Linux系统——文本三剑客补充（写不进去了！）
模糊匹配
模糊匹配用~表示包含，!~表示不包含
1.匹配含有root的列
[root@localhost ~]#awk -F: '/root/' /etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[root@localhost ~]#awk -F: '$1~ /root/' /etc/passwd
#模糊匹配 只匹配第一列含有root 的行
root:x:0:0:root:/root:/bin/bash
[root@localhost ~]#awk -F: '$1~/ro/' /etc/passwd
#只要第一列有ro就匹配上
root:x:0:0:root:/root:/bin/bash
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
[root@localhost ~]#awk -F: '$7~/nologin/ {print $1,$7}' /etc/passwd
#只要第7列有nologin 就打印出第1列和第7列
bin /sbin/nologin
daemon /sbin/nologin
adm /sbin/nologin
lp /sbin/nologin
mail /sbin/nologin
operator /sbin/nologin
games /sbin/nologin
ftp /sbin/nologin
nobody /sbin/nologin
systemd-network /sbin/nologin
dbus /sbin/nologin
polkitd /sbin/nologin
abrt /sbin/nologin
libstoragemgmt /sbin/nologin
rpc /sbin/nologin
colord /sbin/nologin
saslauth /sbin/nologin
rtkit /sbin/nologin
pulse /sbin/nologin
chrony /sbin/nologin
rpcuser /sbin/nologin
nfsnobody /sbin/nologin
ntp /sbin/nologin
tss /sbin/nologin
usbmuxd /sbin/nologin
geoclue /sbin/nologin
qemu /sbin/nologin
radvd /sbin/nologin
setroubleshoot /sbin/nologin
sssd /sbin/nologin
gdm /sbin/nologin
gnome-initial-setup /sbin/nologin
sshd /sbin/nologin
avahi /sbin/nologin
postfix /sbin/nologin
tcpdump /sbin/nologin2.打印1-200之间所有能被7整除并且包含数字7的整数数字
[root@localhost ~]#seq 200
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
[root@localhost ~]#seq 200|awk '$1%7==0'
7
14
21
28
35
42
49
56
63
70
77
84
91
98
105
112
119
126
133
140
147
154
161
168
175
182
189
196
[root@localhost ~]#seq 200|awk '$1%7==0 && $1~/7/'
7
70
77
147
175
3.提取内存占用总内存的百分比
3.1方法一
[root@localhost ~]#free
total used free shared buff/cache available
Mem: 1867048 327804 654316 9324 884928 1312676
Swap: 4194300 0 4194300
[root@localhost ~]#free -m
total used free shared buff/cache available
Mem: 1823 320 638 9 864 1281
Swap: 4095 0 4095
[root@localhost ~]#free -m|awk '/Mem:/ {print int($3)}'
320
[root@localhost ~]#free -m|awk '/Mem:/ {print int($2)}'
1823
[root@localhost ~]#free -m|awk '/Mem:/ {print $3/$2}'
0.175535
[root@localhost ~]#free -m|awk '/Mem:/ {print ($3/$2)*100}'
17.5535
[root@localhost ~]#free -m|awk '/Mem:/ {print int($3/$2*100)"%"}'
17%3.2方法二
[root@localhost ~]#free
total used free shared buff/cache available
Mem: 1867048 327768 654332 9324 884948 1312712
Swap: 4194300 0 4194300
[root@localhost ~]#free -m
total used free shared buff/cache available
Mem: 1823 320 638 9 864 1281
Swap: 4095 0 4095
[root@localhost ~]#free -m|awk '/Mem:/ {print $3}'
320
[root@localhost ~]#free -m|awk '/Mem:/ {print $2}'
1823
[root@localhost ~]#free -m|awk '/Mem:/ {print $3/$2}'
0.175535
[root@localhost ~]#free -m|awk '/Mem:/ {print $3/$2*100}'
17.5535
[root@localhost ~]#free -m|awk '/Mem:/ {print $3/$2*100}'|awk -F. '{print $1}'
17
[root@localhost ~]#free -m|awk '/Mem:/ {print $3/$2*100}'|awk -F. '{print $1"%"}'
17%4.查看暴力破解密码主机的IP地址
4.1方法一 使用awk
[root@localhost ~]#cat /var/log/secure
Jan 28 16:08:24 localhost sshd[1631]: pam_unix(sshd:session): session closed for user root
Jan 28 16:18:53 localhost sshd[2343]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Jan 28 16:18:53 localhost sshd[2343]: pam_unix(sshd:session): session closed for user root
Jan 28 16:19:01 localhost polkitd[715]: Unregistered Authentication Agent for unix-session:c1 (system bus name :1.31, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Jan 29 08:03:36 localhost polkitd[708]: Loading rules from directory /etc/polkit-1/rules.d
Jan 29 08:03:36 localhost polkitd[708]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 29 08:03:37 localhost polkitd[708]: Finished loading, compiling and executing 8 rules
Jan 29 08:03:37 localhost polkitd[708]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 29 08:03:40 localhost sshd[1005]: Server listening on 0.0.0.0 port 22.
Jan 29 08:03:40 localhost sshd[1005]: Server listening on :: port 22.
Jan 29 08:03:42 localhost sshd[1074]: Accepted password for root from 192.168.241.1 port 61187 ssh2
Jan 29 08:03:42 localhost sshd[1074]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:03:53 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 29 08:04:10 localhost polkitd[708]: Registered Authentication Agent for unix-session:c1 (system bus name :1.35 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 29 20:19:31 localhost polkitd[708]: Unregistered Authentication Agent for unix-session:c1 (system bus name :1.35, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Jan 29 20:19:31 localhost sshd[1005]: Received signal 15; terminating.
Jan 30 07:47:05 localhost polkitd[705]: Loading rules from directory /etc/polkit-1/rules.d
Jan 30 07:47:05 localhost polkitd[705]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 30 07:47:06 localhost polkitd[705]: Finished loading, compiling and executing 8 rules
Jan 30 07:47:06 localhost polkitd[705]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 30 07:47:09 localhost sshd[1011]: Server listening on 0.0.0.0 port 22.
Jan 30 07:47:09 localhost sshd[1011]: Server listening on :: port 22.
Jan 30 07:47:22 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 30 07:47:30 localhost sshd[1535]: Accepted password for root from 192.168.241.1 port 52599 ssh2
Jan 30 07:47:30 localhost sshd[1535]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 30 07:47:40 localhost polkitd[705]: Registered Authentication Agent for unix-session:c1 (system bus name :1.32 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 30 20:32:34 localhost sshd[1535]: Exiting on signal 15
Jan 31 08:05:18 localhost polkitd[695]: Loading rules from directory /etc/polkit-1/rules.d
Jan 31 08:05:18 localhost polkitd[695]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 31 08:05:18 localhost polkitd[695]: Finished loading, compiling and executing 8 rules
Jan 31 08:05:18 localhost polkitd[695]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 31 08:05:19 localhost sshd[1005]: Server listening on 0.0.0.0 port 22.
Jan 31 08:05:19 localhost sshd[1005]: Server listening on :: port 22.
Jan 31 08:05:35 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 31 08:05:48 localhost polkitd[695]: Registered Authentication Agent for unix-session:c1 (system bus name :1.32 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 31 08:17:52 localhost sshd[1854]: Accepted password for root from 192.168.241.1 port 64889 ssh2
Jan 31 08:17:52 localhost sshd[1854]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 31 13:55:50 localhost sshd[5501]: Connection closed by 192.168.241.22 port 36182 [preauth]
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
Jan 31 13:55:55 localhost sshd[5503]: Connection closed by 192.168.241.22 port 36184 [preauth]
[root@localhost ~]#cat /var/log/secure|awk '/Failed/{print $11}'
Interrupted
192.168.241.22
192.168.241.22
[root@localhost ~]#cat /var/log/secure|awk '/Failed/{print $0}'
Jan 28 16:18:53 localhost sshd[2343]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
[root@localhost ~]#cat /var/log/secure|awk '/Failed/{print $11}'|sort -n
Interrupted
192.168.241.22
192.168.241.22
[root@localhost ~]#cat /var/log/secure|awk '/Failed/{print $11}'|sort -n|uniq -c
1 Interrupted
2 192.168.241.224.2使用循环
[root@localhost ~]#cat /var/log/secure
Jan 28 16:08:24 localhost sshd[1631]: pam_unix(sshd:session): session closed for user root
Jan 28 16:18:53 localhost sshd[2343]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Jan 28 16:18:53 localhost sshd[2343]: pam_unix(sshd:session): session closed for user root
Jan 28 16:19:01 localhost polkitd[715]: Unregistered Authentication Agent for unix-session:c1 (system bus name :1.31, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Jan 29 08:03:36 localhost polkitd[708]: Loading rules from directory /etc/polkit-1/rules.d
Jan 29 08:03:36 localhost polkitd[708]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 29 08:03:37 localhost polkitd[708]: Finished loading, compiling and executing 8 rules
Jan 29 08:03:37 localhost polkitd[708]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 29 08:03:40 localhost sshd[1005]: Server listening on 0.0.0.0 port 22.
Jan 29 08:03:40 localhost sshd[1005]: Server listening on :: port 22.
Jan 29 08:03:42 localhost sshd[1074]: Accepted password for root from 192.168.241.1 port 61187 ssh2
Jan 29 08:03:42 localhost sshd[1074]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:03:53 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 29 08:04:10 localhost polkitd[708]: Registered Authentication Agent for unix-session:c1 (system bus name :1.35 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 29 20:19:31 localhost polkitd[708]: Unregistered Authentication Agent for unix-session:c1 (system bus name :1.35, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Jan 29 20:19:31 localhost sshd[1005]: Received signal 15; terminating.
Jan 30 07:47:05 localhost polkitd[705]: Loading rules from directory /etc/polkit-1/rules.d
Jan 30 07:47:05 localhost polkitd[705]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 30 07:47:06 localhost polkitd[705]: Finished loading, compiling and executing 8 rules
Jan 30 07:47:06 localhost polkitd[705]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 30 07:47:09 localhost sshd[1011]: Server listening on 0.0.0.0 port 22.
Jan 30 07:47:09 localhost sshd[1011]: Server listening on :: port 22.
Jan 30 07:47:22 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 30 07:47:30 localhost sshd[1535]: Accepted password for root from 192.168.241.1 port 52599 ssh2
Jan 30 07:47:30 localhost sshd[1535]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 30 07:47:40 localhost polkitd[705]: Registered Authentication Agent for unix-session:c1 (system bus name :1.32 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 30 20:32:34 localhost sshd[1535]: Exiting on signal 15
Jan 31 08:05:18 localhost polkitd[695]: Loading rules from directory /etc/polkit-1/rules.d
Jan 31 08:05:18 localhost polkitd[695]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 31 08:05:18 localhost polkitd[695]: Finished loading, compiling and executing 8 rules
Jan 31 08:05:18 localhost polkitd[695]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 31 08:05:19 localhost sshd[1005]: Server listening on 0.0.0.0 port 22.
Jan 31 08:05:19 localhost sshd[1005]: Server listening on :: port 22.
Jan 31 08:05:35 localhost gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Jan 31 08:05:48 localhost polkitd[695]: Registered Authentication Agent for unix-session:c1 (system bus name :1.32 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 31 08:17:52 localhost sshd[1854]: Accepted password for root from 192.168.241.1 port 64889 ssh2
Jan 31 08:17:52 localhost sshd[1854]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 31 13:55:50 localhost sshd[5501]: Connection closed by 192.168.241.22 port 36182 [preauth]
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
Jan 31 13:55:55 localhost sshd[5503]: Failed password for root from 192.168.241.22 port 36184 ssh2
Jan 31 13:55:55 localhost sshd[5503]: Connection closed by 192.168.241.22 port 36184 [preauth]
[root@localhost ~]#awk '/Failed/{ip[$11]++}END{for(i in ip){print i","ip[i]}}' /var/log/secure
192.168.241.22,2
Interrupted,1
[root@localhost ~]#awk '/Failed password/{ip[$11]++}END{for(i in ip){print i","ip[i]}}' /var/log/secure
192.168.241.22,2