Linux – When to use egrep instead of grep

bashlinux

I am preparing for a Linux terminal assessment now, I tried to Google and found most resources are referring to the basic "grep" rather than the more powerful "egrep" — well, that is at least what the professor said in lecture.

I am always working with small samples so performance tuning is a thing too far away.

So basically I'd like to know are there any areas where I must switch to egrep to do it in a better way? Is it safe to work with basic "grep" as for now? will there be potential risks?

Sorry about my limited knowledge on Linux shell commands, the man page looks like a maze to me and honestly I haven't put much time in understanding all the features both command provide.

Best Answer

egrep = grep -E

From http://www.opengroup.org/onlinepubs/007908799/xcu/grep.html

"Match using extended regular expressions. Treat each pattern specified as an ERE, as described in the XBD specification, Extended Regular Expressions . If any entire ERE pattern matches an input line, the line will be matched. A null ERE matches every line."

So, with egrep you can use +, ?, | and ().

Differences between grep, pgrep, egrep, and fgrep (Linux):

grep

grep is an acronym that stands for "Global Regular Expressions Print". grep is a program which scans a specified file or files line by line, returning lines that contain a pattern. A pattern is an expression that specifies a set of strings by interpreting characters as meta-characters. For example the asterisk meta character (*) is interpreted as meaning "zero or more of the preceding element". This enables users to type a short series of characters and meta characters into a grep command to have the computer show us what lines in which files match.

The standard grep command looks like:

grep <flags> '<regular expression>' <filename>

grep prints the search results to the screen (stdout) and returns the following exit values:

0    A match was found.
1    No match was found.
>1   A syntax error was found or a file was inaccessible 
     (even if matches were found).

Some common flags are: -c for counting the number of successful matches and not printing the actual matches, -i to make the search case insensitive, -n to print the line number before each match printout, -v to take the complement of the regular expression (i.e. return the lines which don't match), and -l to print the file names of files with lines which match the expression.

egrep

egrep is an acronym that stands for "Extended Global Regular Expressions Print".

The 'E' in egrep means treat the pattern as a regular expression. "Extended Regular Expressions" abbreviated 'ERE' is enabled in egrep. egrep (which is the same as grep -E) treats +, ?, |, (, and ) as meta-characters.

In basic regular expressions (with grep), the meta-characters ?, +, {, |, (, and ) lose their special meaning. If you want grep to treat these characters as meta-characters, escape them \?, \+, \{, \|, \(, and \).

For example, here grep uses basic regular expressions where the plus is treated literally, any line with a plus in it is returned.

grep "+" myfile.txt

egrep on the other hand treats the "+" as a meta character and returns every line because plus is interpreted as "one or more times".

egrep "+" myfile.txt

Here every line is returned because the + was treated by egrep as a meta character. normal grep would have searched only for lines with a literal +.

fgrep

fgrep is an acronym that stands for "Fixed-string Global Regular Expressions Print".

fgrep (which is the same as grep -F) is fixed or fast grep and behaves as grep but does NOT recognize any regular expression meta-characters as being special. The search will complete faster because it only processes a simple string rather than a complex pattern.

For example, if I wanted to search my .bash_profile for a literal dot (.) then using grep would be difficult because I would have to escape the dot because dot is a meta character that means 'wild-card, any single character':

grep "." myfile.txt

The above command returns every line of myfile.txt. Do this instead:

fgrep "." myfile.txt

Then only the lines that have a literal '.' in them are returned. fgrep helps us not bother escaping our meta characters.

pgrep

pgrep is an acronym that stands for "Process-ID Global Regular Expressions Print".

pgrep looks through the currently running processes and lists the process IDs which matches the selection criteria to stdout. pgrep is handy when all you want to know is the process id integer of a process. For example, if I wanted to know only the process ID of my mysql process I would use the command pgrep mysql which would return a process ID like 7312.

Linux – What are the advantages, if any of grep over egrep

Technical answer: traditionally, egrep used a deterministic finite automaton (DFA) internally while grep used a non-deterministic finite automaton (NFA). These days, GNU grep and egrep take a hybrid NFA/DFA approach.

According to Friedl's book Mastering Regular Expressions, to discover if your egrep (for example) has an NFA engine or if it has a DFA engine try:

echo =XX========================================= | egrep 'X(.+)+X'

Freidl (p.147) says:

If it takes a long time to finish, it's an NFA ... If it finishes quickly, it's either a DFA or an NFA with some advanced optimization. Does it display a warning message about a stack overow or long match aborted? If so, it's an NFA.

Friedl describes the NFA engine as "regex-directed" and the DFA as "text-directed". The details of the distinction are described from p.153 of his book onwards.

The consequence is that there are some pattern/text combinations that are matched more quickly by a DFA and some that are matched more quickly by an NFA. Also, the way you write a regex for an NFA can have a significant effect on the speed of matching. Often, a DFA will be faster, but DFAs do not support lazy matching, they match differently in some cases, they cannot do look-around expressions or back-references, and they omit some other features compared to NFAs.

According to Freidl, GNU grep uses a DFA when possible and reverts to an NFA when back-references are used.