Core text tools — grep, cut, sort, uniq, tr, wc · Linux

Six text tools cover 80% of production log-and-data triage. This lesson is the muscle-memory foundation that the next two lessons (sed, awk; find, xargs) build on.

grep — find lines that match

The most-used flags in production:

Flag	Effect
`-i`	Case-insensitive
`-v`	Invert: print non-matching lines
`-c`	Count matches per file
`-l`	List filenames that have at least one match
`-n`	Print line numbers
`-o`	Print only the matched text, not the whole line
`-E`	Extended regex (egrep)
`-F`	Fixed string, no regex
`-P`	Perl-compatible regex (PCRE) — fastest for complex patterns
`-A N`	Print N lines of context after each match
`-B N`	Print N lines of context before each match
`-C N`	Print N lines of context around each match
`--color=auto`	Highlight matches in interactive use
`-r`	Recurse into directories
`-R`	Like `-r` but follows symlinks

Read-only / Safegrep with line numbers— -n prints the line number in the file. Useful for tracking down a specific entry.

$ grep -n 'systemd' /etc/group | head -3

42:systemd-journal:x:101:
43:systemd-network:x:102:
44:systemd-resolve:x:103:

Illustrative output

Quote your regex

A pattern like grep systemd-journal will be interpreted by the shell as a single argument because there are no unquoted shell metacharacters. But grep . is not “match a dot” — it is “match any character”. Always quote your pattern with single quotes:

grep 'pattern with . and spaces'

Single quotes are literal; double quotes allow variable expansion which is rarely what you want for grep.

cut — slice by column

cut extracts columns from delimited text. Three modes:

Read-only / Safecut by delimiter— -d: sets the delimiter to colon (good for /etc/passwd). -f1,7 selects fields 1 and 7 (username and shell).

$ grep '^root:' /etc/passwd | cut -d: -f1,7

root:/bin/bash

Illustrative output

Read-only / Safecut by character position— -c1-10 keeps characters 1 through 10. Useful for fixed-width records (e.g., some syslog formats).

$ uname -a | cut -c1-10

Linux 6.6.

Illustrative output

sort — order lines

Read-only / Safesort by numeric UID— -t: sets the delimiter; -k3 selects field 3 (UID); -n sorts numerically rather than lexically. Without -n, 'adm' (UID 3) would sort after 'avahi' (UID 120) because 'a' < '1'.

$ grep '^root:' /etc/passwd; printf '\n'; grep -v '^root:' /etc/passwd | sort -t: -k3 -n | head -3

root:x:0:0:root:/root:/bin/bash

abrt:x:173:173::/etc/abrt:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
avahi:x:120:124:Avahi mDNS daemon:/run/avahi:/sbin/nologin

Illustrative output

Useful flags: -r reverse, -u unique (sort + dedupe), -h human numeric sort (-h understands 1K, 2G), -V version sort, -R random, -s stable (disable last-resort comparison).

uniq — collapse adjacent duplicates

Read-only / Safeuniq counts— -c prefixes each line with the count. uniq only collapses adjacent duplicates — sort first if your data isn't grouped. 'b' appears twice because they were separated by other letters.

$ printf 'a\nb\nb\nc\nb\n' | uniq -c

Illustrative output

tr — translate or delete characters

Read-only / Safetr uppercase— tr maps character sets. 'a-z' → 'A-Z' is the classic case-conversion idiom.

$ echo "Hello, World!" | tr 'a-z' 'A-Z'

HELLO, WORLD!

Illustrative output

Read-only / Safetr delete— -d deletes characters. Here it strips newlines.

$ printf 'a\nb\nc\n' | tr -d '\n'; echo

abc

Illustrative output

Read-only / Safetr squeeze— -s squeezes repeats. Used to normalise whitespace.

$ echo "hello   world" | tr -s ' '

hello world

Illustrative output

wc — word, line, character, byte count

Read-only / Safewc default— Without flags, wc prints lines, words, and bytes. -l for lines only, -c for bytes, -m for characters (multibyte-aware), -w for words.

$ wc /etc/passwd

   46   92 3010 /etc/passwd

Illustrative output

The classic top-N pipeline

Many production diagnostics start with this shape:

Read-only / Safetop source IPs— Pull all ssh events from the last day, extract the source IP, count occurrences, and list the top 10. This pipeline is the canonical first step in investigating a brute-force attempt.

$ journalctl -u ssh --since '1 day ago' --no-pager 2>/dev/null | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -rn | head -10

...

Illustrative output

grep — find lines that match

cut — slice by column

sort — order lines

uniq — collapse adjacent duplicates

tr — translate or delete characters

wc — word, line, character, byte count

The classic top-N pipeline

Knowledge check