💎 Earn 45%—Join Hostman Affiliate Program!
SupportContact Sales
English
Solutions
Community
Sign In
Sign In

How to Use Grep and Regular Expressions in Linux

How to Use Grep and Regular Expressions in Linux
Hostman Team
Technical writer
Linux
11.02.2025
Reading time: 16 min
Share

GREP (short for "global regular expression print") is one of the most popular utilities in the Linux operating system.

With it, you can search for phrases (sequences of characters) in multiple files simultaneously using regular expressions and filter the output of other commands, keeping only the necessary information.

This guide will cover how to search for specific expressions in a set of text files with various contents using the GREP utility.

All examples shown were run on a cloud server hosted by Hostman running Ubuntu version 22.04.

How Does GREP Work

The GREP command follows this structure:

grep [OPTIONS] [PATTERN] [SOURCES]

Where:

  • OPTIONS: Special parameters (flags) that activate certain mechanisms in the utility related to searching for expressions and displaying results.

  • PATTERN: A regular expression (or plain string) containing the phrase (pattern, template, sequence of characters) you want to find.

  • SOURCES: The path to the files where we will search for the specified expression.

If the GREP command is used to filter the output of another command, its structure looks a bit different:

[COMMAND] | grep [OPTIONS] [PATTERN]

Thus:

  • COMMAND: An arbitrary command with its own set of parameters whose output needs to be filtered.

  • The "pipe" symbol (|) is necessary to create a command pipeline, redirecting streams so that the output of an arbitrary command becomes the input for the GREP command.

Preparation

To understand the nuances of using GREP, it's best to start with small examples of searching for specific phrases. Therefore, we will first create a few text files and then test the GREP command on them.

Let’s first prepare a separate directory where the search will take place:

mkdir texts

Next, create the first file:

nano texts/poem

It will contain one of Langston Hughes's poems:

Hold fast to dreams  
For if dreams die  
Life is a broken-winged bird  
That cannot fly.  
Hold fast to dreams  
For when dreams go  
Life is a barren field  
Frozen with snow.

Now, create the second file:

nano texts/code.py

It will contain a simple Python script:

from datetime import date

dateNow = date.today()
print("Current time:", dateNow)

Finally, create the third file:

nano texts/page.html

This one will have simple HTML markup:

<html>
	<head>
		<title>Some Title</title>
	</head>

	<body>
		<div class="block">
			<p>There's gold here</p>
		</div>

		<div class="block">
			<p>A mixture of wax and clouds</p>
		</div>

		<div class="block block_special">
			<p>Today there's nothing</p>
		</div>
	</body>
</html>

By using files of different formats, we can better understand what the GREP command does by utilizing the full range of the utility's features.

Regular Expressions

Regular expressions are the foundation of the GREP command. Unlike a regular string, regular expressions contain special characters that allow you to specify phrases with a certain degree of variability.

When using the GREP utility, regular expressions are placed within single quotes:

'^date[[:alpha:]]*'

Thus, the full command can look like this:

grep '^date[[:alpha:]]*' texts/*

In this case, the console output will be:

texts/code.py:dateNow = date.today()

However, using double quotes allows you to pass various system data into the expression. For example, you can first create an environment variable with the search expression:

PATTERN="^date[[:alpha:]]*"

And then use it in the GREP command:

grep "$PATTERN" ./texts/*

Additionally, using single backticks allows you to use bash subprocess commands within the GREP command. For example, you can extract a regular expression from a pre-prepared file:

grep `cat somefile` ./texts/*

Note that with the asterisk symbol (wildcard), you can specify all the files in the directory at once. However, the GREP command also allows you to specify just one file: 

grep '^date[[:alpha:]]' texts/code.py 

Because regular expressions are a universal language used in many operating systems and programming languages, their study is a separate vast topic. 

However, it makes sense to briefly cover the main special characters and their functions. It’s important to note that regular expressions in Linux can work in two modes: basic (Basic Regular Expression, BRE) and extended (Extended Regular Expression, ERE). The extended mode is activated with the additional flag -E. The difference between the two modes lies in the number of available special characters and, consequently, the breadth of available functionality.

Basic Syntax

Basic syntax allows you to define only general formal constructs without considering the specific configuration of their characters.

Start of a line — ^

The caret symbol indicates that the sought sequence of characters must be at the beginning of the line:

grep '^Hold' texts/*

The console output will be as follows:

texts/poem:Hold fast to dreams
texts/poem:Hold fast to dreams

End of a line — $

The dollar sign indicates that the sought sequence of characters must be at the end of the line:

grep '</p>$' texts/*

Output:

texts/page.html:                        <p>There's gold here</p>
texts/page.html:                        <p>A mixture of wax and clouds</p>
texts/page.html:                        <p>Today there's nothing</p>

Note that the console output preserves the original representation of the found lines as they appear in the files.

Start of a word — \<

The backslash and less-than symbol indicate that the sought phrase must be at the beginning of a word:

grep '\<br' texts/*

Output:

texts/poem:Life is a broken-winged bird

End of a word — \>

The backslash and greater-than symbol indicate that the sought sequence of characters must be at the end of a word:

grep 'en\>' texts/*

Output:

texts/poem:Life is a broken-winged bird
texts/poem:For when dreams go
texts/poem:Life is a barren field
texts/poem:Frozen with snow.

Start or end of a word — \b

You can specify the start or end of a word using the more universal sequence of characters — backslash and the letter b.

For example, this marks the beginning:

grep '\bdie' texts/*

Output:

texts/poem:For if dreams die

And this marks the end:

grep '<div\b' texts/*

In this case, the console terminal output will be as follows:

texts/page.html:                <div class="block">
texts/page.html:                <div class="block">
texts/page.html:                <div class="block block_special">

Any character — .

Certain characters in the sought phrases can be left unspecified using the dot symbol:

grep '..ere' texts/*

Output:

texts/page.html:                        <p>There's gold here</p>
texts/page.html:                        <p>Today there's nothing</p>

Extended Syntax

Unlike basic syntax, extended syntax allows you to specify the exact number of characters in the sought phrases, thus expanding the range of possible matches.

Combining patterns — |

To avoid running the GREP command multiple times, you can specify several patterns in a single regular expression:

grep -E '^Hold|</p>$' texts/*

The result of running this command will be a combined console output containing the search results for the two separate regular expressions shown earlier.

texts/page.html:                        <p>There's gold here</p>
texts/page.html:                        <p>A mixture of wax and clouds</p>
texts/page.html:                        <p>Today there's nothing</p>
texts/poem:Hold fast to dreams
texts/poem:Hold fast to dreams

Repetition range — {n, d}

In some cases, certain characters in the sought phrase may vary in quantity. Therefore, in the regular expression, you can specify a range of the allowed number of specific characters.

grep -E 'en{1,2}' texts/*

Output:

texts/code.py:print("Current time:", dateNow)
texts/poem:Life is a broken-winged bird
texts/poem:For when dreams go
texts/poem:Life is a barren field
texts/poem:Frozen with snow.

However, frequently used repetition intervals are more conveniently written as special characters, thus simplifying the appearance of the regular expression.

One or more repetitions — +

A repetition interval from one to infinity can be expressed using the plus sign:

grep -E 'en+' texts/*

In this case, the console output will not differ from the previous example.

texts/code.py:print("Current time:", dateNow)
texts/poem:Life is a broken-winged bird
texts/poem:For when dreams go
texts/poem:Life is a barren field
texts/poem:Frozen with snow.

Zero or one repetition — ?

A repetition interval from 0 to 1 can be expressed using the question mark:

grep -E 'ss?' texts/*

As a result, this command will produce the following output in the console terminal:

texts/page.html:                <div class="block">
texts/page.html:                        <p>There's gold here</p>
texts/page.html:                <div class="block">
texts/page.html:                        <p>A mixture of wax and clouds</p>
texts/page.html:                <div class="block block_special">
texts/page.html:                        <p>Today there's nothing</p>
texts/poem:Hold fast to dreams
texts/poem:For if dreams die
texts/poem:Life is a broken-winged bird
texts/poem:Hold fast to dreams
texts/poem:For when dreams go
texts/poem:Life is a barren field
texts/poem:Frozen with snow.

Character set — [abc]

Instead of one specific character, you can specify an entire set enclosed in square brackets:

grep -E '[Hh]o[Ll]' texts/*

Output:

texts/poem:Hold fast to dreams
texts/poem:Hold fast to dreams

Character range — [a-z]

We can replace a large set of allowed characters with a range written using a hyphen:

grep -E 'h[a-z]+' texts/*

Output:

texts/page.html:<html>
texts/page.html:        <head>
texts/page.html:        </head>
texts/page.html:                        <p>There's gold here</p>
texts/page.html:                        <p>Today there's nothing</p>
texts/page.html:</html>
texts/poem:That cannot fly.
texts/poem:For when dreams go

Moreover, character sets and ranges can be combined:

grep -E 'h[abcd-z]+' texts/*

Each range is implicitly transformed into a set of characters:

  • [a-e] into [abcde]
  • [0-6] into [0123456]
  • [a-eA-F] into [abcdeABCDEF]
  • [A-Fa-e] into [ABCDEFabcde]
  • [A-Fa-e0-9] into [ABCDEFabcde0123456789]
  • [a-dA-CE-G] into [abcdABCEFG]
  • [acegi-l5-9] into [acegijkl56789]

Character type — [:alpha:]

Frequently used ranges can be replaced with predefined character types, whose names are specified in square brackets with colons:

[:lower:]

characters from a to z in lowercase

[:upper:]

characters from A to Z in uppercase

[:alpha:]

all alphabetic characters

[:digit:]

all digit characters

[:alnum:]

all alphabetic characters and digits

It is important to understand that the character type is a separate syntactic construct. This means that it must be enclosed in square brackets, which denote a set or range of characters:

grep -E '[[:alpha:]]+ere' texts/*

Output:

texts/page.html:                        <p>There's gold here</p>
texts/page.html:                        <p>Today there's nothing</p>

Filtering Output

To filter the output of another command, you need to write a pipe symbol after it, followed by the standard call to the GREP utility, but without specifying the files to search:

cat texts/code.py | grep 'import'

Like when searching in regular files, the console output will contain the lines with the matches of the specified phrases:

from datetime import date

In this case, the cat command extracts the file content and passes it to the input stream of the GREP utility.

Search Options

In addition to regular expressions, you can specify additional keys for the GREP command, which are special options in flag format that refine the search.

Extended Regular Expressions (-E)

Activates the extended regular expressions mode, allowing the use of more special characters.

Case Insensitivity (-i)

Performs a search for a regular expression without considering the case of characters:

grep -E -i 'b[ar]' texts/*

The console output corresponding to this command will be:

texts/poem:Life is a broken-winged bird
texts/poem:Life is a barren field

You can also specify flags together in a single string:

grep -Ei 'b[ar]' texts/*

Whole Word (-w)

Performs a search so that the specified regular expression is a complete word (not just a substring) in the found line:

grep -w and texts/*

Note that quotes are not required when specifying a regular string without special characters.

The result of this command will be:

texts/page.html: <p>A mixture of wax and clouds</p>

Multiple Expressions (-e)

To avoid running the command multiple times, you can specify several expressions at once:

grep -e 'Hold' -e 'html' texts/*

The result of this command will be identical to this one:

grep -E 'Hold|html' texts/*

In both cases, the console terminal will display the following output:

texts/page.html:<html>
texts/page.html:</html>
texts/poem:Hold fast to dreams
texts/poem:Hold fast to dreams

Recursive Search (-r)

Performs a recursive search in the specified directory to the maximum depth of nesting:

grep -r '[Ff]ilesystem' /root

The console terminal will display output containing file paths at different nesting levels relative to the specified directory:

/root/parser/parser/settings.py:#HTTPCACHE_STORAGE = "scrapy.extensions.httpcache.FilesystemCacheStorage"
/root/resize.log:Resizing the filesystem on /dev/vda1 to 3931904 (4k) blocks.
/root/resize.log:The filesystem on /dev/vda1 is now 3931904 (4k) blocks long.

Search for Special Characters (-F)

Allows the use of special characters as the characters of the search phrase:

grep -F '[' texts/*

Without this flag, you would encounter an error in the console terminal:

grep: Invalid regular expression

An alternative to this flag would be using the escape character in the form of a backslash (\):

grep '\[' texts/*

Including Files (--include)

Allows limiting the search to the specified files only:

grep --include='*.py' 'date' texts/*

The console output will be:

texts/code.py:from datetime import date
texts/code.py:dateNow = date.today()
texts/code.py:print("Current time:", dateNow)

We can also write this command without the wildcard by using an additional recursive search flag:

grep -r --include='*.py' 'date' texts

Excluding Files (--exclude)

Selectively excludes certain files from the list of search sources:

grep --exclude='*.py' 'th' texts/*

The console output will be:

texts/page.html: <p>Today there's nothing</p>
texts/poem:Frozen with snow.

Output Options

Some parameters of the GREP command affect only the output of search results, improving their informativeness and clarity.

Line Numbers (-n)

To increase the informativeness of the GREP results, you can add the line numbers where the search phrases were found:

grep -n '</p>$' texts/*

Each line in the output will be supplemented with the corresponding line number:

texts/page.html:8:                      <p>There's gold here</p>
texts/page.html:12:                     <p>A mixture of wax and clouds</p>
texts/page.html:16:                     <p>Today there's nothing</p>

Lines Before (-B)

Displays a specified number of lines before the lines with found matches:

grep -B3 'mix' texts/*

After the flag, you specify the number of previous lines to be displayed in the console terminal:

texts/page.html-                </div>
texts/page.html-
texts/page.html-                <div class="block">
texts/page.html:                        <p>A mixture of wax and clouds</p>

Lines After (-A)

Displays a specified number of lines after the lines with found matches:

grep -A3 'mix' texts/*

After the flag, you specify the number of subsequent lines to be displayed in the console terminal:

texts/page.html:                        <p>A mixture of wax and clouds</p>
texts/page.html-                </div>
texts/page.html-
texts/page.html-                <div class="block block_special">

Lines Before and After (-C)

Displays a specified number of lines both before and after the lines with found matches:

grep -C3 'mix' texts/*

After the flag, you specify the number of preceding and following lines to be displayed in the console terminal:

texts/page.html-                </div>
texts/page.html-
texts/page.html-                <div class="block">
texts/page.html:                        <p>A mixture of wax and clouds</p>
texts/page.html-                </div>
texts/page.html-
texts/page.html-                <div class="block block_special">

Line Count (-c)

Instead of listing the found lines, the GREP command will output only the number of matches:

grep -c 't' texts/*

The console output will contain the count of matches found in all specified files:

texts/code.py:3
texts/page.html:5
texts/poem:4

If only one file is specified as the source:

grep -c 't' texts/block

The console output will contain only the number:

4

File Names (-l)

This flag allows you to output only the names of the files in which matches were found:

grep -l 't' texts/*

The console output will be as follows:

texts/code.py
texts/page.html
texts/poem

Limit Output (-m)

Limits the number of lines output to the console terminal to the number specified next to the flag:

grep -m2 't' texts/*

The console output will be:

texts/code.py:from datetime import date
texts/code.py:dateNow = date.today()
texts/page.html:<html>
texts/page.html:                <title>Some Title</title>
texts/poem:Hold fast to dreams
texts/poem:That cannot fly.

As you can see, the limiting number affects not the entire output but the lines of each file.

Exact Match of Whole Line (-x)

Searches for an exact match of the entire line with no variability:

grep -x 'Life is a broken-winged bird' texts/*

The console output will be:

texts/poem:Life is a broken-winged bird

Conclusion

The GREP command in Linux is the most flexible and precise tool for searching expressions in large volumes of text data.

When using the command, you need to specify the following elements:

  • A specific set of options (flags) that configure the search and output mechanisms.
  • One or more regular expressions that describe the search phrase.
  • A list of sources (files and directories) where the search will be performed.

Additionally, the utility is used to filter the output of other commands by redirecting input and output streams.

And if you’re looking for a reliable, high-performance, and budget-friendly solution for your workflows, Hostman has you covered with Linux VPS Hosting options, including Debian VPS, Ubuntu VPS, and VPS CentOS.

The core of the GREP command is regular expressions. Unlike a simple string, they allow you to define a phrase with a certain degree of variability, making it match multiple similar entries.

There are two modes of operation for regular expressions:

  • Basic Mode: A limited set of special characters that allow you to formalize expressions only in general terms.
  • Extended Mode: A full set of special characters that allows you to formalize expressions with precision down to each character.

The extended mode provides complete flexibility and accuracy when working with regular expressions.

In rare cases where you only need to find matches for trivial patterns, you can limit yourself to the basic mode.

Linux
11.02.2025
Reading time: 16 min
Share

Similar

Linux

Linux cp Command

Linux has an unlimited set of commands to perform assigned tasks. The Linux cp command is the primary tool and the basis for copying and managing files and directories in this operating system. This function is designed to duplicate files or directories in the same or different location. Armed with this functionality, users have advanced capabilities: from creating backup copies to moving files between directories. Linux cp command is simple to learn You can find all the necessary information covered in this tutorial. You will discover how the Linux cp command and cp directory work, as well as its grammatical structures, crucial hints, parameters, settings, and recommended practices. Readers will learn the tricks of the cp command, which will help them become more proficient. And if you’re looking for a reliable, high-performance, and budget-friendly solution for your workflows, Hostman has you covered with virtual servers with NVMe storage, Linux VPS Hosting options, including Debian VPS, Ubuntu VPS, and VPS CentOS. The core of the cp command in Linux The functionality of the command allows users to control the creation of copies. One feature offers overwriting existing files, another is responsible for recursively copying a directory with its entire entities, and the third protects the first data for repeating backups. This command demonstrates more features for specific purposes and user experience during the process. A key benefit of the cp command is its exceptional accuracy in duplicating files and directories. You can be absolutely sure that the duplicated files are identical to the original ones with all its interior. Therefore, the user can replicate the original file without any changes. The cp command in Linux inherently tells the user a destination directory for storing copies in a specific repository. The command's precision makes it indispensable for both novice and advanced users. Linux cp syntax This command consists of the following parameters: source file or directory and destination directory. The basic syntax of the Linux cp command is as follows: cp [...file/directory-sources] [destination] Here [file/directory-sources] specifies the files or directories sources to copy, while the [destination] specifies the location to copy the file to. There are the letter flags to specify the way of creation a replica of files and directories: -a leaves the first file attributes the same; -r recursively replicates directories and their interior entities; -v shows copied files in detail; -i requires consent to overwrite the file; -u rewrites new or missing files in the destination directory; -f forcibly copies without user consent; -s makes a symbolic link instead of a file replica; -ra recreates an exact duplicate of a file or directory without changing attributes; -rf updates or changes a file or directory with the original name in the same place; -pv (if installed) monitors and shows the time required to complete copying large folders. How to copy files with the cp command To make a file copy, apply the cp command in Linux as follows: cp ./DirectoryA_1/README.txt ./DirectoryA_2 where ./DirectoryA_1/README.txt is the source file, and ./DirectoryA_2 is the destination. The cp command was originally designed to interact with files. To replicate directories, you must use the -r flag to command that the directory with all its interior entities to be copied recursively. Therefore, you should write cp -r before the directory sources in Linux as follows: cp -r ./DirectoryA_1/Folder/ ./DirectoryA_2 The cp -r command in Linux will recursively duplicate the Folder directory in ./DirectoryA_1/ as well as all contents in the Folder directory. For instance, if you need to replicate the whole file contents in DirectoryA_1 with the .txt extension, try following command: cp ./DirectoryA_1/*.txt ./DirectoryA_2 where ./DirectoryA_1/*.txt matches files with the .txt extension in their names, and the cp command duplicates all those data to the destination. Best practices of the cp Linux command To duplicate one unit of information via the Linux cp command, write down the file name and destination directory. For instance, to replicate a file named example.txt to the 'Documents' directory, try the following command: cp example.txt Documents/ The action leads to creating a file duplicate in the 'Documents' directory with the original name. To copy multiple files at once, utilize the cp command in Linux, specifying the file names separated by a space. For instance, to duplicate three files named 'file1.txt', 'file2.txt', and 'file3.txt' to the 'Documents' directory, try the following command: cp file1.txt file2.txt file3.txt Documents/ To replicate a directory with all its interior entities, apply the -r that means cp recursive feature in Linux. For instance, to duplicate a directory named 'Pictures' to the 'Documents' directory, try the following command: cp -r Pictures Documents/ The action leads to creating a copy of the 'Pictures' directory with all its interior contents in the 'Documents' directory. To replicate a folder in Linux, you should utilize the -r flag. For instance, to duplicate a folder named 'Pictures' from the existing directory to a folder named 'Photos' in the home directory, try the following command: cp -r Pictures/ ~/Photos/ The destination folder will be created automatically if none exists. The files in the destination folder will be combined with the core of the source folder if one already exists. The cp -a feature in Linux leaves unchanged the initial file attributes while copying. Therefore, the duplicates will have the same parameters as their originals. For instance, to replicate a file named 'example.txt' to the 'Documents' directory while leaving unchanged its attributes, try the following command: cp -a example.txt Documents/ The Linux cp -v function showcases the progress of the duplication. At the same time the user can copy large files while monitoring the process. For instance, to replicate a file named 'largefile.zip' to the 'Downloads' directory while watching the progress, try the following command: cp -v largefile.zip Downloads/ The -i option requires the consent before overwriting an initial file. to protect against an accidental file rewriting. For instance, to duplicate a file named 'example.txt' to the 'Documents' directory, if a file with the identical name already exists, the cp command will require the consent before rewriting the original file. Initially, the Linux cp command copies a file or a directory to a default location. The system allows the user to specify any other location for the duplicate file or directory. For instance, to replicate a file named 'example.txt' from the 'Documents' directory to the 'Downloads' directory, try the following command: cp Documents/example.txt Downloads/ The cp -ra function in Linux is designed to carry out the copying process of directories with all their contents inside. The -r flag gives an order to repeat all the files and directories within an existing location, while the -a flag keeps the initial attributes preserved. Therefore, it is possible to make an exact duplicate of a directory without changing attributes. For instance, if you apply the command cp -ra /home/user1/documents /home/user2, it will replicate the 'documents' directory with all its entities inside in the 'user2' directory. The new folder will show the identical attributes as the initial item. The cp -rf feature in Linux is similar to the previous -ra option. The difference between these two functions is that the -f flag rewrites the given files or directories in the destination without requiring consent. Therefore, it is possible to update or replace an item with the identical name in the place of destination. For instance, if you apply the command cp -rf /home/user1/documents /home/user2, and there is already a 'documents' directory in the 'user2' directory, it will be overwritten with the contents of the 'documents' directory from the 'user1' directory. Be careful while utilizing the -rf function. Incorrect use of it leads to data loss. Check up twice the destination folder to avoid unwanted rewriting items. It is simpler to work with files and directories when you use Linux's cp -r capability with the -a and -f settings. Whereas the -rf particle modifies or replaces files and directories, the -ra particle precisely copies a directory and everything within it. You can learn how to handle stuff in this operating system by properly applying these differences. If you want to monitor and control the process of item duplication, which is not possible with other parameters of the cp command, use the -pv utility. To install the pv utility on Debian/Ubuntu you need to open the terminal and run the following command:  apt-get install pv After the installation is complete, verify it by running the following command in the terminal pv --version To install the pv utility on CentOS/Fedora, you need to connect the EPEL repository, which contains additional software packages unavailable in the default repositories. Run in the terminal: yum install epel-release Then run the following command in the terminal:  yum install pv  After the installation is complete, verify it by running the following command in the terminal:  pv --version To use this particle with the cp command, you should utilize | symbol. You can use the ~ symbol to indicate the root directory if the full path needs to be specified. For instance, to replicate a folder named 'Documents' from the root directory to a folder named 'Backup' in the home directory, try the following action: cp -r Documents/ ~/Backup/ | pv Example of executed Linux cp command Conclusion The cp command, although not an inherently difficult tool to learn, nevertheless provides basic knowledge of using the Linux operating system in terms of managing files and directories. In this tutorial, we tried to show the capabilities of the cp command in Linux from all sides, demonstrating best practices and useful tips of its various parameters. With new knowledge, you will be able to improve your skills in interacting with files and directories in Linux. The extreme accuracy of the copying process and additional options allow you to solve a wide range of problems. Multifunctionality helps users choose the file management mode and complete tasks efficiently. The command is a prime example of the many capabilities of this operating system, including the cp with progress feature in Linux. Altogether they unlock a potential of the system for novice and advanced users. Frequently Asked Questions (FAQ) How to copy files from one directory to another in Linux?  Use the cp command followed by the source path and then the destination path. Syntax: cp [source_file] [destination_directory] Example: cp /home/user/downloads/photo.jpg /home/user/pictures/ What are the most common cp command options? -r (Recursive): Essential for copying directories. It copies the folder and every file inside it. -i (Interactive): Prompts you for confirmation before overwriting an existing file. Highly recommended for beginners. -v (Verbose): Prints the name of each file as it is copied, so you can see the progress. -p (Preserve): Preserves the original file attributes like modification time, access time, and ownership modes. How do I copy a directory (folder)?  You must use the -r (recursive) flag. If you try to copy a folder without it, Linux will give you an error saying the source is a directory. Command: cp -r source_folder/ destination_folder/ How do I copy multiple files at once?  You can list multiple source files before the destination directory, or use wildcards. List: cp file1.txt file2.txt /backup/ Wildcard: cp *.jpg /home/user/images/ (Copies all JPG files). How do I prevent cp from overwriting existing files?  Use the -n (no clobber) flag. This tells Linux to silently skip any files that already exist in the destination folder, rather than replacing them. cp -n file.txt /backup/ What is the difference between cp -u and cp -n? -n never overwrites. -u (Update) only overwrites if the source file is newer than the destination file, or if the destination file is missing. This is useful for syncing folders.
22 January 2026 · 10 min to read
Linux

Using the ps aux Command in Linux

Effective system administration in Linux requires constant awareness of running processes. Whether diagnosing performance bottlenecks, identifying unauthorized tasks, or ensuring critical services remain operational, the ps aux command is an indispensable tool.  This guide provides a comprehensive exploration of ps aux, from foundational concepts to advanced filtering techniques, equipping you to extract actionable insights from process data. And if you’re looking for a reliable, high-performance, and budget-friendly solution for your workflows, Hostman has you covered with Linux VPS Hosting options, including Debian VPS, Ubuntu VPS, and VPS CentOS. Prerequisites To follow the tutorial: Deploy a Linux cloud server instance at Hostman SSH into the server instance Understanding Processes in Linux Before we explore the ps aux command, let's take a moment to understand what processes are in the context of a Linux system. What are Processes? A process represents an active program or service running on your Linux system. Each time you execute a command, launch an application, or initiate a background service, you create a process. Linux assigns a unique identifier, called a Process ID (PID), to each process. This PID allows the system to track and manage individual processes effectively. Why are Processes Grouped in Linux? Linux employs a hierarchical structure to organize processes. This structure resembles a family tree, where the initial process, init (or systemd), acts as the parent or ancestor. All other processes descend from this initial process, forming a parent-child relationship. This hierarchy facilitates efficient process management and resource allocation. The ps Command The ps (process status) command provides a static snapshot of active processes at the moment of execution. Unlike dynamic tools such as top or htop, which update in real-time, ps is ideal for scripting, logging, or analyzing processes at a specific point in time. The ps aux syntax merges three key options: a: Displays processes from all users, not just the current user. u: Formats output with user-oriented details like CPU and memory usage. x: Includes processes without an attached terminal, such as daemons and background services. This combination offers unparalleled visibility into system activity, making it a go-to tool for troubleshooting and analysis. Decoding the ps aux Output Executing ps aux generates a table with 11 columns, each providing critical insights into process behavior. Below is a detailed explanation of these columns: USER This column identifies the process owner. Entries range from standard users to system accounts like root, mysql, or www-data. Monitoring this field helps detect unauthorized processes or identify which users consume excessive resources. PID The Process ID (PID) is a unique numerical identifier assigned to each task. Administrators use PIDs to manage processes—for example, terminating a misbehaving application with kill [PID] or adjusting its priority using renice. %CPU and %MEM These columns display the percentage of CPU and RAM resources consumed by the process. Values above 50% in either column often indicate performance bottlenecks. For instance, a database process consuming 80% CPU might signal inefficient queries or insufficient hardware capacity. VSZ and RSS VSZ (Virtual Memory Size) denotes the total virtual memory allocated to the process, including memory swapped to disk. On the other hand, RSS (Resident Set Size) represents the physical memory actively used by the process. A process with a high VSZ but low RSS might reserve memory without actively utilizing it, which is common in applications that preallocate resources. TTY This field shows the terminal associated with the process. A ? indicates no terminal linkage, which is typical for background services like cron or systemd-managed tasks. STAT The STAT column reveals process states through a primary character + optional attributes: Primary States: R: Running or ready to execute. S: Sleeping, waiting for an event or signal. I: Idle kernel thread D: Uninterruptible sleep (usually tied to I/O operations). Z: Zombie—a terminated process awaiting removal by its parent. Key Attributes: s: Session leader N: Low priority <: High priority For example, a STAT value of Ss denotes a sleeping session leader, while l< indicates an idle kernel thread with high priority. START and TIME START indicates the time or date the process began. Useful for identifying long-running tasks. TIME represents the cumulative CPU time consumed since launch. A process running for days with minimal TIME is likely idle. COMMAND This column displays the command or application that initiated the process. It helps identify the purpose of a task—for example, /usr/bin/python3 for a Python script or /usr/sbin/nginx for an Nginx web server. Advanced Process Filtering Techniques While ps aux provides a wealth of data, its output can be overwhelming on busy systems. Below are methods to refine and analyze results effectively. Isolating Specific Processes To focus on a particular service—such as SSH—pipe the output to grep: ps aux | grep sshd Example output: root 579 0.0 0.5 15436 5512 ? Ss 2024 9:35 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups root 2090997 0.0 0.8 17456 8788 ? Ss 11:26 0:00 sshd: root@pts/0 root 2092718 0.0 0.1 4024 1960 pts/0 S+ 12:19 0:00 grep --color=auto sshd This filters lines containing sshd, revealing all SSH-related processes. To exclude the grep command itself from results, use a regular expression: ps aux | grep "[s]shd"  Example output: root 579 0.0 0.5 15436 5512 ? Ss 2024 9:35 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups root 2090997 0.0 0.8 17456 8788 ? Ss 11:26 0:00 sshd: root@pts/0 Sorting by Resource Consumption Identify CPU-intensive processes by sorting the output in descending order: ps aux --sort=-%cpu | head -n 10 Example output: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND mysql 1734280 0.4 36.4 1325172 357284 ? Ssl Jan30 87:39 /usr/sbin/mysqld redis 1424968 0.3 0.6 136648 6240 ? Ssl Jan18 112:25 /usr/bin/redis-server 127.0.0.1:6379 root 1 0.0 0.6 165832 6824 ? Ss 2024 5:51 /lib/systemd/systemd --system --deserialize 45 root 2 0.0 0.0 0 0 ? S 2024 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? I< 2024 0:00 [rcu_gp] root 4 0.0 0.0 0 0 ? I< 2024 0:00 [rcu_par_gp] root 5 0.0 0.0 0 0 ? I< 2024 0:00 [slub_flushwq] root 6 0.0 0.0 0 0 ? I< 2024 0:00 [netns] root 8 0.0 0.0 0 0 ? I< 2024 0:00 [kworker/0:0H-events_highpri] Similarly, you can sort by memory usage to detect potential leaks: ps aux --sort=-%mem | head -n 10 Example output: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND mysql 1734280 0.4 36.4 1325172 357284 ? Ssl Jan30 87:39 /usr/sbin/mysqld root 330 0.0 4.4 269016 43900 ? S<s 2024 22:43 /lib/systemd/systemd-journald root 368 0.0 2.7 289316 27100 ? SLsl 2024 8:19 /sbin/multipathd -d -s root 1548462 0.0 2.5 1914688 25488 ? Ssl Jan23 2:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 1317247 0.0 1.8 1801036 17760 ? Ssl Jan14 22:24 /usr/bin/containerd root 556 0.0 1.2 30104 11956 ? Ss 2024 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers root 635 0.0 1.1 107224 11092 ? Ssl 2024 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal root 2090997 0.0 0.8 17456 8788 ? Ss 11:26 0:00 sshd: root@pts/0 root 2091033 0.0 0.8 9936 8480 pts/0 Ss 11:26 0:00 bash --rcfile /dev/fd/63 Real-Time Monitoring Combine ps aux with the watch command to refresh output every 2 seconds: watch -n 2 "ps aux --sort=-%cpu" This provides a dynamic view of CPU usage trends. Zombie Process Detection Zombie processes, though largely harmless, clutter the process list. Locate them with: ps aux | grep 'Z' Persistent zombies often indicate issues with parent processes failing to clean up child tasks. Practical Use Cases Now, let’s explore some common use cases of the ps aux command in Linux: Diagnosing High CPU Usage Follow the below steps: Execute this command to list processes by CPU consumption. ps aux --sort=-%cpu Identify the culprit—for example, a malfunctioning script using 95% CPU. If unresponsive, terminate the process gracefully with: kill [PID] Or forcibly with: kill -9 [PID] Detecting Memory Leaks Simply do the following: Sort processes by memory usage: ps aux --sort=-%mem Investigate tasks with abnormally high %MEM values. Restart the offending service or escalate to developers for code optimization. Auditing User Activity List all processes owned by a specific user (e.g., Jenkins): ps aux | grep ^jenkins This helps enforce resource quotas or investigate suspicious activity. Best Practices for Process Management Let’s now take a quick look at some best practices to keep in mind when managing Linux processes: Graceful Termination: Prefer kill [PID] over kill -9 to allow processes to clean up resources. Log Snapshots: Periodically save process lists for audits: ps aux > /var/log/process_audit_$(date +%F).log Contextual Analysis: A high %CPU value might be normal for a video encoder but alarming for a text editor. Hence, it’s essential to consider the context when making an analysis. Common Pitfalls to Avoid Here are some pitfalls to look out for when using ps aux in Linux: Misinterpreting VSZ: High virtual memory usage doesn’t always indicate a problem—it includes swapped-out data. Overlooking Zombies: While mostly benign, recurring zombies warrant investigating parent processes. Terminating Critical Services: Always verify the COMMAND field before using kill to avoid disrupting essential services. Conclusion The ps aux command is a cornerstone of Linux system administration, offering deep insights into process behavior and resource utilization. You can diagnose performance issues, optimize resource allocation, and maintain system stability by mastering its output interpretation, filtering techniques, and real-world applications.  Did you know? Hostman prepared an Object Storage for your project to save all necessary info for your server. Start using now! For further exploration, consult the ps manual (man ps) or integrate process monitoring into automated scripts for proactive system management. Frequently Asked Questions (FAQ) What is the ps aux command in Linux?  It is the most common command to view a snapshot of all running processes on the system. The flags break down as follows: a: Shows processes for all users, not just the current user. u: Displays the process's user/owner and provides detailed resource usage (CPU, RAM). x: Shows processes not attached to a terminal (background daemons). Why do we use the ps command in Linux? We use it to monitor system health and troubleshoot performance. It helps you identify which applications are consuming the most CPU or Memory, find the Process ID (PID) needed to stop a frozen program, and verify if background services are running correctly. How do you use the ps aux command to find zombie processes? Zombie processes (defunct) appear with a Z in the STAT column. You can filter for them specifically by running: ps aux | grep 'Z' Alternatively, to get a cleaner list excluding the grep command itself: ps aux | awk '$8=="Z" {print $0}' How do I sort the output by Memory or CPU usage?  By default, ps aux does not sort by usage. You can use the --sort option: Sort by Memory: ps aux --sort=-%mem Sort by CPU: ps aux --sort=-%cpu (The minus sign sorts in descending order). What do the VSZ and RSS columns mean? VSZ (Virtual Memory Size): The total virtual memory available to the process (including swap and shared libraries). RSS (Resident Set Size): The actual physical RAM the process is currently using. RSS is usually the more important number for checking memory usage. How do I kill a process I found using ps aux?  First, locate the PID (Process ID) in the second column of the output. Then run: sudo kill [PID] If the process refuses to close, you can force kill it with sudo kill -9 [PID].
22 January 2026 · 10 min to read
Linux

How to Create a Text File in Linux Terminal

In Linux, you can access and edit text files using a text editor that is designed to work with plain text. These files are not specifically coded or formatted. Choose your server now! There are several different ways to create a file in Linux. The Linux Command Line or Terminal is most likely the fastest. This is a crucial skill for any user, but especially for server administrators, who need to create text files, scripts, or configuration files quickly for their jobs. Let's proceed to the guide on four standard techniques for creating a text file on the terminal. And if you’re looking for a reliable, high-performance, and budget-friendly solution for your workflows, Hostman has you covered with Linux VPS Hosting options, including Debian VPS, Ubuntu VPS, and VPS CentOS. File Creation in Linux Can be Frustrating Sometimes Prerequisites for File Creation in Linux Ensure these prerequisites are met before generating files in a Linux environment using the command-line interface: Access to a Functional Linux System: You must either have a Linux-based operating system installed on your computer or secure access to a Linux server via SSH (Secure Shell) protocol. Operational Terminal Interface: Confirm that your terminal application is accessible and fully operational. The terminal serves as your primary gateway to executing commands. Adequate User Permissions: Verify you can create files within the chosen directory. You may need to use sudo (for directories with access restrictions) to escalate privileges. Fundamental Commands Proficiency: You must get familiar with essential commands, such as touch for file creation, echo for printing text, cat for viewing file contents, and text editors like nano, vim, or vi for editing files directly. Text Editing Utilities: Ensure your system includes text editing tools: nano for command line simplicity, vim for advanced configurations, or graphical options like gedit for user-friendly navigation. Directory Management Expertise: Develop familiarity with directory navigation commands like cd for changing the working directory and ls for listing directory contents. This knowledge streamlines your workflow and avoids potential errors. Using the touch Command Generally, we use the touch command to create empty files and change timestamps. It will create an empty file if it doesn't exist already.  To create a text file in the current directory with the touch command: Open your terminal emulator. Type the command: touch filename.txt Start with "touch" command Replace "filename" with the name you picked for the file. If the file with the same name already exists, the access and modification timestamps will be updated without affecting the content of the file. If not, a blank file with the specified name will be generated. Press Enter—if it is successful, there will be no output. Use the ls command to list the directory content and verify file creation. "LS" command is also important of you want to generate text file in Linux Using the echo Command Redirection The echo command is widely used to display text on the terminal. But its capabilities go beyond that; it may also be used to write content to a file or create an empty file. For this, combine the echo command with double redirect symbols (you can also use a single >) and the desired filename. A text file can be created by redirecting the output of the echo command to a file. See how it works: Open your terminal emulator. Type the command: echo “Your text content here” > filename.txt "Echo" command is also important in the process Replace the text in double quotations (do not delete them) with yours to add it to the file.  After you press Enter, your text will be added to the file filename.txt. It will overwrite an existing file, if there is one. Otherwise, it will just create a new one. Press Enter. To verify that the file has been created and contains the desired content, use cat command to display the content.  "Cat" command can help you to display your file you just created Using the cat Command Redirection In Linux, the cat command is mostly used to concatenate and show file contents. It can, however, also be used to generate a text document by redirecting the standard output of cat to a file. Open your terminal emulator. Type the following command: cat > filename.txt This is what you'll see after "cat" command Replace filename.txt with the name for your text file. This command instructs cat to receive input rom the terminal and to redirect it into the filename.txt. Press Enter. The terminal will be waiting for input.  Enter the text you want in the file. Press Enter after each line. Press Ctrl + D when you are done. This signals the end of input to the cat and saves the content.  Run the cat command to check that the file has been created and contains the desired content. This is how you can check how your file in Linux is created Using printf for Advanced File Creation The printf utility is a powerful alternative to echo, offering enhanced formatting options for structuring text. It allows users to create files with precisely formatted content. Open the terminal. Use printf to define the text layout, incorporating formatting elements like newlines (\n) or tabs (\t). Redirect the output to a file using the > operator. Example: printf "First Line\nSecond Line\nIndented\tThird Line\n" >  formatted_file.txt Run the cat command to inspect the file's content and ensure the formatting matches expectations. Append Without Overwriting: To add content to an existing file without overwriting its current data, replace > with the append operator >>: printf "Additional content here.\n" >> formatted_file.txt Using a Text Editor You can also create new files in linux text editors. There is always at least one integrated command-line text editor in your Linux distribution. But you can choose and install a different one according to your preferences, for example, Vim, Nano, or Emacs. Each of them has its own features and advantages. Vim vim, which stands for "Vi IMproved," is a very flexible and adaptable text editor. It is well-known for its modal editing, which allows for distinct modes for various functions like text entry, navigation, and editing. It allows split windows, multiple buffers, syntax highlighting, and a large selection of plugins for extra features. To create a text file using vim, follow the steps below: Open vim, with the desired filename as an argument. "Vim" command is one of the key steps in file creation Press i to switch to Insert mode. Start typing and editing the filename.txt.  To save and exit, press Esc to ensure that command mode is running. Type: wq (write and quit) and press Enter. Simple command to finish your work Nano nano is ideal for short adjustments and straightforward text files because it is lightweight and requires little setup. It provides support for basic text manipulation functions, search and replace, and syntax highlighting. To create a text file using nano, follow the steps below:  Run nano with the desired filename as an argument. It will open a new buffer for editing the file filename.txt. Nano is useful in you want to fix something in your text file Start typing and editing the filename.txt.  To save and exit, press Ctrl + O to write the file, confirm the filename, and then press Ctrl + X to exit Nano. Click "yes" to exit Emacs emacs is a powerful and flexible text editor that supports syntax highlighting, multiple buffers, split windows, and integration with external tools and programming languages. To create a text file using emacs, follow the steps below:  Open emacs, with the desired filename as an argument. Start typing and editing the filename.txt.  "Emacs" is more flexible text editor To save and exit, press Ctrl + X, followed by Ctrl + S to save the file, and then Ctrl + X, followed by Ctrl + C to exit Emacs. Note: If a message states that "VIM command not found", "nano command not found" or "emacs command not found" in Linux, it typically means that the vim, nano or emacs text editor is not installed on the system, or it's not included in the PATH environment variable, which is a list of directories where the operating system looks for executable files. Don't forget to install necessary command in Linux To resolve this, install the text editor first using the command:  apt-get install vim apt-get install nano  apt-get install emacs Gedit An intuitive text editor that supports working with plain text and has syntax highlighting for programming languages. A straightforward graphical interface makes it usable for various tasks, from quick edits to complex document preparation. Open the Gedit Application: Launch Gedit either through the applications menu or by executing the following command in the terminal: gedit example.txt Gedit will create a new file if the specified one does not exist. Input Your Text: Type or paste your desired content into the editor. Save the File: Save your work with Ctrl + S or select File > Save. If creating a new file, specify a filename and a location. Verify: Return to the terminal and confirm the file exists with the ls command or review its content with cat. Linux File Creation Recommendations Ensure you have sufficient permissions to create files in the target directory. If they are insufficient, consider working in a directory where you have full rights (or elevate privileges with sudo). Check if a file with the identical name is already present before using the > operator, as the command will overwrite existing content. To prevent data loss, opt for the append operator >>. Familiarize yourself with the printf, echo, and text editors like vim or nano. These tools will help you reduce errors when working with files in Linux, as well as boost productivity. Use printf for creating files requiring structured content, such as configuration files or scripts with precise formatting needs. Choose your server now! Conclusion Now you have acquainted yourself with the fundamental skill of creating a file in Linux using the terminal! Using the Linux command line, several fast and efficient methods exist to create and manage text files. Apply several techniques to meet a different requirement using the touch, echo, cat, printf commands, or text editors like vim, nano, gedit, or emacs. Users can select the method that sufficiently meets their requirements, such as creating empty files, appending text, or significantly modifying material. In summary, any of these methods enable Linux users to easily and quickly handle text files straight from the command line. Frequently Asked Questions (FAQ) How do I create an empty text file in Linux?  The standard command is touch. Simply run: touch filename.txt This creates a blank file immediately. How do I create a file and add content at the same time?  You can use the echo command with the redirection operator (>). echo "Hello World" > filename.txt This creates the file and puts "Hello World" inside it. How do I create and open a file for editing?  Use a terminal text editor like nano or vi. When you run: nano filename.txt Linux will open a blank editor screen. Once you type your text and save (Ctrl+O in nano), the file is created on your disk. What is the fastest way to create a file?  The redirection symbol alone is the quickest method for creating an empty file:> filename.txt This tells the shell to redirect "nothing" into a new file, creating it instantly. How do I create a large file for testing?  Use the fallocate command. For example, to create a 1GB file instantly:fallocate -l 1G bigfile.img How do I view the content of a text file?  Use the cat command to print the text to your terminal: cat filename.txtFor longer files, use less filename.txt to scroll through pages.
21 January 2026 · 10 min to read

Do you have questions,
comments, or concerns?

Our professionals are available to assist you at any moment,
whether you need help or are just unsure of where to start.
Email us
Hostman's Support