1 .TH PCRE2GREP 1 "24 February 2018" "PCRE2 10.32"
3 pcre2grep - a grep with Perl-compatible regular expressions.
5 .B pcre2grep [options] [long options] [pattern] [path1 path2 ...]
10 \fBpcre2grep\fP searches files for character patterns, in the same way as other
11 grep commands do, but it uses the PCRE2 regular expression library to support
12 patterns that are compatible with the regular expressions of Perl 5. See
16 for a quick-reference summary of pattern syntax, or
20 for a full description of the syntax and semantics of the regular expressions
23 Patterns, whether supplied on the command line or in a separate file, are given
24 without delimiters. For example:
26 pcre2grep Thursday /etc/motd
28 If you attempt to use delimiters (for example, by surrounding a pattern with
29 slashes, as is common in Perl scripts), they are interpreted as part of the
30 pattern. Quotes can of course be used to delimit patterns on the command line
31 because they are interpreted by the shell, and indeed quotes are required if a
32 pattern contains white space or shell metacharacters.
34 The first argument that follows any option settings is treated as the single
35 pattern to be matched when neither \fB-e\fP nor \fB-f\fP is present.
36 Conversely, when one or both of these options are used to specify patterns, all
37 arguments are treated as path names. At least one of \fB-e\fP, \fB-f\fP, or an
38 argument pattern must be provided.
40 If no files are specified, \fBpcre2grep\fP reads the standard input. The
41 standard input can also be referenced by a name consisting of a single hyphen.
44 pcre2grep some-pattern file1 - file3
46 Input files are searched line by line. By default, each line that matches a
47 pattern is copied to the standard output, and if there is more than one file,
48 the file name is output at the start of each line, followed by a colon.
49 However, there are options that can change how \fBpcre2grep\fP behaves. In
50 particular, the \fB-M\fP option makes it possible to search for strings that
51 span line boundaries. What defines a line boundary is controlled by the
52 \fB-N\fP (\fB--newline\fP) option.
54 The amount of memory used for buffering files that are being scanned is
55 controlled by parameters that can be set by the \fB--buffer-size\fP and
56 \fB--max-buffer-size\fP options. The first of these sets the size of buffer
57 that is obtained at the start of processing. If an input file contains very
58 long lines, a larger buffer may be needed; this is handled by automatically
59 extending the buffer, up to the limit specified by \fB--max-buffer-size\fP. The
60 default values for these parameters can be set when \fBpcre2grep\fP is
61 built; if nothing is specified, the defaults are set to 20KiB and 1MiB
62 respectively. An error occurs if a line is too long and the buffer can no
65 The block of memory that is actually used is three times the "buffer size", to
66 allow for buffering "before" and "after" lines. If the buffer size is too
67 small, fewer than requested "before" and "after" lines may be output.
69 Patterns can be no longer than 8KiB or BUFSIZ bytes, whichever is the greater.
70 BUFSIZ is defined in \fB<stdio.h>\fP. When there is more than one pattern
71 (specified by the use of \fB-e\fP and/or \fB-f\fP), each pattern is applied to
72 each line in the order in which they are defined, except that all the \fB-e\fP
73 patterns are tried before the \fB-f\fP patterns.
75 By default, as soon as one pattern matches a line, no further patterns are
76 considered. However, if \fB--colour\fP (or \fB--color\fP) is used to colour the
77 matching substrings, or if \fB--only-matching\fP, \fB--file-offsets\fP, or
78 \fB--line-offsets\fP is used to output only the part of the line that matched
79 (either shown literally, or as an offset), scanning resumes immediately
80 following the match, so that further matches on the same line can be found. If
81 there are multiple patterns, they are all tried on the remainder of the line,
82 but patterns that follow the one that matched are not tried on the earlier part
85 This behaviour means that the order in which multiple patterns are specified
86 can affect the output when one of the above options is used. This is no longer
87 the same behaviour as GNU grep, which now manages to display earlier matches
88 for later patterns (as long as there is no overlap).
90 Patterns that can match an empty string are accepted, but empty string
91 matches are never recognized. An example is the pattern "(super)?(man)?", in
92 which all components are optional. This pattern finds all occurrences of both
93 "super" and "man"; the output differs from matching with "super|man" when only
94 the matching substrings are being shown.
96 If the \fBLC_ALL\fP or \fBLC_CTYPE\fP environment variable is set,
97 \fBpcre2grep\fP uses the value to set a locale when calling the PCRE2 library.
98 The \fB--locale\fP option can be used to override this.
101 .SH "SUPPORT FOR COMPRESSED FILES"
104 It is possible to compile \fBpcre2grep\fP so that it uses \fBlibz\fP or
105 \fBlibbz2\fP to read compressed files whose names end in \fB.gz\fP or
106 \fB.bz2\fP, respectively. You can find out whether your \fBpcre2grep\fP binary
107 has support for one or both of these file types by running it with the
108 \fB--help\fP option. If the appropriate support is not present, all files are
109 treated as plain text. The standard input is always so treated. When input is
110 from a compressed .gz or .bz2 file, the \fB--line-buffered\fP option is
117 By default, a file that contains a binary zero byte within the first 1024 bytes
118 is identified as a binary file, and is processed specially. (GNU grep
119 identifies binary files in this manner.) However, if the newline type is
120 specified as "nul", that is, the line terminator is a binary zero, the test for
121 a binary file is not applied. See the \fB--binary-files\fP option for a means
122 of changing the way binary files are handled.
125 .SH "BINARY ZEROS IN PATTERNS"
128 Patterns passed from the command line are strings that are terminated by a
129 binary zero, so cannot contain internal zeros. However, patterns that are read
130 from a file via the \fB-f\fP option may contain binary zeros.
136 The order in which some of the options appear can affect the output. For
137 example, both the \fB-H\fP and \fB-l\fP options affect the printing of file
138 names. Whichever comes later in the command line will be the one that takes
139 effect. Similarly, except where noted below, if an option is given twice, the
140 later setting is used. Numerical values for options may be followed by K or M,
141 to signify multiplication by 1024 or 1024*1024 respectively.
144 This terminates the list of options. It is useful if the next item on the
145 command line starts with a hyphen but is not an option. This allows for the
146 processing of patterns and file names that start with hyphens.
148 \fB-A\fP \fInumber\fP, \fB--after-context=\fP\fInumber\fP
149 Output up to \fInumber\fP lines of context after each matching line. Fewer
150 lines are output if the next match or the end of the file is reached, or if the
151 processing buffer size has been set too small. If file names and/or line
152 numbers are being output, a hyphen separator is used instead of a colon for the
153 context lines. A line containing "--" is output between each group of lines,
154 unless they are in fact contiguous in the input file. The value of \fInumber\fP
155 is expected to be relatively small. When \fB-c\fP is used, \fB-A\fP is ignored.
157 \fB-a\fP, \fB--text\fP
158 Treat binary files as text. This is equivalent to
159 \fB--binary-files\fP=\fItext\fP.
161 \fB-B\fP \fInumber\fP, \fB--before-context=\fP\fInumber\fP
162 Output up to \fInumber\fP lines of context before each matching line. Fewer
163 lines are output if the previous match or the start of the file is within
164 \fInumber\fP lines, or if the processing buffer size has been set too small. If
165 file names and/or line numbers are being output, a hyphen separator is used
166 instead of a colon for the context lines. A line containing "--" is output
167 between each group of lines, unless they are in fact contiguous in the input
168 file. The value of \fInumber\fP is expected to be relatively small. When
169 \fB-c\fP is used, \fB-B\fP is ignored.
171 \fB--binary-files=\fP\fIword\fP
172 Specify how binary files are to be processed. If the word is "binary" (the
173 default), pattern matching is performed on binary files, but the only output is
174 "Binary file <name> matches" when a match succeeds. If the word is "text",
175 which is equivalent to the \fB-a\fP or \fB--text\fP option, binary files are
176 processed in the same way as any other file. In this case, when a match
177 succeeds, the output may be binary garbage, which can have nasty effects if
178 sent to a terminal. If the word is "without-match", which is equivalent to the
179 \fB-I\fP option, binary files are not processed at all; they are assumed not to
180 be of interest and are skipped without causing any output or affecting the
183 \fB--buffer-size=\fP\fInumber\fP
184 Set the parameter that controls how much memory is obtained at the start of
185 processing for buffering files that are being scanned. See also
186 \fB--max-buffer-size\fP below.
188 \fB-C\fP \fInumber\fP, \fB--context=\fP\fInumber\fP
189 Output \fInumber\fP lines of context both before and after each matching line.
190 This is equivalent to setting both \fB-A\fP and \fB-B\fP to the same value.
192 \fB-c\fP, \fB--count\fP
193 Do not output lines from the files that are being scanned; instead output the
194 number of lines that would have been shown, either because they matched, or, if
195 \fB-v\fP is set, because they failed to match. By default, this count is
196 exactly the same as the number of lines that would have been output, but if the
197 \fB-M\fP (multiline) option is used (without \fB-v\fP), there may be more
198 suppressed lines than the count (that is, the number of matches).
200 If no lines are selected, the number zero is output. If several files are are
201 being scanned, a count is output for each of them and the \fB-t\fP option can
202 be used to cause a total to be output at the end. However, if the
203 \fB--files-with-matches\fP option is also used, only those files whose counts
204 are greater than zero are listed. When \fB-c\fP is used, the \fB-A\fP,
205 \fB-B\fP, and \fB-C\fP options are ignored.
207 \fB--colour\fP, \fB--color\fP
208 If this option is given without any data, it is equivalent to "--colour=auto".
209 If data is required, it must be given in the same shell item, separated by an
212 \fB--colour=\fP\fIvalue\fP, \fB--color=\fP\fIvalue\fP
213 This option specifies under what circumstances the parts of a line that matched
214 a pattern should be coloured in the output. By default, the output is not
215 coloured. The value (which is optional, see above) may be "never", "always", or
216 "auto". In the latter case, colouring happens only if the standard output is
217 connected to a terminal. More resources are used when colouring is enabled,
218 because \fBpcre2grep\fP has to search for all possible matches in a line, not
219 just one, in order to colour them all.
221 The colour that is used can be specified by setting one of the environment
222 variables PCRE2GREP_COLOUR, PCRE2GREP_COLOR, PCREGREP_COLOUR, or
223 PCREGREP_COLOR, which are checked in that order. If none of these are set,
224 \fBpcre2grep\fP looks for GREP_COLORS or GREP_COLOR (in that order). The value
225 of the variable should be a string of two numbers, separated by a semicolon,
226 except in the case of GREP_COLORS, which must start with "ms=" or "mt="
227 followed by two semicolon-separated colours, terminated by the end of the
228 string or by a colon. If GREP_COLORS does not start with "ms=" or "mt=" it is
229 ignored, and GREP_COLOR is checked.
231 If the string obtained from one of the above variables contains any characters
232 other than semicolon or digits, the setting is ignored and the default colour
233 is used. The string is copied directly into the control string for setting
234 colour on a terminal, so it is your responsibility to ensure that the values
235 make sense. If no relevant environment variable is set, the default is "1;31",
238 \fB-D\fP \fIaction\fP, \fB--devices=\fP\fIaction\fP
239 If an input path is not a regular file or a directory, "action" specifies how
240 it is to be processed. Valid values are "read" (the default) or "skip"
241 (silently skip the path).
243 \fB-d\fP \fIaction\fP, \fB--directories=\fP\fIaction\fP
244 If an input path is a directory, "action" specifies how it is to be processed.
245 Valid values are "read" (the default in non-Windows environments, for
246 compatibility with GNU grep), "recurse" (equivalent to the \fB-r\fP option), or
247 "skip" (silently skip the path, the default in Windows environments). In the
248 "read" case, directories are read as if they were ordinary files. In some
249 operating systems the effect of reading a directory like this is an immediate
250 end-of-file; in others it may provoke an error.
252 \fB--depth-limit\fP=\fInumber\fP
253 See \fB--match-limit\fP below.
255 \fB-e\fP \fIpattern\fP, \fB--regex=\fP\fIpattern\fP, \fB--regexp=\fP\fIpattern\fP
256 Specify a pattern to be matched. This option can be used multiple times in
257 order to specify several patterns. It can also be used as a way of specifying a
258 single pattern that starts with a hyphen. When \fB-e\fP is used, no argument
259 pattern is taken from the command line; all arguments are treated as file
260 names. There is no limit to the number of patterns. They are applied to each
261 line in the order in which they are defined until one matches.
263 If \fB-f\fP is used with \fB-e\fP, the command line patterns are matched first,
264 followed by the patterns from the file(s), independent of the order in which
265 these options are specified. Note that multiple use of \fB-e\fP is not the same
266 as a single pattern with alternatives. For example, X|Y finds the first
267 character in a line that is X or Y, whereas if the two patterns are given
268 separately, with X first, \fBpcre2grep\fP finds X if it is present, even if it
269 follows Y in the line. It finds Y only if there is no X in the line. This
270 matters only if you are using \fB-o\fP or \fB--colo(u)r\fP to show the part(s)
271 of the line that matched.
273 \fB--exclude\fP=\fIpattern\fP
274 Files (but not directories) whose names match the pattern are skipped without
275 being processed. This applies to all files, whether listed on the command line,
276 obtained from \fB--file-list\fP, or by scanning a directory. The pattern is a
277 PCRE2 regular expression, and is matched against the final component of the
278 file name, not the entire path. The \fB-F\fP, \fB-w\fP, and \fB-x\fP options do
279 not apply to this pattern. The option may be given any number of times in order
280 to specify multiple patterns. If a file name matches both an \fB--include\fP
281 and an \fB--exclude\fP pattern, it is excluded. There is no short form for this
284 \fB--exclude-from=\fP\fIfilename\fP
285 Treat each non-empty line of the file as the data for an \fB--exclude\fP
286 option. What constitutes a newline when reading the file is the operating
287 system's default. The \fB--newline\fP option has no effect on this option. This
288 option may be given more than once in order to specify a number of files to
291 \fB--exclude-dir\fP=\fIpattern\fP
292 Directories whose names match the pattern are skipped without being processed,
293 whatever the setting of the \fB--recursive\fP option. This applies to all
294 directories, whether listed on the command line, obtained from
295 \fB--file-list\fP, or by scanning a parent directory. The pattern is a PCRE2
296 regular expression, and is matched against the final component of the directory
297 name, not the entire path. The \fB-F\fP, \fB-w\fP, and \fB-x\fP options do not
298 apply to this pattern. The option may be given any number of times in order to
299 specify more than one pattern. If a directory matches both \fB--include-dir\fP
300 and \fB--exclude-dir\fP, it is excluded. There is no short form for this
303 \fB-F\fP, \fB--fixed-strings\fP
304 Interpret each data-matching pattern as a list of fixed strings, separated by
305 newlines, instead of as a regular expression. What constitutes a newline for
306 this purpose is controlled by the \fB--newline\fP option. The \fB-w\fP (match
307 as a word) and \fB-x\fP (match whole line) options can be used with \fB-F\fP.
308 They apply to each of the fixed strings. A line is selected if any of the fixed
309 strings are found in it (subject to \fB-w\fP or \fB-x\fP, if present). This
310 option applies only to the patterns that are matched against the contents of
311 files; it does not apply to patterns specified by any of the \fB--include\fP or
312 \fB--exclude\fP options.
314 \fB-f\fP \fIfilename\fP, \fB--file=\fP\fIfilename\fP
315 Read patterns from the file, one per line, and match them against each line of
316 input. As is the case with patterns on the command line, no delimiters should
317 be used. What constitutes a newline when reading the file is the operating
318 system's default interpretation of \en. The \fB--newline\fP option has no
319 effect on this option. Trailing white space is removed from each line, and
320 blank lines are ignored. An empty file contains no patterns and therefore
321 matches nothing. Patterns read from a file in this way may contain binary
322 zeros, which are treated as ordinary data characters. See also the comments
323 about multiple patterns versus a single pattern with alternatives in the
324 description of \fB-e\fP above.
326 If this option is given more than once, all the specified files are read. A
327 data line is output if any of the patterns match it. A file name can be given
328 as "-" to refer to the standard input. When \fB-f\fP is used, patterns
329 specified on the command line using \fB-e\fP may also be present; they are
330 tested before the file's patterns. However, no other pattern is taken from the
331 command line; all arguments are treated as the names of paths to be searched.
333 \fB--file-list\fP=\fIfilename\fP
334 Read a list of files and/or directories that are to be scanned from the given
335 file, one per line. What constitutes a newline when reading the file is the
336 operating system's default. Trailing white space is removed from each line, and
337 blank lines are ignored. These paths are processed before any that are listed
338 on the command line. The file name can be given as "-" to refer to the standard
339 input. If \fB--file\fP and \fB--file-list\fP are both specified as "-",
340 patterns are read first. This is useful only when the standard input is a
341 terminal, from which further lines (the list of files) can be read after an
342 end-of-file indication. If this option is given more than once, all the
343 specified files are read.
346 Instead of showing lines or parts of lines that match, show each match as an
347 offset from the start of the file and a length, separated by a comma. In this
348 mode, no context is shown. That is, the \fB-A\fP, \fB-B\fP, and \fB-C\fP
349 options are ignored. If there is more than one match in a line, each of them is
350 shown separately. This option is mutually exclusive with \fB--output\fP,
351 \fB--line-offsets\fP, and \fB--only-matching\fP.
353 \fB-H\fP, \fB--with-filename\fP
354 Force the inclusion of the file name at the start of output lines when
355 searching a single file. By default, the file name is not shown in this case.
356 For matching lines, the file name is followed by a colon; for context lines, a
357 hyphen separator is used. If a line number is also being output, it follows the
358 file name. When the \fB-M\fP option causes a pattern to match more than one
359 line, only the first is preceded by the file name. This option overrides any
360 previous \fB-h\fP, \fB-l\fP, or \fB-L\fP options.
362 \fB-h\fP, \fB--no-filename\fP
363 Suppress the output file names when searching multiple files. By default,
364 file names are shown when multiple files are searched. For matching lines, the
365 file name is followed by a colon; for context lines, a hyphen separator is used.
366 If a line number is also being output, it follows the file name. This option
367 overrides any previous \fB-H\fP, \fB-L\fP, or \fB-l\fP options.
369 \fB--heap-limit\fP=\fInumber\fP
370 See \fB--match-limit\fP below.
373 Output a help message, giving brief details of the command options and file
374 type support, and then exit. Anything else on the command line is
378 Ignore binary files. This is equivalent to
379 \fB--binary-files\fP=\fIwithout-match\fP.
381 \fB-i\fP, \fB--ignore-case\fP
382 Ignore upper/lower case distinctions during comparisons.
384 \fB--include\fP=\fIpattern\fP
385 If any \fB--include\fP patterns are specified, the only files that are
386 processed are those that match one of the patterns (and do not match an
387 \fB--exclude\fP pattern). This option does not affect directories, but it
388 applies to all files, whether listed on the command line, obtained from
389 \fB--file-list\fP, or by scanning a directory. The pattern is a PCRE2 regular
390 expression, and is matched against the final component of the file name, not
391 the entire path. The \fB-F\fP, \fB-w\fP, and \fB-x\fP options do not apply to
392 this pattern. The option may be given any number of times. If a file name
393 matches both an \fB--include\fP and an \fB--exclude\fP pattern, it is excluded.
394 There is no short form for this option.
396 \fB--include-from=\fP\fIfilename\fP
397 Treat each non-empty line of the file as the data for an \fB--include\fP
398 option. What constitutes a newline for this purpose is the operating system's
399 default. The \fB--newline\fP option has no effect on this option. This option
400 may be given any number of times; all the files are read.
402 \fB--include-dir\fP=\fIpattern\fP
403 If any \fB--include-dir\fP patterns are specified, the only directories that
404 are processed are those that match one of the patterns (and do not match an
405 \fB--exclude-dir\fP pattern). This applies to all directories, whether listed
406 on the command line, obtained from \fB--file-list\fP, or by scanning a parent
407 directory. The pattern is a PCRE2 regular expression, and is matched against
408 the final component of the directory name, not the entire path. The \fB-F\fP,
409 \fB-w\fP, and \fB-x\fP options do not apply to this pattern. The option may be
410 given any number of times. If a directory matches both \fB--include-dir\fP and
411 \fB--exclude-dir\fP, it is excluded. There is no short form for this option.
413 \fB-L\fP, \fB--files-without-match\fP
414 Instead of outputting lines from the files, just output the names of the files
415 that do not contain any lines that would have been output. Each file name is
416 output once, on a separate line. This option overrides any previous \fB-H\fP,
417 \fB-h\fP, or \fB-l\fP options.
419 \fB-l\fP, \fB--files-with-matches\fP
420 Instead of outputting lines from the files, just output the names of the files
421 containing lines that would have been output. Each file name is output once, on
422 a separate line. Searching normally stops as soon as a matching line is found
423 in a file. However, if the \fB-c\fP (count) option is also used, matching
424 continues in order to obtain the correct count, and those files that have at
425 least one match are listed along with their counts. Using this option with
426 \fB-c\fP is a way of suppressing the listing of files with no matches. This
427 opeion overrides any previous \fB-H\fP, \fB-h\fP, or \fB-L\fP options.
429 \fB--label\fP=\fIname\fP
430 This option supplies a name to be used for the standard input when file names
431 are being output. If not supplied, "(standard input)" is used. There is no
432 short form for this option.
434 \fB--line-buffered\fP
435 When this option is given, non-compressed input is read and processed line by
436 line, and the output is flushed after each write. By default, input is read in
437 large chunks, unless \fBpcre2grep\fP can determine that it is reading from a
438 terminal (which is currently possible only in Unix-like environments or
439 Windows). Output to terminal is normally automatically flushed by the operating
440 system. This option can be useful when the input or output is attached to a
441 pipe and you do not want \fBpcre2grep\fP to buffer up large amounts of data.
442 However, its use will affect performance, and the \fB-M\fP (multiline) option
443 ceases to work. When input is from a compressed .gz or .bz2 file,
444 \fB--line-buffered\fP is ignored.
447 Instead of showing lines or parts of lines that match, show each match as a
448 line number, the offset from the start of the line, and a length. The line
449 number is terminated by a colon (as usual; see the \fB-n\fP option), and the
450 offset and length are separated by a comma. In this mode, no context is shown.
451 That is, the \fB-A\fP, \fB-B\fP, and \fB-C\fP options are ignored. If there is
452 more than one match in a line, each of them is shown separately. This option is
453 mutually exclusive with \fB--output\fP, \fB--file-offsets\fP, and
454 \fB--only-matching\fP.
456 \fB--locale\fP=\fIlocale-name\fP
457 This option specifies a locale to be used for pattern matching. It overrides
458 the value in the \fBLC_ALL\fP or \fBLC_CTYPE\fP environment variables. If no
459 locale is specified, the PCRE2 library's default (usually the "C" locale) is
460 used. There is no short form for this option.
462 \fB--match-limit\fP=\fInumber\fP
463 Processing some regular expression patterns may take a very long time to search
464 for all possible matching strings. Others may require a very large amount of
465 memory. There are three options that set resource limits for matching.
467 The \fB--match-limit\fP option provides a means of limiting computing resource
468 usage when processing patterns that are not going to match, but which have a
469 very large number of possibilities in their search trees. The classic example
470 is a pattern that uses nested unlimited repeats. Internally, PCRE2 has a
471 counter that is incremented each time around its main processing loop. If the
472 value set by \fB--match-limit\fP is reached, an error occurs.
474 The \fB--heap-limit\fP option specifies, as a number of kibibytes (units of
475 1024 bytes), the amount of heap memory that may be used for matching. Heap
476 memory is needed only if matching the pattern requires a significant number of
477 nested backtracking points to be remembered. This parameter can be set to zero
478 to forbid the use of heap memory altogether.
480 The \fB--depth-limit\fP option limits the depth of nested backtracking points,
481 which indirectly limits the amount of memory that is used. The amount of memory
482 needed for each backtracking point depends on the number of capturing
483 parentheses in the pattern, so the amount of memory that is used before this
484 limit acts varies from pattern to pattern. This limit is of use only if it is
485 set smaller than \fB--match-limit\fP.
487 There are no short forms for these options. The default limits can be set
488 when the PCRE2 library is compiled; if they are not specified, the defaults
489 are very large and so effectively unlimited.
491 \fB--max-buffer-size=\fInumber\fP
492 This limits the expansion of the processing buffer, whose initial size can be
493 set by \fB--buffer-size\fP. The maximum buffer size is silently forced to be no
494 smaller than the starting buffer size.
496 \fB-M\fP, \fB--multiline\fP
497 Allow patterns to match more than one line. When this option is set, the PCRE2
498 library is called in "multiline" mode. This allows a matched string to extend
499 past the end of a line and continue on one or more subsequent lines. Patterns
500 used with \fB-M\fP may usefully contain literal newline characters and internal
501 occurrences of ^ and $ characters. The output for a successful match may
502 consist of more than one line. The first line is the line in which the match
503 started, and the last line is the line in which the match ended. If the matched
504 string ends with a newline sequence, the output ends at the end of that line.
505 If \fB-v\fP is set, none of the lines in a multi-line match are output. Once a
506 match has been handled, scanning restarts at the beginning of the line after
507 the one in which the match ended.
509 The newline sequence that separates multiple lines must be matched as part of
510 the pattern. For example, to find the phrase "regular expression" in a file
511 where "regular" might be at the end of a line and "expression" at the start of
512 the next line, you could use this command:
514 pcre2grep -M 'regular\es+expression' <file>
516 The \es escape sequence matches any white space character, including newlines,
517 and is followed by + so as to match trailing white space on the first line as
518 well as possibly handling a two-character newline sequence.
520 There is a limit to the number of lines that can be matched, imposed by the way
521 that \fBpcre2grep\fP buffers the input file as it scans it. With a sufficiently
522 large processing buffer, this should not be a problem, but the \fB-M\fP option
523 does not work when input is read line by line (see \fP--line-buffered\fP.)
525 \fB-N\fP \fInewline-type\fP, \fB--newline\fP=\fInewline-type\fP
526 The PCRE2 library supports five different conventions for indicating
527 the ends of lines. They are the single-character sequences CR (carriage return)
528 and LF (linefeed), the two-character sequence CRLF, an "anycrlf" convention,
529 which recognizes any of the preceding three types, and an "any" convention, in
530 which any Unicode line ending sequence is assumed to end a line. The Unicode
531 sequences are the three just mentioned, plus VT (vertical tab, U+000B), FF
532 (form feed, U+000C), NEL (next line, U+0085), LS (line separator, U+2028), and
533 PS (paragraph separator, U+2029).
535 When the PCRE2 library is built, a default line-ending sequence is specified.
536 This is normally the standard sequence for the operating system. Unless
537 otherwise specified by this option, \fBpcre2grep\fP uses the library's default.
538 The possible values for this option are CR, LF, CRLF, ANYCRLF, or ANY. This
539 makes it possible to use \fBpcre2grep\fP to scan files that have come from
540 other environments without having to modify their line endings. If the data
541 that is being scanned does not agree with the convention set by this option,
542 \fBpcre2grep\fP may behave in strange ways. Note that this option does not
543 apply to files specified by the \fB-f\fP, \fB--exclude-from\fP, or
544 \fB--include-from\fP options, which are expected to use the operating system's
545 standard newline sequence.
547 \fB-n\fP, \fB--line-number\fP
548 Precede each output line by its line number in the file, followed by a colon
549 for matching lines or a hyphen for context lines. If the file name is also
550 being output, it precedes the line number. When the \fB-M\fP option causes a
551 pattern to match more than one line, only the first is preceded by its line
552 number. This option is forced if \fB--line-offsets\fP is used.
555 If the PCRE2 library is built with support for just-in-time compiling (which
556 speeds up matching), \fBpcre2grep\fP automatically makes use of this, unless it
557 was explicitly disabled at build time. This option can be used to disable the
558 use of JIT at run time. It is provided for testing and working round problems.
559 It should never be needed in normal use.
561 \fB-O\fP \fItext\fP, \fB--output\fP=\fItext\fP
562 When there is a match, instead of outputting the whole line that matched,
563 output just the given text. This option is mutually exclusive with
564 \fB--only-matching\fP, \fB--file-offsets\fP, and \fB--line-offsets\fP. Escape
565 sequences starting with a dollar character may be used to insert the contents
566 of the matched part of the line and/or captured substrings into the text.
568 $<digits> or ${<digits>} is replaced by the captured
569 substring of the given decimal number; zero substitutes the whole match. If
570 the number is greater than the number of capturing substrings, or if the
571 capture is unset, the replacement is empty.
573 $a is replaced by bell; $b by backspace; $e by escape; $f by form feed; $n by
574 newline; $r by carriage return; $t by tab; $v by vertical tab.
576 $o<digits> is replaced by the character represented by the given octal
577 number; up to three digits are processed.
579 $x<digits> is replaced by the character represented by the given hexadecimal
580 number; up to two digits are processed.
582 Any other character is substituted by itself. In particular, $$ is replaced by
585 \fB-o\fP, \fB--only-matching\fP
586 Show only the part of the line that matched a pattern instead of the whole
587 line. In this mode, no context is shown. That is, the \fB-A\fP, \fB-B\fP, and
588 \fB-C\fP options are ignored. If there is more than one match in a line, each
589 of them is shown separately, on a separate line of output. If \fB-o\fP is
590 combined with \fB-v\fP (invert the sense of the match to find non-matching
591 lines), no output is generated, but the return code is set appropriately. If
592 the matched portion of the line is empty, nothing is output unless the file
593 name or line number are being printed, in which case they are shown on an
594 otherwise empty line. This option is mutually exclusive with \fB--output\fP,
595 \fB--file-offsets\fP and \fB--line-offsets\fP.
597 \fB-o\fP\fInumber\fP, \fB--only-matching\fP=\fInumber\fP
598 Show only the part of the line that matched the capturing parentheses of the
599 given number. Up to 32 capturing parentheses are supported, and -o0 is
600 equivalent to \fB-o\fP without a number. Because these options can be given
601 without an argument (see above), if an argument is present, it must be given in
602 the same shell item, for example, -o3 or --only-matching=2. The comments given
603 for the non-argument case above also apply to this option. If the specified
604 capturing parentheses do not exist in the pattern, or were not set in the
605 match, nothing is output unless the file name or line number are being output.
607 If this option is given multiple times, multiple substrings are output for each
608 match, in the order the options are given, and all on one line. For example,
609 -o3 -o1 -o3 causes the substrings matched by capturing parentheses 3 and 1 and
610 then 3 again to be output. By default, there is no separator (but see the next
613 \fB--om-separator\fP=\fItext\fP
614 Specify a separating string for multiple occurrences of \fB-o\fP. The default
615 is an empty string. Separating strings are never coloured.
617 \fB-q\fP, \fB--quiet\fP
618 Work quietly, that is, display nothing except error messages. The exit
619 status indicates whether or not any matches were found.
621 \fB-r\fP, \fB--recursive\fP
622 If any given path is a directory, recursively scan the files it contains,
623 taking note of any \fB--include\fP and \fB--exclude\fP settings. By default, a
624 directory is read as a normal file; in some operating systems this gives an
625 immediate end-of-file. This option is a shorthand for setting the \fB-d\fP
628 \fB--recursion-limit\fP=\fInumber\fP
629 See \fB--match-limit\fP above.
631 \fB-s\fP, \fB--no-messages\fP
632 Suppress error messages about non-existent or unreadable files. Such files are
633 quietly skipped. However, the return code is still 2, even if matches were
634 found in other files.
636 \fB-t\fP, \fB--total-count\fP
637 This option is useful when scanning more than one file. If used on its own,
638 \fB-t\fP suppresses all output except for a grand total number of matching
639 lines (or non-matching lines if \fB-v\fP is used) in all the files. If \fB-t\fP
640 is used with \fB-c\fP, a grand total is output except when the previous output
641 is just one line. In other words, it is not output when just one file's count
642 is listed. If file names are being output, the grand total is preceded by
643 "TOTAL:". Otherwise, it appears as just another number. The \fB-t\fP option is
644 ignored when used with \fB-L\fP (list files without matches), because the grand
645 total would always be zero.
647 \fB-u\fP, \fB--utf-8\fP
648 Operate in UTF-8 mode. This option is available only if PCRE2 has been compiled
649 with UTF-8 support. All patterns (including those for any \fB--exclude\fP and
650 \fB--include\fP options) and all subject lines that are scanned must be valid
651 strings of UTF-8 characters.
653 \fB-V\fP, \fB--version\fP
654 Write the version numbers of \fBpcre2grep\fP and the PCRE2 library to the
655 standard output and then exit. Anything else on the command line is
658 \fB-v\fP, \fB--invert-match\fP
659 Invert the sense of the match, so that lines which do \fInot\fP match any of
660 the patterns are the ones that are found.
662 \fB-w\fP, \fB--word-regex\fP, \fB--word-regexp\fP
663 Force the patterns only to match "words". That is, there must be a word
664 boundary at the start and end of each matched string. This is equivalent to
665 having "\eb(?:" at the start of each pattern, and ")\eb" at the end. This
666 option applies only to the patterns that are matched against the contents of
667 files; it does not apply to patterns specified by any of the \fB--include\fP or
668 \fB--exclude\fP options.
670 \fB-x\fP, \fB--line-regex\fP, \fB--line-regexp\fP
671 Force the patterns to start matching only at the beginnings of lines, and in
672 addition, require them to match entire lines. In multiline mode the match may
673 be more than one line. This is equivalent to having "^(?:" at the start of each
674 pattern and ")$" at the end. This option applies only to the patterns that are
675 matched against the contents of files; it does not apply to patterns specified
676 by any of the \fB--include\fP or \fB--exclude\fP options.
679 .SH "ENVIRONMENT VARIABLES"
682 The environment variables \fBLC_ALL\fP and \fBLC_CTYPE\fP are examined, in that
683 order, for a locale. The first one that is set is used. This can be overridden
684 by the \fB--locale\fP option. If no locale is set, the PCRE2 library's default
685 (usually the "C" locale) is used.
691 The \fB-N\fP (\fB--newline\fP) option allows \fBpcre2grep\fP to scan files with
692 different newline conventions from the default. Any parts of the input files
693 that are written to the standard output are copied identically, with whatever
694 newline sequences they have in the input. However, the setting of this option
695 affects only the way scanned files are processed. It does not affect the
696 interpretation of files specified by the \fB-f\fP, \fB--file-list\fP,
697 \fB--exclude-from\fP, or \fB--include-from\fP options, nor does it affect the
698 way in which \fBpcre2grep\fP writes informational messages to the standard
699 error and output streams. For these it uses the string "\en" to indicate
700 newlines, relying on the C I/O library to convert this to an appropriate
704 .SH "OPTIONS COMPATIBILITY"
707 Many of the short and long forms of \fBpcre2grep\fP's options are the same
708 as in the GNU \fBgrep\fP program. Any long option of the form
709 \fB--xxx-regexp\fP (GNU terminology) is also available as \fB--xxx-regex\fP
710 (PCRE2 terminology). However, the \fB--depth-limit\fP, \fB--file-list\fP,
711 \fB--file-offsets\fP, \fB--heap-limit\fP, \fB--include-dir\fP,
712 \fB--line-offsets\fP, \fB--locale\fP, \fB--match-limit\fP, \fB-M\fP,
713 \fB--multiline\fP, \fB-N\fP, \fB--newline\fP, \fB--om-separator\fP,
714 \fB--output\fP, \fB-u\fP, and \fB--utf-8\fP options are specific to
715 \fBpcre2grep\fP, as is the use of the \fB--only-matching\fP option with a
716 capturing parentheses number.
718 Although most of the common options work the same way, a few are different in
719 \fBpcre2grep\fP. For example, the \fB--include\fP option's argument is a glob
720 for GNU \fBgrep\fP, but a regular expression for \fBpcre2grep\fP. If both the
721 \fB-c\fP and \fB-l\fP options are given, GNU grep lists only file names,
722 without counts, but \fBpcre2grep\fP gives the counts as well.
725 .SH "OPTIONS WITH DATA"
728 There are four different ways in which an option with data can be specified.
729 If a short form option is used, the data may follow immediately, or (with one
730 exception) in the next command line item. For example:
735 The exception is the \fB-o\fP option, which may appear with or without data.
736 Because of this, if data is present, it must follow immediately in the same
737 item, for example -o3.
739 If a long form option is used, the data may appear in the same command line
740 item, separated by an equals character, or (with two exceptions) it may appear
741 in the next command line item. For example:
746 Note, however, that if you want to supply a file name beginning with ~ as data
747 in a shell command, and have the shell expand ~ to a home directory, you must
748 separate the file name from the option, because the shell does not treat ~
749 specially unless it is at the start of an item.
751 The exceptions to the above are the \fB--colour\fP (or \fB--color\fP) and
752 \fB--only-matching\fP options, for which the data is optional. If one of these
753 options does have data, it must be given in the first form, using an equals
754 character. Otherwise \fBpcre2grep\fP will assume that it has no data.
757 .SH "USING PCRE2'S CALLOUT FACILITY"
760 \fBpcre2grep\fP has, by default, support for calling external programs or
761 scripts or echoing specific strings during matching by making use of PCRE2's
762 callout facility. However, this support can be disabled when \fBpcre2grep\fP is
763 built. You can find out whether your binary has support for callouts by running
764 it with the \fB--help\fP option. If the support is not enabled, all callouts in
765 patterns are ignored by \fBpcre2grep\fP.
767 A callout in a PCRE2 pattern is of the form (?C<arg>) where the argument is
768 either a number or a quoted string (see the
772 documentation for details). Numbered callouts are ignored by \fBpcre2grep\fP;
773 only callouts with string arguments are useful.
776 .SS "Calling external programs or scripts"
779 If the callout string does not start with a pipe (vertical bar) character, it
780 is parsed into a list of substrings separated by pipe characters. The first
781 substring must be an executable name, with the following substrings specifying
784 executable_name|arg1|arg2|...
786 Any substring (including the executable name) may contain escape sequences
787 started by a dollar character: $<digits> or ${<digits>} is replaced by the
788 captured substring of the given decimal number, which must be greater than
789 zero. If the number is greater than the number of capturing substrings, or if
790 the capture is unset, the replacement is empty.
792 Any other character is substituted by itself. In particular, $$ is replaced by
793 a single dollar and $| is replaced by a pipe character. Here is an example:
795 echo -e "abcde\en12345" | pcre2grep \e
797 (?C"/bin/echo|Arg1: [$1] [$2] [$3]|Arg2: $|${1}$| ($4)")()' -
801 Arg1: [a] [bcd] [d] Arg2: |a| ()
803 Arg1: [1] [234] [4] Arg2: |1| ()
806 The parameters for the \fBexecv()\fP system call that is used to run the
807 program or script are zero-terminated strings. This means that binary zero
808 characters in the callout argument will cause premature termination of their
809 substrings, and therefore should not be present. Any syntax errors in the
810 string (for example, a dollar not followed by another character) cause the
811 callout to be ignored. If running the program fails for any reason (including
812 the non-existence of the executable), a local matching failure occurs and the
813 matcher backtracks in the normal way.
816 .SS "Echoing a specific string"
819 If the callout string starts with a pipe (vertical bar) character, the rest of
820 the string is written to the output, having been passed through the same escape
821 processing as text from the --output option. This provides a simple echoing
822 facility that avoids calling an external program or script. No terminator is
823 added to the string, so if you want a newline, you must include it explicitly.
824 Matching continues normally after the string is output. If you want to see only
825 the callout output but not any output from an actual match, you should end the
826 relevant pattern with (*FAIL).
829 .SH "MATCHING ERRORS"
832 It is possible to supply a regular expression that takes a very long time to
833 fail to match certain lines. Such patterns normally involve nested indefinite
834 repeats, for example: (a+)*\ed when matched against a line of a's with no final
835 digit. The PCRE2 matching function has a resource limit that causes it to abort
836 in these circumstances. If this happens, \fBpcre2grep\fP outputs an error
837 message and the line that caused the problem to the standard error stream. If
838 there are more than 20 such errors, \fBpcre2grep\fP gives up.
840 The \fB--match-limit\fP option of \fBpcre2grep\fP can be used to set the
841 overall resource limit. There are also other limits that affect the amount of
842 memory used during matching; see the discussion of \fB--heap-limit\fP and
843 \fB--depth-limit\fP above.
849 Exit status is 0 if any matches were found, 1 if no matches were found, and 2
850 for syntax errors, overlong lines, non-existent or inaccessible files (even if
851 matches were found in other files) or too many matching errors. Using the
852 \fB-s\fP option to suppress error messages about inaccessible files does not
853 affect the return code.
855 When run under VMS, the return code is placed in the symbol PCRE2GREP_RC
856 because VMS does not distinguish between exit(0) and exit(1).
862 \fBpcre2pattern\fP(3), \fBpcre2syntax\fP(3), \fBpcre2callout\fP(3).
870 University Computing Service
879 Last updated: 24 February 2018
880 Copyright (c) 1997-2018 University of Cambridge.
projects / ossec-hids.git / blob