Viewing, searching and editing text files

cat notes.txt            # print the whole file
less /var/log/syslog     # scroll through a big file (q to quit)
head -n 20 access.log    # first 20 lines
tail -n 50 error.log     # last 50 lines
tail -f error.log        # follow: new lines appear live (Ctrl+C to stop)
wc -l users.csv          # count lines

grep "error" app.log                 # lines containing "error"
grep -i "mpesa" app.log              # ignore case
grep -n "TODO" *.php                 # show line numbers
grep -r "DB_PASSWORD" /var/www       # search a whole folder
grep -v "DEBUG" app.log              # lines NOT containing DEBUG
grep -c "404" access.log             # count matching lines
grep -E "0[17][0-9]{8}" contacts.txt # regular expression: Kenyan phone numbers

find . -name "*.php"                      # all PHP files below here
find /var/www -name "config*"             # by name pattern
find . -type d -name "uploads"            # only folders
find . -size +50M                         # files bigger than 50 MB
find /tmp -mtime +7 -delete               # delete files older than 7 days (careful!)

nano /etc/hosts

diff old.conf new.conf        # show differences
sort names.txt                # alphabetical
sort -n amounts.txt           # numerical
uniq                          # remove repeated neighbouring lines (use after sort)
cut -d, -f2 sales.csv         # 2nd column of a CSV

less /var/log/syslog          # scroll with arrows, / to search, n for next match, q to quit
head -n 20 access.log         # first 20 lines
tail -n 50 error.log          # last 50 lines
tail -f /var/log/nginx/error.log      # watch new lines live (Ctrl+C to stop)
wc -l access.log              # count lines (e.g. number of requests)
du -h access.log              # file size

grep "404" access.log                     # lines containing 404
grep -i "error" app.log                   # ignore case
grep -n "DB_HOST" .env                    # show line numbers
grep -c "POST /checkout" access.log       # count matching lines
grep -v "bot" access.log                  # lines NOT containing "bot"
grep -r "mpesa_callback" /var/www/app     # search all files in a folder
grep -rl "TODO" src/                      # only list file names
grep -A 3 -B 2 "Fatal error" php.log      # 3 lines after and 2 before each match (context)
grep -E "404|500" access.log              # extended regex: 404 OR 500
grep -o "[0-9]\{1,3\}\(\.[0-9]\{1,3\}\)\{3\}" access.log | head   # extract IP addresses

find /var/www -name "*.php"                      # by name
find . -iname "*invoice*"                        # case-insensitive
find /var/log -name "*.log" -size +100M          # large logs
find /backups -name "*.sql.gz" -mtime +30        # older than 30 days
find . -type d -name node_modules                # directories only
find /var/www -type f -perm -o+w                 # files writable by everyone (security risk)
find /backups -name "*.gz" -mtime +30 -delete    # delete old backups (test without -delete first!)

diff old.conf new.conf                # differences between files
diff -u old.conf new.conf             # unified format (like Git)
sort names.txt                        # alphabetical
sort -n numbers.txt                   # numeric
sort -t, -k3 -n sales.csv             # sort CSV by 3rd column numerically
sort names.txt | uniq                 # remove duplicate neighbours
sort names.txt | uniq -c | sort -rn   # count occurrences, most common first
cut -d, -f1,3 sales.csv               # columns 1 and 3 of a CSV

# 1. Is the error log growing?
tail -n 30 /var/log/nginx/error.log
# 2. Which PHP errors happened today?
grep "$(date +%d-%b-%Y)" /var/log/php*-fpm.log | tail
# 3. Which pages return 500 errors most?
grep '" 500 ' /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head
# 4. Find the code mentioned in the error
grep -rn "function processPayment" /var/www/app