Regular Expressions (regex) in Linux

Regular Expressions (regex) are one of the most powerful tools for Linux sysadmins when searching logs, parsing configs, or cleaning up files. I found some practical real-life examples you’ll may use on your day-to-day SysAdmin routine.

First, I needed to brew a great cup of Catimor coffee variety for more inspiration. Below are some brief examples. grep is one of my favorite commands and T-Shirt!

Create Simple Regular Expressions

Regex are patterns used to match text. For example to find all lines in /var/log/auth.log containing the word failed you can run this command:

grep "Failed" /var/log/auth.log

Match “error” or “ERROR” (case-insensitive):

grep -i "error" /var/log/syslog

Match numbers in a text:

grep "[0-9]" users.txt

Basic vs Extended Regular Expressions in Linux

BRE (Basic Regex): default in grep

ERE (Extended Regex): use with egrep or grep -E

Example (basic regex) – \| needed for OR:

grep "error\|warning" /var/log/syslog

Example (extended regex):

grep -E "error|warning" /var/log/syslog

Special Characters, Character Classes, Quantifiers, Anchors

Special characters:

• . → matches any character
• * → zero or more
• + → one or more (ERE only)
• ? → zero or one (ERE only)

For example, matches “fail” followed by anything, then “root”):

grep -E "fail.*root" /var/log/auth.log

Character classes:

• [0-9] → digits
• [A-Za-z] → letters
• [^abc] → not a, b, or c

Find lines starting with a digit:

grep "^[0-9]" file.txt

Find 3-digit numbers:

grep -E "[0-9]{3}" file.txt

Quantifiers:

• {n} → exactly n times
• {n,} → at least n times
• {n,m} → between n and m times

Find lines ending with .com

grep "\.com$" domains.txt

Anchors:

• ^ → start of line
• $ → end of line

Regex Tools for Searching Filesystem/File Content

Find files with regex in names:

find /etc -regex ".*\.conf"

Search recursively in files:

grep -R "PermitRootLogin" /etc/ssh/

Regex for Delete, Change, Substitute (with sed)

Delete lines containing “DEBUG”:

sed -i '/DEBUG/d' /var/log/app.log

Replace “http” with “https”:

sed -i 's/http:/https:/g' index.html

Change only at line start (^ anchor):

sed -i 's/^root/ROOT/' /etc/passwd

More Linux Real-Life Sysadmin Examples

Find failed SSH logins:

grep "Failed password" /var/log/auth.log

Extract IPs from logs:

grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" /var/log/auth.log

Remove commented lines in config:

sed -i '/^#/d' /etc/ssh/sshd_config

Check which users have UID ≥ 1000 (normal users):

awk -F: '$3 >= 1000 {print $1,$3}' /etc/passwd

Regular Expressions (regex) Summary:

• BRE vs ERE: basic needs escapes (\|), extended is simpler.
• Special chars: . * + ? for flexible matching.
• Classes: [0-9], [A-Za-z], [^x].
• Anchors: ^ start, $ end.
• Tools: grep, egrep, find -regex, sed, awk.

Contact me if you have any questions. Also, consider shopping for one my T-Shirt and coffee mugs designs. Thanks!