Fast Search for SysAdmins — grep That Gets Out of Your Way
ripgrep (command: rg) is a line-oriented search tool
that recursively searches directories for a regex pattern. It is built on Rust and is
significantly faster than grep, egrep, and most other search
tools for typical SysAdmin workloads.
The speed is real and measurable, but speed is not the only reason to use it. ripgrep
has sensible defaults that eliminate most of the flags you habitually type with grep:
it searches recursively by default, skips binary files, skips hidden files, respects
.gitignore, and colorizes output automatically. It does what you meant,
not just what you typed.
For AI-assisted SysAdmin work, ripgrep is a natural feed tool — fast extraction
of relevant log lines, config values, or code patterns that you then pipe to
sgpt or fabric for analysis. When you need to find something
before asking AI about it, rg is how you find it.
sudo dnf install ripgrepsudo apt install ripgrep# Get the latest release for x86_64 Linux
curl -LO https://github.com/BurntSushi/ripgrep/releases/latest/download/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz
tar xzf ripgrep-*.tar.gz
sudo cp ripgrep-*/rg /usr/local/bin/rg --version
# ripgrep 14.1.1 (rev e50df40a19)dnf. No EPEL required. If your system is older and dnf comes up empty,
use the GitHub release binary above — it is statically linked and runs anywhere.
# Search for a pattern in current directory (recursive by default)
rg "pattern"
# Search in a specific directory
rg "pattern" /var/log/
# Search a specific file
rg "pattern" /etc/httpd/conf/httpd.conf
# Case-insensitive search
rg -i "error" /var/log/messages
# Show line numbers (on by default when output is a terminal)
rg -n "pattern" file.log
# Show N lines of context around each match
rg -C 3 "OOM killer" /var/log/messages| Behavior | grep | ripgrep (rg) |
|---|---|---|
| Recursive search | grep -r required |
Recursive by default |
| Binary files | Searches them (garbled output) | Skips automatically |
| Hidden files/dirs | Searches them | Skips by default (--hidden to include) |
| .gitignore | Ignores it | Respects it automatically |
| Color output | Needs --color=always |
Automatic when terminal |
| Speed on large trees | Baseline | 3–10x faster typical |
| Regex engine | POSIX / PCRE2 (varies) | Rust regex (fast, safe) |
| Flag | What it does |
|---|---|
-i |
Case-insensitive match |
-l |
List matching filenames only (no content) |
-c |
Count of matching lines per file |
-n |
Show line numbers |
-C N |
N lines of context before and after match |
-B N |
N lines before match |
-A N |
N lines after match |
-t TYPE |
Search only files of a given type (-t html, -t sh) |
-g GLOB |
Include/exclude files matching a glob (-g '*.log') |
-v |
Invert match (lines that do NOT match) |
-w |
Match whole words only |
--hidden |
Include hidden files and directories |
-o |
Print only the matching part of the line |
--no-heading |
Suppress filename grouping (grep-style output) |
# Find all error entries in the last hour's logs
rg "error|ERROR|Error" /var/log/messages
# Find OOM killer events with context
rg -C 5 "Out of memory" /var/log/messages
# Search all httpd logs for 500 errors
rg " 500 " /var/log/httpd/
# Find authentication failures across auth logs
rg "Failed password|authentication failure" /var/log/secure
# Count errors per log file
rg -c "error" /var/log/# Find all Listen directives across Apache configs
rg "^Listen" /etc/httpd/
# Find all PermitRootLogin settings in SSH configs
rg "PermitRootLogin" /etc/ssh/
# Search all cron entries for a specific script
rg "backup.sh" /etc/cron* /var/spool/cron/
# Find any config file referencing an old server hostname
rg "old-server-name" /etc/
# Audit all sudoers for NOPASSWD entries
rg "NOPASSWD" /etc/sudoers /etc/sudoers.d/# Find all bash scripts containing a function name
rg "check_disk" /opt/scripts/
# Search only shell scripts (by type)
rg -t sh "TODO\|FIXME\|HACK" /opt/
# Find hardcoded IP addresses in configs and scripts
rg '\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b' /etc/ /opt/scripts/
# List files containing a deprecated function call
rg -l "old_function_name" /opt/myapp/# Search logs on a remote server
ssh admin@server01 "rg 'disk full' /var/log/messages"
# Check a config value across a fleet (with ansible)
ansible all -m shell -a "rg 'max_connections' /etc/mysql/my.cnf" 2>/dev/null# Which config files reference this database host?
rg -l "db-prod-01" /etc/
# Which scripts use this deprecated variable?
rg -l "OLD_VAR_NAME" /opt/scripts/
# List all HTML files containing a broken link pattern
rg -l "href=\"http://old-domain" /var/www/html/# ripgrep does not natively search .gz files
# Use zcat to feed it:
zcat /var/log/messages-20260323.gz | rg "kernel panic"
# Or search the uncompressed logs and pipe compressed ones separately
rg "kernel panic" /var/log/messages
zcat /var/log/messages*.gz | rg "kernel panic"zcat or zgrep. For everything else,
rg is the better tool.
ripgrep's role in the AI toolchain is as a precision feed tool. You use it to extract exactly the right content before handing it to an AI tool for analysis. Fast, targeted extraction means you are not feeding AI thousands of irrelevant log lines.
# Pull relevant log lines and ask AI to explain them
rg -C 2 "segfault" /var/log/messages | sgpt "What is causing these segfaults and what should I check first?"
# Find all 500 errors and ask for root cause patterns
rg " 500 " /var/log/httpd/access_log | sgpt "Identify any patterns in these HTTP 500 errors"
# Extract failed login attempts and summarize
rg "Failed password" /var/log/secure | sgpt "Summarize these failed login attempts — are there attack patterns?"# Extract errors and run through a fabric analysis pattern
rg "ERROR\|CRITICAL" /var/log/myapp.log | fabric -p analyze_logs
# Pull config drift and summarize
rg -v "^#\|^$" /etc/httpd/conf/httpd.conf | fabric -p summarize# Interactively select which log file to search, then search it
ls /var/log/*.log | fzf | xargs rg "error"
# Browse ripgrep results interactively
rg "pattern" /var/log/ | fzf# On a server with no external internet — use local LLM
rg "OOM\|out of memory" /var/log/messages | \
sgpt --api-host http://localhost:11434 "Explain these memory events and suggest remediation"AI tools have context limits and cost money per token. Feeding a 50,000 line log file to sgpt is wasteful and often counterproductive — the signal gets lost in the noise. ripgrep lets you extract the 40 relevant lines before the AI ever sees the data.
# Bad — feeds everything to AI
cat /var/log/messages | sgpt "find the errors"
# Good — ripgrep extracts signal first
rg -C 3 "error|CRITICAL|panic" /var/log/messages | sgpt "analyze these errors"ripgrep reads a config file if you set the RIPGREP_CONFIG_PATH environment
variable. A minimal config for SysAdmin work:
# ~/.ripgreprc
# Always show line numbers
--line-number
# Follow symlinks
--follow
# Increase max filesize searched (default 500MB)
--max-filesize=1G
# Smart case: case-insensitive unless pattern has uppercase
--smart-case# Add to ~/.bashrc or ~/.bash_profile
export RIPGREP_CONFIG_PATH="$HOME/.ripgreprc"--smart-case is the most useful default to set. It makes rg "error"
case-insensitive while rg "ERROR" remains case-sensitive. Matches how
most people actually think about searching.
grep -r and rg is immediately noticeable.
Not a benchmark curiosity — you feel it in daily use.--no-heading and
--with-filename flags to match expected format..gz log
archives, you still need zcat or zgrep. Not a dealbreaker
but worth knowing before you wonder why rg misses rotated logs..gitignore. Use --no-ignore
to override when you need to search everything.ripgrep earns a place in your baseline toolkit. It is not a dramatic workflow change — you already know how to use grep, and rg feels immediately familiar. The payoff is accumulated over hundreds of searches: faster results, less flag typing, cleaner output, and a natural fit as the extraction layer before AI analysis.
Replace your habitual grep -r with rg and within a week
you will not go back.