1、awk
In some scenarios, we need to filter the column is the way you want to match, instead of the line to match sed, awk and so on can also be nested for loop to use, strong expansion, of course, awk is also the most difficult.
Common awk command options:
- FS -F FS specified delimiter input, fs can be a string or a regular expression, such as -F:
- -v var = value assigned a user-defined variable, the external variables passed to awk
- -f scripfile read the awk command from a script file
- -m [fr] val disposed inherent limit value val, -mf option limits the maximum number of blocks allocated to the val; -mr option limits the maximum number of records. These two features are extensions Bell Laboratories version of awk, awk does not apply in the standard.
awk built-in variables:
- FS or save set separators, e.g. FS = ",";
- N $ N of the specified delimiter field, for example, $ 1, $ 5 representing the first and third columns;
- $ 0 Current reading the entire line of text;
- NF recording current field treatments row (column) number;
- NR current process the number of recording lines;
- FNR process to save the current line number in the present text line;
- Text name FILENAME currently being processed;
- ENVIRON call the shell environment variables.
1, column basic query
[root@aly-centos7 /]# awk '{print $0}' passwd4 #$0代表整列
root x:0:0:root:/root:/bin/bash
bin x:1:1:bin:/bin:/sbin/nologin
daemon x:2:2:daemon:/sbin:/sbin/nologin
adm x:3:4:adm:/var/adm:/sbin/nologin
lp x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync x:5:0:sync:/sbin:/bin/sync
%shutdown x:6:0:shutdown:/sbin:/sbin/shutdown
$halt:x:7:0:halt:/sbin:/sbin/halt
#$mail x:8:12:mail:/var/spool/mail:/sbin/nologin
operator x:11:0:operator:/root:/sbin/nologin
567890
543210
[root@aly-centos7 /]# awk '{print $1}' passwd4 #$1代表第一列
root
bin
daemon
adm
lp
sync
%shutdown
$halt:x:7:0:halt:/sbin:/sbin/halt
# $ mail
operator
9876
2, the filter current memory
To view the remaining memory is the first of the field Mark, and mark this line taken out with grep, awk finally taken out of this line of columns plus a readability statement to the
[root @ aly-centos7 /] # free | grep Mem | awk '{print " current remaining memory: \ n", $ 7} '
current remaining memory:
1408424
3, access ip filter
/ var / log / secure information access for the record, you can look through the log out if subjected to malicious attacks
[root @ aly-centos7 /] # grep "Accepted" / var / log / secure | awk '{print 11} $ '
101.95.130.134
101.95.130.134
101.95.130.134
101.95.130.134
101.95.130.134
101.95.130.134
101.95.130.134
101.95.130.134
[root @ ALY-centos7 /] #
by filtration I know that ip access, but access to ip lot number, while the production server ip access are fixed, usually there is a documented, so you can write a script and filtered ip than those who are not registered can be disposed of.
4, statistics how many columns per row (NF)
[root@aly-centos7 /]# awk '{print NF}' passwd4
2
2
2
2
2
2
2
1
2
2
2
2
[root@aly-centos7 /]# cat passwd4
root x:0:0:root:/root:/bin/bash
bin x:1:1:bin:/bin:/sbin/nologin
daemon x:2:2:daemon:/sbin:/sbin/nologin
adm x:3:4:adm:/var/adm:/sbin/nologin
lp x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync x:5:0:sync:/sbin:/bin/sync
%shutdown x:6:0:shutdown:/sbin:/sbin/shutdown
$halt:x:7:0:halt:/sbin:/sbin/halt
#$mail x:8:12:mail:/var/spool/mail:/sbin/nologin
operator x:11:0:operator:/root:/sbin/nologin
1234 567890
9876 543210
5, respectively, more than one file statistics how many lines (NFR)
[root@aly-centos7 /]# awk '{print FNR}' passwd3 passwd4
1
2
3
4
5
6
7
8
9
10
1
2
3
4
5
6
7
8
9
10
11
12
6, the user uid statistical number of less than 30 and more than 30 more than the number of users (determined)
[root@aly-centos7 /]# awk -F: 'BEGIN{i=0;j=0}{if($3<=30){i++}else{j++}}END{print "<=30:"i,"\n",">=30:"j}' /etc/passwd
<=30:13
>=30:17
7, the number of specified fields appear (while loop)
[root@aly-centos7 /]# grep --color root /etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
dockerroot:x:993:991:Docker User:/var/lib/docker:/sbin/nologin
[root@aly-centos7 /]# awk -F[:/] '{i=1}{while(i<=NF){if($i~/root/){j++};i++}}END{print j}' /etc/passwd
5
8, the number of ip statistics appear
[root@aly-centos7 httpd]# tail -10 access_log
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
172.16.163.69 - - [24/Jul/2018:13:39:12 +0800] "GET / HTTP/1.0" 403 4897 "-" "ApacheBench/2.3"
[root@aly-centos7 httpd]# awk '{ip[$1]++} END{for(i in ip){print i,ip[i]}}' /var/log/httpd/access_log
172.16.163.69 1000
2, but
Because too many parameters, individuals listed are the commonly used parameters
- a: new, can take back a string, and those strings come (currently the next row) in a new line ~
- c: substituted, may be connected to the back c string, these strings can be substituted n1, N2 between the line!
- d: Delete, because it is deleted ah, so usually not connected to any later d pat;
- i: insert, i can take back the string, which string appears (the line current) is a new line;
- p: print, that will print a selection of data. P will usually run together with the parameters sed -n ~
- s: replace, the work can be substituted directly miles! Usually this s action can be used with regular expression! E.g. 1,20s / old / new / g
1, the contents of the specified line range to find the beginning of the root
[@ ALY-centos7 the root /] -n # Sed '{l, 5 / ^ the root / P}' passwd2 the root: X: 0: 0: the root: / the root: / bin / the bash
2, after matching lines increase the display content
[the root @ ALY-centos7 /] # CAT passwd3 the root: X: 0: 0: the root: / the root: / bin / the bash bin: X:. 1:. 1: bin: / bin: / sbin / nologin daemon: X: 2: 2: daemon: / sbin: / sbin / nologin ADM: X:. 3:. 4: ADM: / var / ADM: / sbin / nologin operator: X:. 11: 0: operator: / the root: / sbin / nologin the root, the root root123 [@ ALY-centos7 the root /] # Sed -n '/ 3 /, $ P' passwd3 display # 3 to the first match line to the output line of the most adm: X:. 3:. 4: ADM: / var / ADM: / sbin / nologin operator: X:. 11: 0: operator: / the root: / sbin / nologin the root, the root root123 [@ ALY-centos7 the root /] -n # Sed '/ 3 /, + 1p' passwd3 # to display the first match line output downwardly 3-1 ADM: X:. 3:. 4: ADM: / var / adm: / sbin / nologin operator:x:11:0:operator:/root:/sbin/nologin root123 [root@aly-centos7 /]#
3、文本逆向排序输出
[root@aly-centos7 /]# cat passwd2 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# sed '1!G;h;$!d' passwd2 #逆向排序 operator:x:11:0:operator:/root:/sbin/nologin mail:x:8:12:mail:/var/spool/mail:/sbin/nologin halt:x:7:0:halt:/sbin:/sbin/halt shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown sync:x:5:0:sync:/sbin:/bin/sync lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin bin:x:1:1:bin:/bin:/sbin/nologin root:x:0:0:root:/root:/bin/bash [root@aly-centos7 /]#
4, the display line number (blank line is also shown), or (blank line without line number)
operator: X:. 11: 0: operator: / the root: / sbin / nologin [the root @ ALY-centos7 /] # [the root @ ALY -centos7 /] # CAT passwd2 the root: X: 0: 0: the root: / the root: / bin / the bash bin: X:. 1:. 1: bin: / bin: / sbin / nologin daemon: X: 2: 2: daemon : / sbin: / sbin / nologin ADM: X:. 3:. 4: ADM: / var / ADM: / sbin / nologin LP: X:. 4:. 7: LP: / var / spool / LPD: / sbin / nologin Sync: X:. 5: 0: Sync: / sbin: / bin / Sync the shutdown: X:. 6: 0: the shutdown: / sbin: / sbin / the shutdown HALT: X:. 7: 0: HALT: / sbin: / sbin / HALT mail : X:. 8: 12 is: mail: / var / spool / mail: / sbin / nologin operator: X:. 11: 0: operator: / the root: / sbin / nologin [the root @ ALY-centos7 /] # Sed '=' passwd2 # blank lines does not mask the root: X: 0: 0: the root: / the root: / bin / the bash bin: X:. 1:. 1: bin: / bin: / sbin / nologin daemon: X: 2: 2: daemon: / sbin: / sbin / nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# sed '/./=' passwd2 #屏蔽空行 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown HALT: X:. 7: 0: HALT: / sbin: / sbin / HALT mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator: X:. 11: 0: operator: / the root: / sbin / nologin . 5, displaying the file number of rows [root @ aly-centos7 /] # grep -n "" passwd3 . 1: the root: X: 0: 0: the root: / the root: / bin / the bash 2: bin: X:. 1:. 1: bin: / bin: / sbin / nologin . 3: daemon: X: 2 : 2: daemon: / sbin: / sbin / nologin . 4: ADM: X:. 3:. 4: ADM: / var / ADM: / sbin / nologin . 5: operator: X:. 11: 0: operator: / the root: / sbin / nologin . 6: the root, the root . 7: root123 [root @ aly-centos7 /] -n # Sed '$ =' passwd3 [root @ aly-centos7 /] # . 6, the display even and odd lines [root @ aly-centos7 / ] -n # grep "" passwd3 . 1: the root: X: 0: 0: the root: / the root: / bin / the bash 2: bin: X:. 1:. 1: bin: / bin: / sbin / nologin . 3: daemon: X: 2: 2: daemon: / sbin: / sbin / nologin . 4: ADM: X:. 3:. 4: ADM: / var / ADM: / sbin / nologin
. 5: operator: X:. 11: 0: operator: / the root: / sbin / nologin . 6: the root, the root 7:root123 [root@aly-centos7 /]# sed -n 'p;n' passwd3 #奇数行 root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin root123 [root@aly-centos7 /]# sed -n '1~2p' passwd3 #奇数行 root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin root123 [root@aly-centos7 /]# sed -n 'n;p' passwd3 #偶数行 bin:x:1:1:bin:/bin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin root,root [root@aly-centos7 /]# sed -n '2~2p' passwd3 #偶数行 bin:x:1:1:bin:/bin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin root,root [root@aly-centos7 /]#
7、文件中每行内容逆向显示
[root@aly-centos7 /]# cat passwd2 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync %shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown $halt:x:7:0:halt:/sbin:/sbin/halt #$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin 9876543210 [root@aly-centos7 /]# sed '/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//' passwd2 hsab/nib/:toor/:toor:0:0:x:toor nigolon / NIBS /: the nib /: the nib:. 1:. 1: X: the nib nigolon / NIBS /: NIBS /: nomead: 2: 2: X: nomead nigolon / NIBS /: MDA / RAV /: MDA:. 4:. 3: X: MDA nigolon / NIBS /: DPL / Loops / RAV /: PL:. 7:. 4: X: PL cnys / the nib /: NIBS /: cnys: 0:. 5: X: cnys nwodtuhs / NIBS /: NIBS /: nwodtuhs : 0:. 6: X: nwodtuhs% tlah / NIBS /: NIBS /: tlah: 0:. 7: X: tlah $ nigolon / NIBS /: Liam / Loops / RAV /: Liam: 21 is:. 8: X: Liam $ # nigolon / NIBS /: toor /: rotarepo: 0:. 11: X: rotarepo 0123456789 [@ ALY-centos7 the root /] # . 8, in accordance with the number "ten-hundred" Show
[root@aly-centos7 /]# cat passwd2
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
%shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
$ Halt: x: 7: 0: wait: / sbin: / sbin / halt
#$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
9876543210
[root@aly-centos7 /]# sed ':a;s/\B[0-9]\{3\}\>/,&/;ta' passwd2
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
%shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
$halt:x:7:0:halt:/sbin:/sbin/halt
#$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
1,234,567,890
9,876,543,210
[root@aly-centos7 /]#
9、删除指定内容
删除1-5行内容 [root@aly-centos7 /]# grep -n "" passwd2 | sed '1,5d' 6:sync:x:5:0:sync:/sbin:/bin/sync 7:%shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown 8:$halt:x:7:0:halt:/sbin:/sbin/halt 9:#$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin 10: 11: 12:operator:x:11:0:operator:/root:/sbin/nologin 13:1234567890 14:9876543210 删除奇数行： [root@aly-centos7 /]# grep -n "" passwd2 | sed '1~2d' 2:bin:x:1:1:bin:/bin:/sbin/nologin 4:adm:x:3:4:adm:/var/adm:/sbin/nologin 6:sync:x:5:0:sync:/sbin:/bin/sync 8:$halt:x:7:0:halt:/sbin:/sbin/halt 10: 12:operator:x:11:0:operator:/root:/sbin/nologin 14:9876543210 删除空行 [root@aly-centos7 /]# grep -n "" passwd2 1:root:x:0:0:root:/root:/bin/bash 2:bin:x:1:1:bin:/bin:/sbin/nologin 3:daemon:x:2:2:daemon:/sbin:/sbin/nologin 4:adm:x:3:4:adm:/var/adm:/sbin/nologin 5:lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin 6:sync:x:5:0:sync:/sbin:/bin/sync 7:%shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown 8:$halt:x:7:0:halt:/sbin:/sbin/halt 9:#$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin 10: 11: 12:operator:x:11:0:operator:/root:/sbin/nologin 13:1234567890 14:9876543210 [root@aly-centos7 /]# grep "" passwd2 | sed '/^$/d' root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync %shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown $halt:x:7:0:halt:/sbin:/sbin/halt #$mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin 9876543210 [root@aly-centos7 /]# 10、指定内容进行替换
将root全部替换成mysql [root@aly-centos7 /]# grep -n "" passwd3 1:root:x:0:0:root:/root:/bin/bash 2:bin:x:1:1:bin:/bin:/sbin/nologin 3:daemon:x:2:2:daemon:/sbin:/sbin/nologin 4:adm:x:3:4:adm:/var/adm:/sbin/nologin 5:operator:x:11:0:operator:/root:/sbin/nologin 6:root,root 7:root123 [root@aly-centos7 /]# sed 's/root/mysql/g' passwd3 mysql:x:0:0:mysql:/mysql:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/mysql:/sbin/nologin mysql,mysql mysql123 把数字1全部替换成9 [root@aly-centos7 /]# sed 's/1/9/g' passwd3 root:x:0:0:root:/root:/bin/bash bin:x:9:9:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:99:0:operator:/root:/sbin/nologin root,root root923 只替换行中未出现“sbin”字符的时候，将”root“替换成”nginx“ [root@aly-centos7 /]# sed '/sbin/!s/root/nginx/g' passwd3 nginx:x:0:0:nginx:/nginx:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin nginx,nginx nginx123 root:x:11:0:operator:/root:/sbin/nologin root1:x:11:0:operator:/root:/sbin/nologin root2:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]#
3、grep
grep [-abcEFGhHilLnqrsvVwxy][-A<显示列数>][-B<显示列数>][-C<显示列数>][-d<进行动作>][-e<范本样式>][-f<范本文件>][--help][范本样式][文件或目录...]
1、查找指定进程和个数
[root@aly-centos7 /]# ps -ef | grep nginx
root 14475 14272 0 13:21 pts/0 00:00:00 grep --color=auto nginx [root@aly-centos7 /]# ps -ef | grep -c nginx
2、查看多个文件相同的部分
文件内容： [root@aly-centos7 /]# cat passwd1 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin systemd-bus-proxy:x:999:998:systemd Bus Proxy:/:/sbin/nologin systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin polkitd:x:998:997:User for polkitd:/:/sbin/nologin tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin [root@aly-centos7 /]# cat passwd2 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]#cat passwd3 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin 过滤结果： [root@aly-centos7 /]# cat passwd1 | grep -f passwd2 | grep -f passwd3 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# 最后结果显示三个文件相同的部分
3、从单个和多个文件查找指定内容并显示行号
[root@aly-centos7 /]# cat passwd2 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# cat passwd3 bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin root,root root123 [root@aly-centos7 /]# grep -n "root" passwd2 1:root:x:0:0:root:/root:/bin/bash 10:operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# grep -n "root" passwd2 passwd3 passwd2:1:root:x:0:0:root:/root:/bin/bash passwd2:10:operator:x:11:0:operator:/root:/sbin/nologin passwd3:1:root:x:0:0:root:/root:/bin/bash passwd3:5:operator:x:11:0:operator:/root:/sbin/nologin passwd3:6:root,root passwd3:7:root123 [root@aly-centos7 /]#
4、指定字符查找开头，非开头，结尾的内容
[root@aly-centos7 /]# grep "^r" passwd3 #查找指定字符开头 root:x:0:0:root:/root:/bin/bash root,root root123 [root@aly-centos7 /]# grep "^[^r]" passwd3 #查找非指定字符开头 bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]# grep "n$" passwd3 #查找指定结尾 bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin [root@aly-centos7 /]#
5、过滤指定日志里面的ip个数
[root@aly-centos7 /]#cat qq.log | grep -c "[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" 130205
6、过滤指定路径下所以文件里面包含指定字符内容
[root@aly-centos7 /]# grep -r -n "root" /etc/
/etc/logrotate.d/ppp:9: create 0600 root root
/etc/logrotate.d/mysql:9:# In case the root user has a password, then you
/etc/logrotate.d/mysql:10:# have to create a /root/.my.cnf configuration file
/etc/logrotate.d/mysql:15:# user= root
/etc/logrotate.d/mysql:19:# ATTENTION: The /root/.my.cnf file should be readable
/etc/logrotate.d/mysql:20:# _ONLY_ by root !
/etc/logrotate.d/mysql-mmm:8: create 640 root adm
/etc/logrotate.d/wpa_supplicant:5: create 0600 root root
/etc/logrotate.d/yum:6: create 0600 root root
/etc/rsyncd.conf:9:# use chroot = yes
/etc/statetab:5:# See $STATE_LABEL in /etc/sysconfig/readonly-root
/etc/statetab:9:# /root
/etc/group:1:root:x:0:
/etc/group:49:dockerroot:x:991:
/etc/passwd-:1:root:x:0:0:root:/root:/bin/bash
/etc/passwd-:10:operator:x:11:0:operator:/root:/sbin/nologin
Binary file /etc/aliases.db matches
/etc/mime.types:351:application/vnd.cyan.dean.root+xml
/etc/mime.types:382:application/vnd.dvb.notif-aggregate-root+xml
参考：https://www.cnblogs.com/ppc-srever/p/9322973.html