Ubuntu – Why does this grep command not work

The square bracket expression is part of the bash shell (and other shells as well) grep's character class pattern matching.

The grep program by default understands POSIX basic regular expressions. With that you can define character classes. For example ps -ef | grep [ab9]irefox would find "airefox", "birefox", "9irefox" if those existed, but not "abirefox".

The command grep [a-zA-Z0-9]irefox would even find all processes that start with exactly one letter or number and end in "irefox".

So ps -ef | grep firefox searches for lines with firefox in it. Since the grep process itself has "firefox" in it, grep finds that as well. By adding a [], we are only searching for the character class "[f]" (which consists of only the letter "f" and is therefor equivalent to just an "f" without the brackets). The advantage of the brackets now is that the string "firefox" no longer appears in the grep command. Hence, grep itself won't show up in the grep result.

Because not very many people are familiar with square brackets as character class matching and regular expressions in general, the second result might look a little mysterious.

If you want to fix the second result, you can use them this way:

ps -ef | grep [f]irefox  > data
grep firefox data

(Reference)

This is because grep (without any arguments) only works with standard regular expressions. + is part of the extended regular expressions, so to use that, you need to use grep -E or egrep:

ls -l /var/log | awk '{print $9}' | grep -E "^[a-z]+\.log."

Also, you can just do this if you don't want to use extended regular expressions:

ls -l /var/log | awk '{print $9}' | grep "^[a-z][a-z]*\.log."