grep — System Administration

Pacman, Journalctl, Systemd

Recent package installs from pacman log

grep -P '^\[.*\] \[ALPM\] installed' /var/log/pacman.log | tail -10

Packages installed today

grep -P "^\[$(date +%Y-%m-%d).*\] \[ALPM\] installed" /var/log/pacman.log

Package upgrades in the last week

grep -P '^\[.*\] \[ALPM\] upgraded' /var/log/pacman.log | tail -20

Journal errors in the last hour (deduplicated)

journalctl -p err --since "1 hour ago" --no-pager | grep -oP '(?<=: ).*' | sort | uniq -c | sort -rn | head -10

Running services count

systemctl list-units --type=service --state=running --no-legend | grep -c ''

Failed systemd units

systemctl list-units --failed --no-legend | grep -oP '^\S+'

Find processes by name with full command line

ps aux | grep -P '[n]ode.*antora'
# Bracket trick: [n]ode prevents grep from matching itself

Listening ports — what’s bound where

ss -tlnp | grep -P ':\d+\s' | awk '{print $4, $6}'

Extract timestamps from log lines

grep -oP '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}' /var/log/pacman.log | head -5

Events within a time window (between 14:00 and 15:00)

grep -P '^\[2026-04-11T1[45]:' /var/log/pacman.log

Count events per hour

grep -oP '^\[\d{4}-\d{2}-\d{2}T\K\d{2}' /var/log/pacman.log | sort | uniq -c

Extract error messages, deduplicate, rank by frequency

grep -i 'error' /var/log/*.log 2>/dev/null | grep -oP '(?<=: ).*' | sort | uniq -c | sort -rn | head -10

Tail a log and grep in real-time (live monitoring)

tail -f /var/log/pacman.log | grep --line-buffered 'installed'

Multiline grep — match across line boundaries (GNU grep -z)

grep -Pzo 'BEGIN TRANSACTION.*?END TRANSACTION' logfile

List all aliases

grep -nP '^alias ' ~/.zshrc

List all functions

grep -nP '^(\w+\(\)|function \w+)' ~/.zshrc

Find exported environment variables

grep -nP '^export ' ~/.zshrc ~/.zprofile 2>/dev/null

Find PATH modifications

grep -nP 'PATH' ~/.zshrc ~/.zprofile 2>/dev/null

Hyprland keybind audit — total count

grep -cP '^bind' ~/.config/hypr/hyprland.conf

Hyprland keybinds by type

grep -oP '^bind[a-z]*' ~/.config/hypr/hyprland.conf | sort | uniq -c | sort -rn
# Output: 85 bind, 30 binde, 20 bindl, 14 bindm

Find all SUPER+key bindings

grep -nP '^\$mainMod,' ~/.config/hypr/hyprland.conf | head -10

SSH config hosts

grep -P '^Host\s' ~/.ssh/config 2>/dev/null