Learn › Linux Foundations › Bash Shell Environment

Reverse Search (Ctrl-R)

Ctrl-R - a hands-on Linux lab on a real virtual machine.

Find any command you ran before with Ctrl-R, an incremental reverse search of your shell history. Learn the reverse-i-search frame, the four keys that finish the search (next match, run, edit, cancel), and how it relates to history and history grep. Ctrl-R is a keystroke: this lesson teaches the keypress and its neighbours, then the capstone lets you press it for real.

Yesterday you ran a long command. A grep with a full path, or a curl with a dozen flags. It worked. Today you need it again, and it is buried somewhere in the hundreds of commands you have typed since.

You could press the Up arrow forty times, watching each old command flash past. You could dig through the numbered history list by eye. Both work. Both are slow. There is a faster way, and it is a single keystroke: hold Control and press R.

The black boxes in this lesson are a practice terminal: a safe sandbox that checks the one command each step teaches. Ctrl-R is not a command you type, it is a live keystroke, and a static box cannot run a keypress. So this lesson teaches the keypress in words and shows you the exact frame it draws. Then it lets you practice its two neighbours, history and history | grep, in the sandbox. On the real machine at the end of the module, you press Ctrl-R for yourself.

Ctrl-R starts a reverse search: an incremental search backward through your command history. Reverse means it looks from your most recent command toward your oldest. Incremental means it narrows the match as you type, letter by letter, without waiting for Enter.

You press Ctrl-R, then type a few characters from a command you ran before. Bash finds the most recent command that contains those characters anywhere in the line and shows it to you. Type more characters and the match narrows. Press Enter and that command runs.

This is the fast lane back to a past command, and it matches any part of the line, not just the start. Think of the three ways to reach an old command as a ladder. history prints the whole numbered list to scan by eye. The Up arrow walks that list one command at a time. Ctrl-R searches it. Ctrl-R is the search.

When you press Ctrl-R, your normal prompt is replaced by a special search prompt. It has three parts: the label reverse-i-search, then the text you have typed so far between backticks, then a colon, then the matched command. Watch what happens after you press Ctrl-R and type the four letters grep:

(reverse-i-search)`grep': grep ERROR /var/log/access.log

Read that left to right. (reverse-i-search) is bash telling you the search is live. ` grep' ` is what you typed, the four letters, shown between a backtick and a single quote. After the colon is the winner: the most recent command in your history that contains grep`. You have not pressed Enter yet. Nothing has run. Bash is just showing you the best match so far.

You do not need the start of the command. Reverse search matches any substring, anywhere in the line. Typing access would find that same grep ERROR /var/log/access.log, because the letters access appear inside it. Pick the most memorable, most unusual fragment of the command and type that.

Once a match is showing, four keys decide what happens next. This is the whole workflow, and it is worth committing to memory before you ever touch the key:

The one to respect is Enter. It runs the command the instant you press it, with no second chance to look. If the match is what you want, that is perfect. If you want to check it first, or change one flag, press the Right arrow instead: the command drops onto your command line, cursor ready, and it does NOT run until you decide.

Enter runs the shown command right away. Most engineers get bitten by this once: they search, the first match is close but not exactly right, they hit Enter out of habit, and the wrong command runs. When in doubt, press the Right arrow to move the match onto your line, read it, then run it. The arrow is your review step.

Reverse search does not invent commands. It searches the same history the history command prints: the running record of what you have typed in this shell. Before you can trust the search, it helps to see the list it searches. Type history now:

history

prompt: student@linuxcamp:~$ answer: history output: 1 grep ERROR /var/log/access.log 2 echo "Linux is awesome" 3 history hint: Just the one word and Enter: history

Every line is one command you ran, oldest at the top, newest at the bottom, each with a number on the left. This is exactly the pile Ctrl-R searches, only Ctrl-R searches it from the bottom up (newest first) and matches on the text instead of the number. Your own list will be longer and full of your own commands, but the shape is the same: a numbered log of your past, kept in the memory of this shell.

There is a second way to search history, and it is worth knowing because it does the opposite job. Ctrl-R is interactive: it shows you one match at a time and lets you run it. Sometimes you want the other thing, EVERY match at once, laid out to read. For that you send the history list into grep, the line-search tool, with a pipe.

A pipe is the | character. It takes the output of the command on its left and feeds it as input to the command on its right. Full lesson on pipes comes later. For now, read history | grep grep as: print the history, then keep only the lines that contain the word grep.

history | grep grep

prompt: student@linuxcamp:~$ answer: history | grep grep output: 1 grep ERROR /var/log/access.log hint: Type history, a space, a pipe with spaces around it, then grep and the word to find: history | grep grep

There it is: every history line containing grep, printed together instead of one at a time. That is the trade. Ctrl-R is fastest when you want to run one command right now. history | grep <word> is better when you want to SEE all the matches and their numbers first. Most engineers use both: Ctrl-R for quick recall, history | grep when they want the full picture.

Type letters that match no command and the search does not error out, it changes its own label to warn you. The prompt gains the word failing in front. Say your history holds no command with the letters zzz. After Ctrl-R and typing zzz, the frame reads:

(failing reverse-i-search)`zzz':

The failing in front means no command matches what you have typed. Notice there is nothing after the colon: no match to show. The fix is simple. Backspace to remove a letter or two, or type a different fragment, and the moment your text matches something again the failing disappears and the match returns. If you are stuck, Ctrl-G cancels the whole search and hands you back a clean, empty line.

Scaffolding off. No command is printed this time. You have every piece you need.

You want to see, all at once, every command in your history that contains the word echo, with their numbers, so you can read them before running anything. Not the interactive one-at-a-time search, the full printed list filtered down to just the echo lines.

prompt: student@linuxcamp:~$ answer: history | grep echo output: 2 echo "Linux is awesome" hint: Print the history, then pipe it into grep with the word you want kept. Think history, a padded pipe, grep, then echo.

That is the everyday move for reading history in bulk. history produced the numbered list, the pipe | carried it into grep, and grep echo kept only the lines with echo in them. You get every match and its number, ready to read. When instead you want to run one of those commands right now without reading the rest, that is the moment for Ctrl-R, echo, Enter. Same history, two tools, and you chose by memory which one fits.

You earned this cheat sheet. The top rows are the Ctrl-R keystrokes you now know; the bottom rows are the two commands you just practiced:

The mental model to keep: history is the list, the Up arrow walks it one step at a time, and Ctrl-R searches it. When you need a command you ran before, the fastest path is Ctrl-R, a memorable fragment, then Enter.

Reverse search reads the history in the memory of the shell you are typing in. A command you ran an hour ago in a different terminal window may not be there yet. If Ctrl-R cannot find something you are sure you ran, check that you ran it in this same shell.

The practice terminal has shown you the shape of reverse search. You know the frame Ctrl-R draws, the four keys that finish it, and the two history commands that sit either side of it. The history and history | grep drills you typed yourself.

The Bash Environment module ends with one real Linux machine, the Bash Environment capstone mission, and that is where you press Ctrl-R for real. A VM boots just for you, with its own live history. It hands you objectives that use exactly what you practiced across this module: variables, aliases, the environment, and recalling the commands you ran. One difference from here: the mission shows no commands. You read the objective, you recall the move, you type it or press it. That recall is what makes it stick.

Finish the other Bash Environment lessons, then go pull a command out of your own history for yourself.

Practice Reverse Search (Ctrl-R) in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.