Linux Text Processing: Pipes and Redirection

Short files are easy to print. Long files are easier to read when the display waits for you. Neither cat nor the normal reading view in less edits the file.

Print or join text with cat

cat notes.txt sends the entire file to standard output, normally your terminal. The name comes from concatenate: with several file names, it prints their contents in the order you give them. It does not insert a heading between files.

Suppose a.txt contains the lines "a" and "b", and b.txt contains "c d". Run:

cat -n a.txt b.txt

You see three numbered lines. The numbers continue across the two files; -n numbers the output, not the stored files. To save the joined text, use cat a.txt b.txt > ab.txt. The new file contains the three original lines without numbering. Including -n would save the numbers too.

Printing a large file may push its beginning beyond the visible screen. A pager keeps you in control of the view. less /etc/services opens a long text file and shows a screenful. It can show the first screen before reading the entire file, which helps with large files.

Move through less

The shell prompt is hidden while less is running. The program is waiting for a navigation key:

Uppercase matters: g and G go to opposite ends. To finish reading, press q; waiting for a new shell prompt without quitting can make the pager seem stuck.

Search inside the view

Type /, enter a word, and press Enter to search forward. For example, /ssh finds the next matching text. Type ?ssh and Enter to search backward. Then n repeats the search in its current direction, while N goes in the opposite direction. After a backward search, n continues backward.

The search is a regular expression. /^# finds a line beginning with "#" because ^ marks the start of a line. You can learn the pattern rules separately while using simple words now.

less -N notes.txt adds line numbers to the display. For wide records, less -S notes.txt keeps a long line on one display row by cutting off the visible right end; Left and Right arrows move sideways. The text remains in the file. Without -S, long lines wrap onto extra screen rows. more is an older pager with fewer navigation choices.

Page output from another command

ls -l /usr/bin | less lets you browse the long listing. The pipe delivers the listing to the pager. For an existing file, less notes.txt opens it directly; cat notes.txt | less introduces an extra command for the same view.

Use these commands on text. Printing a binary program such as /bin/ls can show control characters and garble the terminal. If that happens, type reset and press Enter to restore the display.

When you need only a file's opening or latest entries, printing everything hides the useful part. head selects the beginning, and tail selects the end. Both print 10 lines by default.

Choose a number of lines

If numbers.txt contains 1 through 100, one number per line, head numbers.txt prints 1 through 10, while tail numbers.txt prints 91 through 100. Use -n to change the count:

head -n 3 numbers.txt
tail -n 3 numbers.txt

The first command prints 1, 2, 3. The second prints 98, 99, 100. If a file has fewer than the requested lines, the command prints what is available.

head -c 5 selects five bytes instead of five lines. For text beginning with "banana", it prints "banan". Bytes are storage units; with UTF-8 text, a character may use more than one byte, so a byte count is not always a character count.

Read a starting position correctly

A plus sign changes the meaning of tail -n. Compare:

tail -n +2 scores.csv drops the first line, useful when that line holds column headings. It does not pick only the second line. On the numbered file, tail -n +98 numbers.txt prints 98 through 100.

GNU head also accepts a negative count: head -n -97 numbers.txt omits the last 97 lines, leaving 1 through 3. The sign belongs to the count and is part of the instruction.

Select a middle range

To display lines 11 through 20, first keep everything through line 20. Then keep the last 10 lines of that selection:

head -n 20 numbers.txt | tail -n 10

After head, the data is 1 through 20. The last ten lines are 11 through 20. An inclusive range contains the end number minus the start number plus one lines; that final one accounts for including both ends. Using tail -n 11 would also include line 10.

Both commands can read a pipe when no input file is named. ls /etc | head -n 5 limits a listing to its first five names. With ls -lt | head -n 4, remember that the first output line is the "total" line: only three entries follow it.

Watch a file grow

tail -f /var/log/app.log first displays the final lines, then waits and prints text appended to the file. Use it while a program writes new entries. Press Ctrl+C to stop following and return to the shell. The waiting view is intentional; it is different from the completed one-time output of plain tail.

tail -F also retries and follows the file name when a log is removed and created again during rotation. With several input files, head and tail label each file's output with a header such as "==> fruit.txt <==". Add -q when you need the selected text without those headers.

A command communicates through standard streams. Thinking of input and output as separate routes explains how the same program can read a keyboard, read a file, or receive another command's output.

Identify the three streams

A file descriptor is the number used to identify an open stream. A normal shell command inherits these three:

Although stdout and stderr normally share the screen, they are separate connections. A program can report a result on stdout and explain a problem on stderr during the same run.

For example, ls /etc/hostname /nonexistent > out.txt lists one existing path and encounters one missing path. The listing goes to out.txt. The "No such file or directory" message remains on the terminal because > redirects stdout, not stderr. Seeing an error on the screen does not mean output redirection failed.

Give a command input from a file

Commands such as cat, sort, wc, grep, head, and tail can read stdin when no input file is named. Run sort alone, type a few lines, and press Ctrl+D at the beginning of an empty line. That signals the end of input, letting sort print the sorted lines. Ctrl+C stops the command instead of completing the input.

The input operator < connects a file to stdin:

wc -l < fruit.txt

If fruit.txt has six newline-terminated lines, the output is "6". Compare wc -l fruit.txt, which prints "6 fruit.txt". In the redirected form the shell opens the file, and wc receives a stream without the original file name. In the argument form, wc opens the named file itself.

The shell prepares redirections before it starts the program. sort < fruit.txt and < fruit.txt sort therefore connect the same file to the same input stream. The usual placement after the command is easier to read.

Supply a few lines directly

A here document places input below the command. The word after << marks where that input ends:

cat <<EOF > greeting.txt
Hello
See you soon
EOF

cat receives the two greeting lines on stdin and writes them to the output file. The last line contains only EOF; it is a delimiter, not part of the saved text. Another delimiter word can be used if the closing line matches it exactly.

In Bash, a here string supplies one string plus a newline. wc -w <<< "a b c" reports three words. These two forms supply input directly without first creating an input file.

Read the arrow before running the command

sort < fruit.txt reads the file. sort > fruit.txt opens it as an output destination, empties existing contents, and waits for input from the keyboard. The shell performs that destructive opening before sort runs. Keep input files separate from output destinations unless the command has a documented way to update its input safely.

Redirection changes a stream's destination. It is a shell operation, so the same operators work with many different programs. Start by deciding which stream to send and whether an existing file should be replaced or extended.

Save normal results or append them

echo one > log.txt creates the file or empties it before writing the line "one". A later echo two >> log.txt appends "two", leaving two lines. >> also creates a missing file.

ls /etc/hostname /nonexistent > out.txt 2> err.txt separates the successful listing from the missing-path error. The descriptor must touch the operator. ls 2> err.txt redirects errors; ls 2 > err.txt asks ls to list a file named "2" and redirects its normal output.

Combine streams in the correct order

2>&1 points stderr at stdout's current destination. Read redirections from left to right:

ls /etc/hostname /nonexistent > all.txt 2>&1

First, stdout moves to all.txt. Then stderr copies that connection. Both streams now reach the file. Bash's &> all.txt is a shorter form, and &>> all.txt appends both streams.

Reversing the order changes the result:

ls /etc/hostname /nonexistent 2>&1 > out.txt

First, stderr points where stdout currently points: the terminal. Then stdout moves to the file. Stderr keeps the earlier connection, so the error remains visible. 2>&1 makes a connection at that moment; it does not make stderr follow every later change to stdout.

Discard a stream deliberately

/dev/null discards data written to it. find / -name passwd 2>/dev/null leaves matching paths on stdout while hiding diagnostics such as "Permission denied". Those messages may identify unsearched folders, so discarding them also removes information about gaps in the search.

Protect an input file

Do not write sort fruit.txt > fruit.txt. The shell empties the destination before sort reads it. Use a different output path, check the result, and then rename it. For sort specifically, sort -o fruit.txt fruit.txt uses its supported output-file option to update that file safely.

Bash can also reject accidental overwriting:

set -o noclobber

With this setting, ordinary > fails for an existing regular file. >> still appends. Use >| for an intentional overwrite, or set +o noclobber to turn the setting off. The protection is useful when saving repeated reports, but it does not change a command's own file-writing options.

A pipe, written |, joins the normal output of one command to the input of the next. You can connect several small jobs without saving a temporary file between them.

Follow the flow of text

In ls /etc | wc -l, ls writes names and wc -l counts the newline characters it receives. A command that reads stdin, selects or changes text, and writes stdout is called a filter. sort, uniq, wc, cut, grep, head, and tail can all serve as filters.

The general shape is command1 | command2 | command3. Each stage receives the previous stage's output, which may have a different form from the original file. A later stage cannot recover lines or columns that an earlier stage removed.

Build a count in stages

Suppose fruit.txt contains six lines: "banana", "apple", "cherry", "apple", "banana", "apple". To count the different names, first run:

sort fruit.txt

The output has three "apple" lines, two "banana" lines, and one "cherry" line. Equal names are now next to one another. Add a stage:

sort fruit.txt | uniq

uniq removes adjacent repeats, leaving "apple", "banana", and "cherry". Finally, sort fruit.txt | uniq | wc -l reports 3. Counting the original file directly would report six lines, which answers a different question.

Run each growing pipeline and inspect its result before adding the next command. For very long output, temporarily add | head to see the first ten lines. This makes it easier to spot a header that was not removed or a field that was selected incorrectly.

Keep errors separate

An ordinary pipe carries stdout, not stderr. With one existing path and one missing path, ls /etc/hostname /nonexistent | wc -l counts the one normal listing line. The error still appears on the terminal.

To include diagnostics in the data, use ls /etc/hostname /nonexistent 2>&1 | wc -l, which counts two lines in this example. Bash's |& combines stdout and stderr into the pipe as well. Whether including errors is useful depends on what you want the final count to mean.

The stages run concurrently. tail -f /var/log/app.log | grep ERROR displays newly appended matching lines on the terminal. This is a live view, not a process that waits for the file to finish. Programs can buffer output, however; immediate display is not a general promise for every possible pipeline.

Save a copy along the route

tee writes its input both to a file and to stdout:

sort fruit.txt | uniq | tee unique.txt | wc -l

The terminal shows 3, while unique.txt stores the three names. tee -a appends instead of replacing the saved file. Placing tee earlier would save an earlier form of the data.

A pipe connects to a command, while > names a file. ls > less creates a file named "less"; it does not start the pager. The receiving command must also read stdin: piping text into echo or ls does not turn that text into their arguments.

Counting and ordering are separate jobs. Before using a count, decide whether you need records, words, bytes, or distinct values. Before removing duplicates, decide whether equal lines are already next to one another.

Count the right thing with wc

Plain wc file reports lines, words, and bytes, in that order, then the file name. The six-line fruit list containing "banana", "apple", "cherry", "apple", "banana", "apple" gives "6 6 39 fruit.txt". Each line contributes its letters plus a newline byte.

A final piece of text without a newline is not counted by wc -l. Text containing "one", a newline, and then "two" therefore has a count of 1. In UTF-8, "café" followed by a newline uses six bytes but five characters because "é" uses two bytes. With several input files, wc prints their counts and an additional total.

Choose text or numeric sorting

sort writes ordered lines without changing the input file. Its default order follows the current language setting. sort -f compares without distinguishing uppercase from lowercase.

Text sorting compares characters: "100", "25", "9" appear in that order because their first digits are "1", "2", "9". sort -n compares numeric values, giving 9, 25, 100. Add -r for reverse order, as in sort -rn. sort -h understands size suffixes such as "2K", "300M", and "1G".

Sort on a field

For comma-separated records, -t, sets the separator. -k3,3nr selects only field 3, compares numerically, and reverses the order:

tail -n +2 scores.csv | sort -t, -k3,3nr | head -n 3

Given "name,city,score" followed by "Ana,Lisbon,82", "Ben,Oslo,75", "Chen,Lisbon,91", "Dara,Oslo,68", and "Eli,Lisbon,88", the result is Chen, Eli, then Ana with their complete records. The first stage drops the header. Otherwise its nonnumeric score key counts as zero during numeric sorting.

Without -t, blanks separate fields. -k2 extends the key from field 2 through the line's end; -k2,2 limits it to field 2.

Group duplicates before counting them

uniq compares each line with the adjacent run. On the unsorted fruit list, it leaves all six lines because no equal names are adjacent. sort fruit.txt | uniq prints the three different names; sort -u fruit.txt can also produce a distinct sorted list.

After sorting, uniq -c reports each run's count: "3 apple", "2 banana", "1 cherry", with spaces padding the counts. uniq -d prints one copy of each repeated value, and uniq -u prints only values that occur once. uniq -i ignores case in its comparisons.

For the most frequent values first, use sort fruit.txt | uniq -c | sort -rn. The initial sort groups identical lines; the final sort ranks their counts. Omitting the first sort counts scattered runs separately.

A record often holds more information than a question needs. cut selects fields or fixed positions from each line and writes the selection to stdout. It does not rearrange or edit the original file.

Select fields by their separator

A delimiter separates fields. In /etc/passwd, colons separate the user name, password placeholder, user ID, group ID, full name, home folder, and login shell. For this example record:

alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

cut -d: -f1,6 prints "alice:/home/alice". Field numbers begin at 1, and the delimiter remains between selected fields. cut -d: -f5 prints "Alice Smith"; the internal space is part of that field because the delimiter is a colon.

The list selects fields, not a new order. cut -d, -f3,1 still prints field 1 followed by field 3. By default the separator is a tab, so cut -f2 file selects the second tab-separated field.

A line with no delimiter is printed whole. For example, cut -f2 prints "no tabs here" unchanged because it has no tab. Add -s to suppress lines with no delimiter. A line containing delimiters but lacking a requested field is a different case; -s is not a general test for complete records.

Select fixed positions

cut -c1-5 selects positions 1 through 5. On the account record above, it prints "alice". Position selection suits fixed-width text, where the desired columns start at the same places on every line. Field selection suits records whose field lengths vary but whose separators stay consistent.

Check how separators behave

With cut -d' ' -f2, every single space is a separator. The text "a b" has an empty second field between its two spaces, so the result is an empty line. If repeated spaces are just padding between columns, tr -s ' ' | cut -d' ' -f2 first squeezes each run of spaces to one.

cut also treats commas inside quoted values as separators. A quoted CSV value such as "Smith, Ann" is not kept together automatically. Use simple delimiter-separated examples only when the field boundaries really match the delimiter rule.

Count values from a selected column

To count cities in scores.csv, start with cut -d, -f2 scores.csv. With the records for Ana, Ben, Chen, Dara, and Eli, this prints "city", "Lisbon", "Oslo", "Lisbon", "Oslo", "Lisbon". Then:

cut -d, -f2 scores.csv | tail -n +2 | sort | uniq -c | sort -rn

Dropping the first line removes "city". Sorting groups the three Lisbon entries and the two Oslo entries; uniq -c counts them, and the last sort places "3 Lisbon" before "2 Oslo". Forgetting the header stage creates an extra value, "1 city", because a heading is still text to these commands.

grep searches text and normally prints every line containing a match. A useful search starts by choosing both the pattern and the kind of result you need: lines, counts, line numbers, or file names.

Start with a quoted pattern

The usual form is grep 'pattern' file. With no file argument, grep reads stdin. Searches are case-sensitive unless you add -i.

Suppose server.log has five entries: an INFO startup line, an ERROR disk-full line, a WARN retry line, a lowercase "error timeout" line, and an INFO backup line. grep 'ERROR' server.log prints only the uppercase ERROR line. grep -i 'error' server.log prints both error lines.

Quote patterns even when they look simple. grep 'disk full' server.log searches for the two words together. Without quotes, grep disk full server.log uses "disk" as the pattern and treats "full" as another file name. Quotes also keep the shell from expanding stars and other special characters before grep receives them.

Choose the output you need

Options combine: grep -ic 'error' server.log reports 2, while grep -n 'WARN' server.log identifies line 3. -c counts matching lines, not the number of occurrences inside them. A line containing "error error" contributes one to the count.

Consider the lines "error", "terror", "errors", and "Error found". Plain grep 'error' matches the first three. grep -w 'error' matches only the first because "error" is not a whole word in "terror" or "errors". Adding -i also matches "Error found". -x asks for an entire matching line, so "Error found" still fails a whole-line search for "error".

Search across files

When several files are searched, grep normally prefixes matches with file names. grep -r 'TODO' notes searches files throughout the folder tree. Add -l to print only names of files with matches: grep -rl 'TODO' notes. Uppercase -L lists files without a match. These are file-selection results, not counts of matching lines.

Decide whether the pattern is literal

By default, grep interprets a regular expression. A dot matches any single character, so '10.0.0.7' can also match "10a0b0c7". grep -F '10.0.0.7' file searches for the exact text. Escaping each dot, as in '10\.0\.0\.7', also makes the dots literal.

grep -q suppresses normal output and reports through its exit status: 0 for a match, 1 for no match, and normally 2 for an error in GNU grep. A missing input file is an error, not evidence that the pattern was absent.

In a pipeline, grep -i 'error' server.log | wc -l counts matching lines just as grep -ic does. The first form leaves room for other filters between selecting lines and counting them.

A regular expression, or regex, describes text that can match. grep normally looks for a matching part anywhere in a line, then prints the whole line. Most letters match themselves; special characters describe positions, choices, or repetition.

Match a character or a position

The dot . matches one character within a line. With the lines "cat", "cart", "coat", "cut", "act", "scat", and "color", the pattern 'c.t' matches "cat", "cut", and "scat". The last contains "cat" as a matching part. "coat" has two characters between "c" and "t", so one dot cannot cover them.

Use anchors to constrain positions. ^ marks the start of a line and $ the end:

grep '^c.t$' words.txt prints only "cat" and "cut". Anchoring both ends rules out a longer line such as "scat".

Choose one character from a set

A bracket expression matches one character. [ao] means either "a" or "o", so 'c[ao]t' matches the "cat" portion of "cat" and "scat". [0-9] describes a digit. A caret immediately after the opening bracket negates the set: 'c[^a]t' matches "cut" but not "cat". This caret excludes a character; it does not mark a line's beginning there.

Named classes describe categories in the current language setting. [[:digit:]] selects a digit, [[:alpha:]] a letter, [[:alnum:]] a letter or digit, and [[:upper:]] or [[:lower:]] a letter of the stated case. [[:space:]] includes spaces, tabs, and other whitespace characters. Keep both pairs of square brackets: the class name sits inside the outer set expression.

Repeat the preceding item

* means zero or more occurrences of the item immediately before it. 'ca*t' can match "ct", "cat", or "caat". It also matches "act" because that line contains "ct", using zero occurrences of "a". To match any run of characters, combine dot and star as .*.

'^c.*t$' matches "cat", "cart", "coat", and "cut" in the word list. A filename wildcard and a regex use different star rules: the shell pattern *.txt describes names ending in ".txt", but the regex for that ending is '\.txt$'.

Make a special character literal

A backslash can remove a special meaning. \. matches a real dot, \* a star, and \[ an opening square bracket. [.] also selects a literal dot. grep '\.conf$' file selects lines ending in ".conf".

A configuration search can remove simple comments and empty lines with grep -v '^#' app.conf | grep -v '^$'. The first test recognizes comments only when "#" is the first character. Default basic syntax treats unescaped ?, +, braces, |, and parentheses as ordinary characters. GNU grep supports backslashed operator forms; grep -E provides extended syntax without those backslashes.

Extended regular expressions add useful ways to express optional parts, repeated groups, and alternatives. Use grep -E so the pattern is read in this syntax. The dot, anchors, sets, and star keep their earlier meanings.

Count repetitions

An operator follows the item it modifies. That item can be one character, a bracket expression, or a group:

'logs?' matches "log" and "logs": only the "s" is optional. 'ca+t' requires at least one "a", so it matches "cat" and the matching part in "scat", but not "ct" inside "act". Omitting -E changes an unescaped question mark or plus sign into literal text in basic syntax.

For an entire code of two uppercase letters and four digits, use:

grep -E '^[A-Z]{2}[0-9]{4}$' codes.txt

"AB1234" and "QZ0042" match. "A12345" has only one leading letter, "ab1234" uses lowercase, and "XY98765" has an extra digit. The two anchors prevent a valid-looking section inside a longer code from qualifying. Adding -i would also allow the lowercase code.

Group alternatives

| means an alternative inside an extended pattern. 'cat|cut' searches for either word anywhere in a line. Parentheses set the boundaries of a group: 'c(a|o)t' chooses "a" or "o" between "c" and "t". A following quantifier applies to the whole group, so '(ab)+' matches one or more copies of "ab".

Keep the pattern quoted. In grep -E cat|cut words.txt, the shell interprets the unquoted vertical bar as a pipe between commands. In grep -E 'cat|cut' words.txt, it delivers that character to grep as part of one pattern.

Print matches instead of complete lines

-o prints only matching parts, one per output line. The command below extracts a dotted-number shape from a longer line:

grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' server.log

The parenthesized part is one to three digits followed by a literal dot; {3} repeats it three times. The final part adds one to three digits. It extracts "10.0.0.7" from a line that contains it, but also accepts "999.999.999.999". Matching a shape does not check whether each number is within an address's valid range.

Remove blank and comment lines together

grep -Ev '^[[:space:]]*(#|$)' app.conf selects active settings. Read the pattern in order: start at the beginning, allow whitespace, then match either "#" or the end of the line. It therefore recognizes indented comments and whitespace-only lines as well as empty lines. -v keeps the lines that do not fit that description, such as "port=8080". The older command name egrep is obsolescent in GNU grep; use grep -E.

find walks a directory tree and tests the items it reaches. Choose the starting folder first: find project prints project itself and the entries below it. Adding tests narrows the selection.

Match names, paths, and types

find project -name '*.txt' selects names ending in ".txt" anywhere below the starting folder. Quote the wildcard so the shell passes it unchanged. -name is case-sensitive, so "Guide.TXT" needs -iname '*.txt' for a case-insensitive match.

The pattern must match the whole item's name, without its parent folders. -name 'guide' does not match "guide.txt"; -name 'guide*' does. Use -path '*/src/*' when the folder portion matters. find prints traversal order, so add | sort when you want ordered paths.

-type f selects regular files, -type d directories, and -type l symbolic links. find project -type f -name '*.txt' requires both the type and name tests to pass. A directory named "notes.txt" fails the type test even though its name fits.

Understand size comparisons

-size compares a size after rounding it up to the selected unit. c means bytes, k means 1,024-byte kibibytes, M means 1,048,576-byte mebibytes, and G means gibibytes. A leading plus means greater than, a minus means less than, and no sign means equal to the specified number of units.

For -size +100M, the rounded size must exceed 100 MiB units. A file one byte larger than 100 MiB rounds to 101 units and qualifies. A nonempty file smaller than 1 MiB rounds to one unit, so -size -1M finds only empty files. Use a byte test for an exact byte threshold, or a smaller unit for a useful small-file range.

Test age and limit depth

-mtime uses completed 24-hour periods since modification. -mtime -7 selects items modified less than seven days ago. -mtime +30 selects ages with more than 30 completed periods: at least 31 days. -mmin -30 uses minutes for recent changes. -user alice selects an owner, and -empty selects empty files or directories.

To examine the starting folder and its immediate entries without entering subfolders, use find project -maxdepth 1 -type f. Put -maxdepth before the tests.

Combine tests and preserve patterns

Tests written side by side mean AND. -o means OR, as in find project -name '*.txt' -o -name '*.md'. ! -name '*.c' negates a name test. For simple selection, keep the relationship between tests clear before adding actions.

An unquoted wildcard is expanded by the shell in your current folder. If only notes.txt matches there, find . -name *.txt becomes a search for that one name, missing other text files. With several local matches, the command may fail because extra names appear inside the test expression.

A search of protected folders may report "Permission denied". 2>/dev/null hides those errors but cannot make unreadable folders searchable. find checks the tree while running; a live file system can still change before a later command uses the returned paths.

After selecting files, you can give their paths to another command. Keeping the selection and the action in the same find expression avoids treating spaces inside file names as separators between names.

Run a command on each match

The action -exec command {} \; runs the command once per matched item. find replaces {} with that item's path. For example:

find project -name 'main.c' -exec wc -l {} \;

If the match is project/src/main.c, this runs wc -l project/src/main.c. The escaped semicolon ends the action. The backslash keeps the shell from using the semicolon to end the entire shell command first.

Use {} + to pass batches of paths to fewer command invocations:

find notes -type f -name '*.txt' -exec grep -l 'TODO' {} +

grep receives the selected file paths as arguments and lists the ones containing "TODO". Both forms preserve a path such as "notes/team plan.txt" as one argument. The + form reduces startup work when many files match.

Combine file selection with text selection

find tests file properties; grep examines contents. Add -mtime -7 before the action to search only recently modified text files:

find notes -type f -name '*.txt' -mtime -7 -exec grep -l 'TODO' {} +

First the name, type, and age tests select files. Then grep searches their text. grep -r alone can search a tree's contents, but it does not replace those file-property tests.

Apply deletion only after checking the selection

-delete removes matches without confirmation or undo. First run the selection with no deleting action and read the paths. Only then add -delete at the end, as in find /tmp/build -type f -name '*.tmp' -delete. For a per-item confirmation prompt, -ok rm {} \; asks before running the removal command.

Actions run as the expression is evaluated. Putting -delete before -name '*.tmp' lets deletion happen before that name test can restrict it. A later test cannot protect an item from an action already taken.

Choose a faster lookup when it fits

locate guide.txt searches an index of stored paths containing "guide.txt". It can respond quickly without walking the disk. Because the database is refreshed periodically, a new file may be missing or a deleted path may remain. updatedb rebuilds the index; a system-wide update commonly needs administrator rights. Some distributions require an optional package such as plocate.

which grep looks through the folders in PATH for an executable program file, often reporting /usr/bin/grep. It does not describe every way Bash resolves a command. type echo, for example, can identify a built-in even when an external program named "echo" also exists. Use type commandname for Bash's interpretation, find for a current tree search, and locate for a quick indexed name lookup.

nano notes.txt opens text in a terminal editor. You can move with arrow keys and type directly into the text. If the file does not exist, nano starts an empty buffer, the working text held in memory; saving creates the file on disk.

Read the shortcut labels

The bottom lines show key combinations. ^ means Ctrl, so ^X means Ctrl+X. M- means Meta, usually Alt, so M-U means Alt+U. Ctrl+G opens help. These labels describe keys to press together, not characters to type into the file.

Make and save a small change

To change "port=8080" to "port=9090" in app.conf:

1. Run nano app.conf.
2. Press Ctrl+W, enter "8080", and press Enter.
3. At the match, delete the four digits and type "9090".
4. Press Ctrl+O, then Enter to confirm the file name and save.
5. Press Ctrl+X to leave.

Back at the shell, grep 'port' app.conf should show "port=9090". This checks the saved file, not just what was visible in the editor.

Ctrl+O is Write Out, not an open-file command. Ctrl+R reads another file's contents into the current buffer at the cursor. Confusing those actions can insert unwanted text into the file you are editing.

Search, replace, and move

Ctrl+W searches for text. Alt+G goes to a requested line number, useful when an error message identifies a particular line. Ctrl+C shows the current line and column.

Alt+R, also available as Ctrl+, starts replacement. Enter the text to find and then its replacement. For each match, answer Y to replace or N to skip; A replaces all. Choosing individual replacements helps when the same digits appear in several settings and only one should change.

Move text and undo changes

Repeated Ctrl+K presses collect consecutive lines. With a marked selection, Ctrl+K cuts the marked text instead of the whole line. Ctrl+U then inserts that text where the cursor is placed. Undo is useful immediately after an accidental cut or replacement.

Leave deliberately

Ctrl+X exits. If the buffer has unsaved changes, nano asks whether to save it. Y saves, followed by Enter to confirm the name; N leaves without saving those changes; Ctrl+C cancels the exit and returns to editing. Answering N is a decision to discard work, not a way to continue editing.

nano -l app.conf shows line numbers, and nano +12 app.conf starts at line 12. If saving fails because you lack permission, the edited buffer has not been saved to that path. System files require appropriate rights, for example sudo nano /etc/hosts when an authorized system change needs administrator access. For practice, use a file in your own folder.

vi notes.txt opens a terminal editor in normal mode. A key such as x is a command there. To type text, first enter insert mode. On many Linux systems, vi starts Vim or another vi-compatible editor.

Keep track of the mode

Vim shows "-- INSERT --" while inserting. Esc returns to normal mode. From normal mode, i inserts before the cursor and a after it. I starts before the line's first nonblank character, preserving indentation; A appends at the end. o opens a line below and O a line above.

Move without typing text

In normal mode, h, j, k, and l move left, down, up, and right. Arrow keys also work. w moves to the next word, 0 to the line's beginning, and $ to its end. G jumps to the last line. 1G jumps to the first; Vim also offers gg. A number before G selects a line, so 12G jumps to line 12. :12 and Enter does the same job. Counts also repeat movements: 5j moves down five lines.

Edit from normal mode

x deletes the character under the cursor. dd cuts a line; 3dd cuts three lines. yy copies a line. For whole-line text, p pastes below the current line and P above it. For character text, p pastes after the cursor and P before it.

cw replaces the rest of the current word and enters insert mode. r followed by a character replaces just one character. u undoes a change; Vim's Ctrl+R redoes it. A dot . repeats the last change.

Find and change a setting

To replace "8080" with "9090" in app.conf, run vi app.conf, then type /8080 and Enter. At the first "8", type cw, type "9090", and press Esc. Type :wq and Enter to save and leave.

Search backward with ?text and Enter. n repeats the current search direction and N reverses it. Searches accept regular expressions. To replace every occurrence throughout a file, :%s/8080/9090/g uses % for all lines and g for all occurrences on each line. :set number shows line numbers while editing.

Save or quit on purpose

From normal mode, :w and Enter saves; :w newname.txt saves under a new name. :q quits only if no unsaved changes prevent it. :wq, :x, or ZZ saves and quits. :q! discards unsaved changes and quits.

If typing unexpectedly moves the cursor or deletes text, press Esc to establish normal mode, then use u to undo unwanted edits before continuing. Enter insert mode before typing the replacement text. When leaving an editing attempt, choose whether to save or discard; the exclamation mark in :q! authorizes discarding unsaved work.