Hiring panels ask these questions because log triage is daily work. Every command below was verified against GNU grep 3.11, so you can rehearse the exact syntax you will type on the job.
Every example below runs against a small log file, so you can reproduce each result in your own terminal in under a minute. If you want the full command tour first, start with our grep command tutorial, then use this page for interview-style practice.
What is grep and why is it useful?
grep is a command-line utility that searches input files for lines matching a regular expression and prints those lines. Interviewers like it because one answer reveals whether you understand regular expressions, exit codes, and how to work through large logs without a GUI. It ships with every major Linux distribution, so there is nothing to install before practice.
How do you search for a specific word or phrase?
The basic form takes the search expression followed by one or more files. Suppose app.log records application activity and you need every line that mentions ERROR:
grep "ERROR" app.log
grep prints each line that contains the match, leaving everything else out. Without a filename argument it reads standard input, which is why piping another command’s output into grep is so common in scripts.
How do you ignore case and show line numbers?
Logs rarely use consistent capitalization, so interviewers often follow up by asking how you catch both ERROR and error. The -i flag ignores case, and -n prefixes each matching line with its line number:
grep -in "error" app.log
The output shows line 2 with uppercase ERROR and line 4 with lowercase error. Line numbers matter when you hand results to a teammate, because they can jump straight to the spot in the original file.
How do you count matching lines?
The -c flag suppresses normal output and prints a count of matching lines instead. To find out how many successful logins appear in the log:
grep -c "login ok" app.log
This prints 2 for our sample file. When you pass several files, grep reports a separate count per file, which makes it an easy way to compare activity across logs.
How do you print lines that do not match?
The -v flag inverts the match, returning every line except the ones containing the expression. Filtering out routine login lines isolates everything unusual:
grep -v "login ok" app.log
Inverting matches is also how you clean noise before counting. Combining -v with -c answers questions such as how many lines failed a health check without listing them all.
How do you search for multiple expressions at once?
You have two correct options here, and knowing both signals experience. The -e flag accepts each expression separately:
grep -e "ERROR" -e "WARN" app.log
With extended regular expressions enabled by -E, alternation using the pipe character does the same job in one expression:
grep -E "ERROR|WARN" app.log
Both expressions return identical results here. A wrong answer to watch for is piping grep into grep as if the pipe were OR logic inside one command. Piping chains filters across separate processes, while -e and alternation match both expressions in a single pass.
How do you match whole words only?
Searching for “error” also matches “errors” and “errorless” unless you constrain the match. The -w flag selects only lines containing matches that form whole words, which is exactly how the GNU grep manual defines it:
echo "error errors errorless" | grep -o "error"
echo "error errors errorless" | grep -ow "error"
The first command prints three matches, one per substring, and the second prints just one because only the standalone word qualifies. Interviewers use this question to test whether you know the difference between matching text and matching words.
How do you print only the matched part of a line?
The -o flag prints each match on its own line instead of the full line, which turns free text into extractable values. Pulling usernames out of the login records looks like this:
grep -o "user=[a-z]*" app.log
The output is user=nina and user=sam with nothing else on the line. Combined with sort and uniq this becomes the standard way to answer questions such as which users appear most often in a log.
How do you show lines before and after a match?
Context flags are the signature senior-level question. Use -B for lines before the match, -A for lines after, and -C for both together. To see what happened immediately around the database timeout:
grep -B1 -A1 "ERROR" app.log
The output confirms the match plus its INFO neighbor above and WARN neighbor below. Context is usually the difference between spotting an error and understanding it.
Can grep search multiple files and directories?
Yes. Name several files after the expression, or add -r to walk a directory tree. Recursion is the everyday case when sweeping source code for leftover markers:
Each hit is prefixed with its file path and line number, exactly what a reviewer needs to act on the findings.
Pair -l with -r when you only care about which files contain the match:
grep -rl "TODO" .
A common follow-up question is how to skip binary or hidden files. Use –include to restrict recursion to specific filenames, for example grep -r –include=”*.py” “TODO” .
Frequently asked flag comparison
Interviewers move fast between flags, so keep this mapping handy. Each row names the flag, its job, and the question it usually answers.
| Flag | What it does | Typical interview question |
|---|---|---|
| -i | Ignores case | Search regardless of capitalization |
| -n | Prints line numbers | Locate matches in the source file |
| -c | Counts matching lines | Tally events instead of listing them |
| -v | Inverts the match | Show everything except the noise |
| -w | Matches whole words only | Avoid partial-word hits |
| -o | Prints only the matched part | Extract values such as usernames |
| -E | Extended regular expressions | Combine conditions with | |
| -A / -B / -C | Context after, before, or around | Investigate what surrounded an error |
| -r | Recursive directory search | Sweep a whole project tree |
| -l | Lists filenames only | Find which files contain a match |
Can grep replace text in a file?
No. grep only searches and prints matching lines, it never edits the file. For in-place substitution reach for sed, as covered in our guide to editing files in Linux. Naming sed here shows you know where the search tool ends.
Practice plan for interview day
- Create a sample log file and reproduce every command in this article from memory.
- Explain each flag aloud in one sentence, because interviewers score clarity as much as correctness.
- Mix grep into pipelines with sort and uniq, two staples covered in our Linux command line guide.
- Check exit codes: grep returns 0 when a match is found, 1 when none, and 2 on error, a detail senior panels love.
What does the grep command do?
grep searches input files line by line for a match against a regular expression and prints every matching line. It works on plain text, logs, and command output piped from other programs.
How do I search for two different words with grep?
Use either grep -e “word1” -e “word2” file.txt or enable extended expressions with grep -E “word1|word2” file.txt. Both approaches print lines containing either word.
How can I see the lines before and after a match?
Use -B num for lines before the match, -A num for lines after, or -C num for both. For example, grep -B1 -A1 “ERROR” app.log shows one line of context on each side.
Does grep support replacing text in files?
No. grep finds and prints matching lines only. Use the sed stream editor for search-and-replace tasks.
Conclusion
Strong grep answers combine a correct command, output you can explain, and knowledge of where the tool ends. Build that habit with the practice log above, then extend it with our tutorials on Linux logging and job control and bashrc versus bash profile to cover the rest of the shell questions that usually follow.