Finding the Needle in the Log Haystack

grep

grep "pattern" file           # print matching lines
grep -i "pattern" file          # case-insensitive
grep -r "pattern" dir/            # search every file under a directory, recursively
grep -n "pattern" file              # show line numbers
grep -c "pattern" file                # count matches instead of printing them

find

find /path -name "*.log"           # find files by name pattern, anywhere under /path
find /path -type f                   # only regular files, not directories

grep -r searches file contents. find -name searches file names. Different questions, easy to reach for the wrong one under pressure.

Just enough regex

A handful of characters cover most real searches:

• . matches any single character
• * means "zero or more of whatever came before it"
• ^ anchors to the start of a line, $ to the end
• [0-9] matches any one digit, [a-z] any lowercase letter

grep -E turns on extended regex, which adds + (one or more) and | (alternation - match either side) without needing to escape them.

Find the one line that matters

~/logs/ has nearly two thousand lines of routine INFO noise, one FATAL line buried somewhere in it, and an unrelated file nested a few directories deep that has nothing to do with any of this. Grep the whole tree at once, combining -r (recurse into every subdirectory) and -n (show line numbers):

grep -rn "FATAL" ~/logs/

/home/laborant/logs/app/service.log:1501:2026-09-22T10:11:47 FATAL ledger checksum mismatch on shard 7, code=E4821

One line, out of nearly two thousand, found in a single command - no need to know in advance which of the files under ~/logs/ it was hiding in. grep -r's output has three parts, colon-separated: the file path (.../service.log), the line number within that file (31, thanks to -n), then the matching line itself. That line ends with a token like code=E4821. Write just the code - E4821, without the code= part - into ~/answer.txt.