wi --color 'warning|error|critical'
cat /usr/share/dict/words | egrep '^\w{13,}$' | egrep -iv '(\w).*\1'
2014-09-29 12:52:09
User: hackerb9
Functions: cat egrep

This is the most straightforward approach: first regexp limits dictionary file to words with thirteen or more characters, second regexp discards any words that have a letter repeated. (Bonus challenge: Try doing it in a single regexp!)

finger $(whoami) | egrep -o 'Name: [a-zA-Z0-9 ]{1,}' | cut -d ':' -f 2 | xargs echo
2014-09-24 01:22:07
User: swebber
Functions: cut egrep finger xargs

Its possible to user a simple regex to extract de username from the finger command.

The final echo its optional, just for remove the initial space

ifconfig | egrep -A2 "eth|wlan" | tr -d "\n"| sed 's/\-\-/\n/g'|awk '{print "mac: "$5 " " $7}' | sed 's/addr:/addr: /g'
ethtool -S eth0 | egrep "(drop|disc|err|fifo|buf|fail|miss|OOB|fcs|full|frags|hdr|tso).*: [^0]"
2014-07-15 05:27:34
User: suprjami
Functions: egrep

A grep against ethtool to look for common errors and packet loss statistics which network drivers report in their private data, which is queried with ethool -S. This is the current grep used in xsos (https://github.com/ryran/xsos), which I originally contributed and has been improved by the community over time.

cut -f 2 -d ':' oclHashcat.pot | egrep -oi '[a-z]{1,20}' | sort | uniq > base.pot
grep "btrfs: checksum error at logical" /var/log/messages | egrep -o "[^ ]+$" | tr -d ')' | sort | uniq
2014-07-01 08:15:26
User: jcoll
Functions: egrep grep sort tr

Filter entries in OpenSuse /var/log/messages like:

timestamp servername kernel: [83242.108090] btrfs: checksum error at logical 1592344576 on dev /dev/sda5, sector 5223584, root 5, inode 2652, offset 282624, length 4096, links 1 (path: log/warn)

echo $(ifconfig) | egrep -o "en.*?inet [^ ]* " | sed 's/.*inet \(.*\)$/\1/' | tail -n +2
read -p "Please enter the 4chan url: "|egrep '//i.4cdn.org/[a-z0-9]+/src/([0-9]*).(jpg|png|gif)' - -o|nl -s https:|cut -c7-|uniq|wget -nc -i - --random-wait
function colorize() { c="--line-buffered --color=yes"; GREP_COLORS="mt=01;34" egrep $c '(^| 200 | 304 )' "${@}" | GREP_COLORS="mt=02;31" egrep $c '(^|"(GET|POST) .*[^0-9] 4[0-1][0-9] )' | GREP_COLORS="ms=02;37" egrep $c '(^|^[0-9\.]+) ';}
2013-08-14 21:05:34
User: mogsie
Functions: egrep

Puts a splash of color in your access logs. IP addresses are gray, 200 and 304 are green, all 4xx errors are red. Works well with e.g. "colorize access_log | less -R" if you want to see your colors while paging.

Use as inspiration for other things you might be tailing, like syslog or vmstat


tail -f access.log | colorize
ifconfig | egrep [0-9A-Za-z]{2}\(:[0-9A-Za-z]{2}\){5} | awk '{print $1 ":\t" $5}'
2013-07-30 17:02:07
User: jaimeanrm
Functions: awk egrep ifconfig

Is the better option on a Open SuSE Box

while read X ; do printf "$X --"; virsh dumpxml $X | egrep "source dev|source file"; done< <(virsh list | awk '$1 ~ /^[1-9]/ { print $2 }')
2013-07-29 17:32:59
User: hugme
Functions: awk egrep printf read

This will strip out the relivent disk information from kvm. I'm using it to find disks on a SAN which are no longer in use.

mysql -e 'show databases' -s --skip-column-names | egrep -v "^(test|mysql|performance_schema|information_schema)$" | parallel --gnu "mysqldump --routines {} > {}_daily.sql"
2013-07-24 15:37:58
User: intel352
Functions: egrep

Backs up all databases, excluding test, mysql, performance_schema, information_schema.

Requires parallel to work, install parallel on Ubuntu by running: sudo aptitude install parallel

netstat -tn | awk '{print $5}' | egrep -v '(localhost|\*\:\*|Address|and|servers|fff|127\.0\.0)' | sed 's/:[0-99999999].*//g'
2013-06-13 14:35:38
User: kehansen
Functions: awk egrep netstat sed

I used this to get all the remote connection ip addresses connected to my server... I had to start storing and tracking this data so thats why i built this out... probably not optimal as far as the egrep regex but it works ;)

git branch -r | awk '{print $1}' | egrep -v -f /dev/fd/0 <(git branch -vv | grep origin) | awk '{print $1}' | xargs git branch -d
iwlist ath0 scanning |egrep '(ESSID|Signal|Address)'| \sed -e 's/Cell - Address:*//g' -e 's/ESSID://g' \-e 's/Noise level=-//g' -e 's/dBm//g' \-e 's/Quality=*//g' -e 's/Signal level=-//g' \-e 's/"//g'
svn ls -R | egrep -v -e "\/$" | xargs svn blame | awk '{count[$2]++}END{for(j in count) print count[j] "\t" j}' | sort -rn
2013-05-03 01:45:12
User: kurzum
Functions: awk egrep ls sort xargs
Tags: svn count

This one has a better performance, as it is a one pass count with awk. For this script it might not matter, but for others it is a good optiomization.

svn ls -R | egrep -v -e "\/$" | tr '\n' '\0' | xargs -0 svn blame | awk '{print $2}' | sort | uniq -c | sort -nr
2013-04-10 19:37:53
User: rymo
Functions: awk egrep ls sort tr uniq xargs
Tags: svn count

make usable on OSX with filenames containing spaces. note: will still break if filenames contain newlines... possible, but who does that?!

egrep -v "(^#|^\b*$)"
DATE=`date +"%H:%M" --date '-1 min'`; egrep "\ $DATE\:..\ " /var/log/dhcpd.log |awk '/DHCPREQUEST/ {split($3,t,":"); printf("%02d:%02d\n",t[1],t[2]);}' |uniq -c;
alias gfind='find . -print0 | xargs -0 egrep -I '
du --max-depth=1 -h * |sort -h -k 1 |egrep '(M|G)\s'
2013-02-14 08:56:56
User: TerDale
Functions: du egrep sort

Enhanced version: fixes sorting by human readable numbers, and filters out non MB or GB entries that have a G or an M in their name.

tcpdump -i eth0 port http or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|userna me:|password:|login:|pass |user '