Linux系统——文本三剑客
目录
一、grep
1.格式
2.选项
2.1 grep重定向
2.2grep -m 匹配到几次停止
2.3grep -i 忽略大小写
2.4grep -n 显示行号
2.5grep -c 统计匹配行数
2.6grep -A 后几行
2.7grep -C 前后三行
2.8grep -B 前三行
2.9grep -e 或
2.10grep -w 匹配整个单词
2.11grep -r 快速过滤
2.12扩展
2.12.1统计当前主机连接状态
2.12.2统计当前连接主机数
二、sed——Stream EDitor
1.格式
2.选项
3.脚本格式
3.1sed 'p' 打印
3.2sed -n 关闭自动打印功能
3.3sed -n ‘kp’（k表示数字） 直接显示多少行
3.4sed ‘kq’（q表示退出） 到第几行退出
3.5sed -n '/^d/,/^g/p' 以d开头开始到以g开头结束
3.6支持正则表达式
3.7扩展——显示日志
3.8奇偶数
3.9sed 'd' 删除
3.10sed -i 修改文件内容（常用于修改配置文件可以在修改之前先进行备份操作）
3.11sed a 在后面追加
3.12sed i 在前面追加
3.13sed c 替换
3.14sed !取反
3.15sed r 将文件传到该文件第二行
3.16sed “=” 换行显示行号
3.17sed可以当作grep使用
4.搜索替代
4.1不打开文件如何修改文件里的内容
4.2 &指代之前找到的内容
4.3 （）代表分组；\1 代表留下的组——分组后向引用
4.3.1分组后向引用
4.3.2提取ip
方法一
方法二
方法三
4.3.3提取版本号
方法一
方法二
4.3.4提取想要的内容（ifcfg-ens33）
4.3.5提取权限大小（以数字显示）
5.变量
5.1变量使用
5.2修改端口
6.sed高级用法
6.1常见的高级命令
6.1.1 sed -n 'N' 读取匹配到的行的下一行追加至模式空间
6.1.2sed 'G' 从保持空间取出内容追加至模式空间（取反）
6.1.3sed -n '{g;1!p;};h'前一行 sed -nr '{n;p}'后一行
6.1.4奇偶显示
7.总结
7.1sed选项
7.2sed命令空间
7.3查找替换
7.3.1固定格式
7.3.2分组后向引用
三、AWK——一种语言
1.含义
2.工作原理
3.执行原理
4.基础用法
4.1选项
4.3awk '{print "hello"}'——有多少行打印多少hello（支持标准输出）
4.4-F "分隔符" 提取内容
4.5BEGIN——仅在开始处理文件中的文本之前执行一次
4.6BEGIN——小型计算器
4.7END——仅在文本处理完成之后执行一次
4.8提取磁盘占用情况
方法一
方法二
方法三
4.9可以提取ip地址
4.9.1sed awk搭配使用
4.9.2hostname -I
4.9.3awk
4.10可以修改输出内容
5.内置变量
5.1格式
5.2 $0，$1，$3
5.3 FS——指定分隔符
5.3.1FS 指定分隔符
5.3.2使用FS分隔符
5.3.3FS与fs
5.4OFS——指定输出时的分隔符
5.5RS——换行
5.6NF——行内字段的个数
5.6.1统计行内字段个数
5.6.2磁盘挂载
5.7NR——统计/显示行号
5.7.1NR——显示行号
5.7.2NR——筛ip行
5.7.3NR!=——取反
5.7.4如何找出当前系统中的普通用户
5.8FNR——查看多个文件各有多少行
5.9FILENAME——显示处理的文件名
6.自定义变量
7.printf
7.1%s——显示字符串
8.模式PATTERN
8.1模式为空——每一行都匹配成功，没有额外条件
8.2正则匹配——仅能处理匹配到达的行，需要用/ /括起来
8.3line ranges——行范围
8.3.1显示行号
8.3.2行范围用法
8.4找到10:00到11：00的日志
8.4.1通过awk找
8.4.2通过sed找
8.5关系表达式——或且非
8.5.1或且非
8.5.2取反——奇偶
8.6条件判断
8.6.1语法
8.6.2格式
8.6.3总结
9.循环——for while
9.1格式
9.2示例
9.2.1计算
10.awk数组
10.1访问、赋值数组元素
10.1.1统计系统状态
方法一
方法二
方法三
10.1.2去重
10.2数组长度
10.3遍历数组
11.awk脚本——将awk程序写入脚本，调用或执行
四、扩展
1.提取下面的字段中IP地址和时间
1.1方法一——使用awk提取（三种方法）
1.2方法二——使用sed提取
2.提取host.txt主机名后再放回host.txt文件
2.1方法一——使用awk提取
2.2方法二——使用cut、tr命令提取
2.3方法三——使用sed命令提取
3.统计/etc/fstab文件中每个文件系统类型出现的次数
4.统计/etc/fstab文件中每个真单词出现的次数
5.提取出字符串中的所有数字
6.查出/tmp/的权限，以数字方式显示
7.查出用户UID最大值的用户名、UID及shell类型
8.提取主机名并放入原文件
[root@localhost ~]#locale
LANG=zh_CN.UTF-8
LC_CTYPE="zh_CN.UTF-8"
#语言符号及其分类(LC_CTYPE)
LC_NUMERIC="zh_CN.UTF-8"
#数字(LC_NUMERIC)
LC_TIME="zh_CN.UTF-8"
#时间显示格式(LC_TIME)
LC_COLLATE="zh_CN.UTF-8"
#比较和排序习惯(LC_COLLATE)
LC_MONETARY="zh_CN.UTF-8"
#货币单位(LC_MONETARY)
LC_MESSAGES="zh_CN.UTF-8"
#信息主要是提示信息,错误信息,状态信息,标题,标签,按钮和菜单等(LC_MESSAGES)
LC_PAPER="zh_CN.UTF-8"
#默认纸张尺寸大小(LC_PAPER)
LC_NAME="zh_CN.UTF-8"
#姓名书写方式(LC_NAME)
LC_ADDRESS="zh_CN.UTF-8"
#地址书写方式(LC_ADDRESS)
LC_TELEPHONE="zh_CN.UTF-8"
#电话号码书写方式(LC_TELEPHONE)
LC_MEASUREMENT="zh_CN.UTF-8"
#度量衡表达方式 (LC_MEASUREMENT)
LC_IDENTIFICATION="zh_CN.UTF-8"
#对locale自身包含信息的概述(LC_IDENTIFICATION)
LC_ALL=一、grep
1.格式
grep格式： grep [选项] 查找条件 目标文件
[root@localhost ~]#grep
用法: grep [选项]... PATTERN [FILE]...
试用‘grep --help’来获得更多信息。
[root@localhost ~]#grep --help
用法: grep [选项]... PATTERN [FILE]...
在每个 FILE 或是标准输入中查找 PATTERN。
默认的 PATTERN 是一个基本正则表达式(缩写为 BRE)。
例如: grep -i 'hello world' menu.h main.c
正则表达式选择与解释:
-E, --extended-regexp PATTERN 是一个可扩展的正则表达式(缩写为 ERE)
-F, --fixed-strings PATTERN 是一组由断行符分隔的定长字符串。
-G, --basic-regexp PATTERN 是一个基本正则表达式(缩写为 BRE)
-P, --perl-regexp PATTERN 是一个 Perl 正则表达式
-e, --regexp=PATTERN 用 PATTERN 来进行匹配操作
-f, --file=FILE 从 FILE 中取得 PATTERN
-i, --ignore-case 忽略大小写
-w, --word-regexp 强制 PATTERN 仅完全匹配字词
-x, --line-regexp 强制 PATTERN 仅完全匹配一行
-z, --null-data 一个 0 字节的数据行，但不是空行
Miscellaneous:
-s, --no-messages suppress error messages
-v, --invert-match select non-matching lines
-V, --version display version information and exit
--help display this help text and exit
输出控制:
-m, --max-count=NUM NUM 次匹配后停止
-b, --byte-offset 输出的同时打印字节偏移
-n, --line-number 输出的同时打印行号
--line-buffered 每行输出清空
-H, --with-filename 为每一匹配项打印文件名
-h, --no-filename 输出时不显示文件名前缀
--label=LABEL 将LABEL 作为标准输入文件名前缀
-o, --only-matching show only the part of a line matching PATTERN
-q, --quiet, --silent suppress all normal output
--binary-files=TYPE assume that binary files are TYPE;
TYPE is 'binary', 'text', or 'without-match'
-a, --text equivalent to --binary-files=text
-I equivalent to --binary-files=without-match
-d, --directories=ACTION how to handle directories;
ACTION is 'read', 'recurse', or 'skip'
-D, --devices=ACTION how to handle devices, FIFOs and sockets;
ACTION is 'read' or 'skip'
-r, --recursive like --directories=recurse
-R, --dereference-recursive
likewise, but follow all symlinks
--include=FILE_PATTERN
search only files that match FILE_PATTERN
--exclude=FILE_PATTERN
skip files and directories matching FILE_PATTERN
--exclude-from=FILE skip files matching any file pattern from FILE
--exclude-dir=PATTERN directories that match PATTERN will be skipped.
-L, --files-without-match print only names of FILEs containing no match
-l, --files-with-matches print only names of FILEs containing matches
-c, --count print only a count of matching lines per FILE
-T, --initial-tab make tabs line up (if needed)
-Z, --null print 0 byte after FILE name
文件控制:
-B, --before-context=NUM 打印以文本起始的NUM 行
-A, --after-context=NUM 打印以文本结尾的NUM 行
-C, --context=NUM 打印输出文本NUM 行
-NUM same as --context=NUM
--group-separator=SEP use SEP as a group separator
--no-group-separator use empty string as a group separator
--color[=WHEN],
--colour[=WHEN] use markers to highlight the matching strings;
WHEN is 'always', 'never', or 'auto'
-U, --binary do not strip CR characters at EOL (MSDOS/Windows)
-u, --unix-byte-offsets report offsets as if CRs were not there
(MSDOS/Windows)
‘egrep’即‘grep -E’。‘fgrep’即‘grep -F’。
直接使用‘egrep’或是‘fgrep’均已不可行了。
若FILE 为 -，将读取标准输入。不带FILE，读取当前目录，除非命令行中指定了-r 选项。
如果少于两个FILE 参数，就要默认使用-h 参数。
如果有任意行被匹配，那退出状态为 0，否则为 1；
如果有错误产生，且未指定 -q 参数，那退出状态为 2。
请将错误报告给: [email protected]
GNU Grep 主页: 2.选项
| 选项 | 含义 |
|---|---|
| -color=auto | 对匹配到的文本着色显示 |
| -m | 匹配到几次停止 匹配到几行停止 |
| -v | 反选 |
| -i | 忽略字符大小写 |
| -n | 显示匹配的行号 |
| -c | 统计匹配的行数 |
| -o | 仅显示匹配到的字符串 |
| -q | 静默模式 不输出信息（常用在写脚本里 类似于将输出信息&>/dev/null） |
| -A | A（After）后几行 |
| -B | B（Before）前几行 |
| -C | C（Context）前后各几行 |
| -e | 实现多个选项间的逻辑关系，如grep -e 'cat' -e 'dog' file；grep -E root|bash /etc/passwd |
| -w | 匹配整个单词 |
| -E | 使用ERE（扩展正则表达式）相当于egrep |
| -F | 不支持正则表达式，相当于fgrep |
| -f | file 根据模式文件，处理两个文件相同内容，把第一个文件作为匹配条件 |
| -r | 递归目录，但不处理软连接 快速过滤 |
| -R | 递归目录，但处理软连接 |
2.1 grep重定向
grep支持标准输入和标准输出
2.2grep -m 匹配到几次停止
2.3grep -i 忽略大小写
2.4grep -n 显示行号
2.5grep -c 统计匹配行数
2.6grep -A 后几行
2.7grep -C 前后三行
2.8grep -B 前三行
2.9grep -e 或
2.10grep -w 匹配整个单词
2.11grep -r 快速过滤
2.12扩展
2.12.1统计当前主机连接状态
[root@localhost ~]#ss -natp|grep -v '^State'
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=40))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1529,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1461,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1005,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1008,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1237,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1074,fd=9))
ESTAB 0 0 192.168.241.11:22 192.168.241.1:61187 users:(("sshd",pid=1074,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=39))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1005,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1008,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1237,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1074,fd=8))
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1|sort|uniq -c
1 ESTAB
12 LISTEN2.12.2统计当前连接主机数
[root@localhost ~]#ss -natp|tr -s " "
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=40))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1529,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1461,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1005,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1008,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1237,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1074,fd=9))
ESTAB 0 36 192.168.241.11:22 192.168.241.1:61187 users:(("sshd",pid=1074,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=39))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1005,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1008,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1237,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1074,fd=8))
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5
Address:Port
*:*
*:*
*:*
*:*
*:*
*:*
*:*
192.168.241.1:61187
:::*
:::*
:::*
:::*
:::*
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1
Address
*
*
*
*
*
*
*
192.168.241.1
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1|sort
*
*
*
*
*
*
*
192.168.241.1
Address
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1|sort|uniq -c
5
7 *
1 192.168.241.1
1 Address二、sed——Stream EDitor
和vi不同 sed是行编辑器
Sed是从文件或管道中读取一行，处理一行，输出一行；再读取一行，再处理一行，再输出一行，直到最后一行。每当处理一行时，把当前处理的行存储在临时缓冲区中，称为模式空间（PatternSpace），接着用sed命令处理缓冲区中的内容，处理完成后，把缓冲区的内容送往屏幕。接着处理下一行，这样不断重复，直到文件末尾。一次处理一行的设计模式使得sed性能很高，sed在读取大文件时不会出现卡顿的现象。如果使用vi命令打开几十M上百M的文件，明显会出现有卡顿的现象，这是因为vi命令打开文件是一次性将文件加载到内存，然后再打开。Sed就避免了这种情况，一行一行的处理，打开速度非常快，执行速度也很快
1.格式
sed 选项 ‘语法’ 文件或标准输出
sed [option]... ‘script；script；...’ [input file...]
选项 自身脚本语法 支持标准输入和管道
sed ‘ ’表示查看文件内容
sed也支持管道符
2.选项
[root@localhost ~]#sed --help
用法: sed [选项]... {脚本(如果没有其他脚本)} [输入文件]...
-n, --quiet, --silent
取消自动打印模式空间
-e 脚本, --expression=脚本
添加“脚本”到程序的运行列表
-f 脚本文件, --file=脚本文件
添加“脚本文件”到程序的运行列表
--follow-symlinks
直接修改文件时跟随软链接
-i[SUFFIX], --in-place[=SUFFIX]
edit files in place (makes backup if SUFFIX supplied)
-c, --copy
use copy instead of rename when shuffling files in -i mode
-b, --binary
does nothing; for compatibility with WIN32/CYGWIN/MSDOS/EMX (
open files in binary mode (CR+LFs are not treated specially))
-l N, --line-length=N
指定“l”命令的换行期望长度
--posix
关闭所有 GNU 扩展
-r, --regexp-extended
在脚本中使用扩展正则表达式
-s, --separate
将输入文件视为各个独立的文件而不是一个长的连续输入
-u, --unbuffered
从输入文件读取最少的数据，更频繁的刷新输出
-z, --null-data
separate lines by NUL characters
--help
display this help and exit
--version
output version information and exit
如果没有 -e, --expression, -f 或 --file 选项，那么第一个非选项参数被视为
sed脚本。其他非选项参数被视为输入文件，如果没有输入文件，那么程序将从标准
输入读取数据。
GNU sed home page: .
Be sure to include the word ``sed'' somewhere in the ``Subject:'' field.
| 选项 | 含义 |
|---|---|
| -n | 不输出模式空间内容到屏幕，即不自动打印 |
| -e | 多点编辑 |
| -f | FILE 从指定文件中读取编辑脚本 |
| -r -E |
使用扩展正则表达式 |
| -i.bak | 备份文件并原处编辑 |
3.脚本格式
- sed 单引号中间需要写脚本； ‘地址+命令’
- 不给地址：对全文进行处理（比如行号）
- 单地址：#：指定的行；$：最后一行；/PATTERN：被此处模式所能够匹配到的每一行
- 地址范围：#，# 从第几行到第几行（3,6从第三行到第六行）；#，+#从第几行到+的第几行（3，+4，代表从第三行到第七行）；/part1，/part2，第一个正则表达式和第二个正则表达式之间的行；#，/part，从#号开始找 直到part为止；/part，#，找到#号个part为止
- 步进：~ 1~2奇数行 2~2偶数行
| 命令 | 选项 |
|---|---|
| p | 打印当前模式空间内容，追加到默认输出之后 |
| Ip | 忽略大小写输出 |
| d | 删除模式空间匹配的行，并立即启用下一轮循环 |
| a[\]text | 在指定行后面追加文本，支持使用\n实现多行追加 |
| i[\]text | 在行前面插入文本 |
| c[\]text | 替换行为单行或多行文本 |
| w file | 保存模式匹配的行至指定文件 |
| r file | 读取指定文件的文本至模式空间中匹配到的行后 |
| = | 为模式空间中的行打印行号 |
| ！ | 模式空间中匹配行取反处理 |
| q | 结束或退出sed |
3.1sed 'p' 打印
[root@localhost ~]#seq 10 | sed 'p'
#带有自动打印功能，p又再打印一遍
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
103.2sed -n 关闭自动打印功能
[root@localhost ~]#seq 10 | sed -n 'p'
#-n 选项关闭自动打印功能
1
2
3
4
5
6
7
8
9
103.3sed -n ‘kp’（k表示数字） 直接显示多少行
3.4sed ‘kq’（q表示退出） 到第几行退出
3.5sed -n '/^d/,/^g/p' 以d开头开始到以g开头结束
3.6支持正则表达式
3.7扩展——显示日志
[root@localhost opt]#sed -n '/2018:09:37:18/,/2018:10:23:43/p' access_log\(2\)
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "OPTIONS /magedu30 HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:43 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"3.8奇偶数
3.9sed 'd' 删除
3.10sed -i 修改文件内容（常用于修改配置文件可以在修改之前先进行备份操作）
[root@localhost ~]#seq 10 >test.txt
[root@localhost ~]#cat test.txt
1
2
3
4
5
6
7
8
9
10
[root@localhost ~]#sed -i.cxk '2~2d' test.txt
[root@localhost ~]#cat test.txt
1
3
5
7
9
[root@localhost ~]#ls
anaconda-ks.cfg test.txt.cxk 模板 文档 桌面
initial-setup-ks.cfg webmin-2.100-1.noarch.rpm 视频 下载
test.txt 公共 图片 音乐
[root@localhost ~]#cat test.txt.cxk
1
2
3
4
5
6
7
8
9
10
3.11sed a 在后面追加
3.12sed i 在前面追加
3.13sed c 替换
3.14sed !取反
3.15sed r 将文件传到该文件第二行
[root@localhost ~]#vim test
S
M
L
XL
[root@localhost ~]#vim /etc/issue
\S
Kernel \r on an \m
[root@localhost ~]#sed '2r /etc/issue' test
S
M
\S
Kernel \r on an \m
L
XL3.16sed “=” 换行显示行号
[root@localhost ~]#sed "=" /etc/passwd
1
root:x:0:0:root:/root:/bin/bash
2
bin:x:1:1:bin:/bin:/sbin/nologin
3
daemon:x:2:2:daemon:/sbin:/sbin/nologin
4
adm:x:3:4:adm:/var/adm:/sbin/nologin
5
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6
sync:x:5:0:sync:/sbin:/bin/sync
7
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8
halt:x:7:0:halt:/sbin:/sbin/halt
9
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10
operator:x:11:0:operator:/root:/sbin/nologin
11
games:x:12:100:games:/usr/games:/sbin/nologin
12
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
13
nobody:x:99:99:Nobody:/:/sbin/nologin
14
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
15
dbus:x:81:81:System message bus:/:/sbin/nologin
16
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
17
abrt:x:173:173::/etc/abrt:/sbin/nologin
18
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
19
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
20
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
21
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
22
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
23
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
24
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
25
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
26
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
27
ntp:x:38:38::/etc/ntp:/sbin/nologin
28
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
29
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
30
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
31
qemu:x:107:107:qemu user:/:/sbin/nologin
32
radvd:x:75:75:radvd user:/:/sbin/nologin
33
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
34
sssd:x:992:987:User for sssd:/:/sbin/nologin
35
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
36
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
37
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
38
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
39
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
40
tcpdump:x:72:72::/:/sbin/nologin
41
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash3.17sed可以当作grep使用
4.搜索替代
格式：s/pattern/string/修饰符
查找替换，支持使用其他分隔符，可以是其它形式（s@@@；s###）
| 替换修饰符 | |
|---|---|
| 修饰符 | 含义 |
| g | 行内全局替换 |
| p | 显示替换成功的行 |
| w | /PATH/FILE 将替换成功的行保存至文件中 |
| I，i | 忽略大小写 |
4.1不打开文件如何修改文件里的内容
[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#sed 's/root/admin/g' /etc/passwd
admin:x:0:0:admin:/admin:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/admin:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash4.2 &指代之前找到的内容
[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#sed 's/root/&er/g' /etc/passwd
rooter:x:0:0:rooter:/rooter:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/rooter:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash4.3 （）代表分组；\1 代表留下的组——分组后向引用
4.3.1分组后向引用
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1/'
123
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2/'
123abc
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2\3/'
123abcxyzr表示扩展正则表达式
4.3.2提取ip
方法一
方法二
方法三
4.3.3提取版本号
方法一
[root@localhost ~]#vim test
ant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar
[root@localhost ~]#cat test
ant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar
[root@localhost ~]#sed -nr 's/.*-(.*).jar/\1/p'
^C
[root@localhost ~]#sed -nr 's/.*-(.*).jar/\1/p' test
1.9.7
1.9.7
2.7.7
3.4
1.0
0.7.6
5.0.4
1.9.5
1.64
1.46
1.64
2.5.5
方法二
[root@localhost ~]#cat test
ant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar
[root@localhost ~]#rev test
raj.7.9.1-tna
raj.7.9.1-rehcnual-tna
raj.7.7.2-rltna
raj.4.3-emitnur-rltna
raj.0.1-ecnaillapoa
raj.6.7.0-eroc-suiahcra
raj.4.0.5-msa
raj.5.9.1-revaewjtcepsa
raj.46.1-no51kdj-xikpcb
raj.64.1-51kdj-vorpcb
raj.46.1-no51kdj-vorpcb
raj.5.5.2-lauq-tapmoc-rekcehc
[root@localhost ~]#rev test |awk -F'raj.' '{print $2}'|awk -F'-' '{print $1}'|rev
1.9.7
1.9.7
2.7.7
3.4
1.0
0.7.6
5.0.4
1.9.5
1.64
1.46
1.64
2.5.5
4.3.4提取想要的内容（ifcfg-ens33）
4.3.5提取权限大小（以数字显示）
5.变量
5.1变量使用
5.2修改端口
6.sed高级用法
插播！我有很多项目，只有一台服务器，如何管理？
启用自配置文件进行维护
sed中除了模式空间，还另外支持保持空间（Hold Space），利用此空间，可以将模式空间中的数量，临时保存至保持空间，从而后续接着处理，实现更为强大的功能
6.1常见的高级命令
| 命令选项 | 含义 |
|---|---|
| P | 打印模式空间开端至\n内容，并追加到默认输出之前 |
| h | 把模式空间中的内容覆盖至保持空间中 |
| H | 把模式空间中的内容追加至保持空间中 |
| g | 从保持空间中取出数据覆盖至模式空间 |
| G | 从保持空间取出内容追加至模式空间 |
| x | 把模式空间中的内容与保持空间中的内容进行互换 |
| n | 读取匹配到行的下一行覆盖至模式空间 |
| N | 读取匹配到的行的下一行追加至模式空间 |
| d | 删除模式空间中的行 |
| D | 如果模式空间包含换行符，则删除直到第一个换行符的模式空间中的文本，并不会读取新的输入行，而使用合成的模式空间重新启动循环，如果模式空间不包含换行符，则会像发出d命令那样启动正常的新循环 |
6.1.1 sed -n 'N' 读取匹配到的行的下一行追加至模式空间
6.1.2sed 'G' 从保持空间取出内容追加至模式空间（取反）
[root@localhost ~]#seq 10 |sed '1G;h'
1
2
3
4
5
6
7
8
9
10
[root@localhost ~]#seq 10 |sed '1G;h;$d'
1
2
3
4
5
6
7
8
9
[root@localhost ~]#seq 10 |sed '1!G;h'
1
2
1
3
2
1
4
3
2
1
5
4
3
2
1
6
5
4
3
2
1
7
6
5
4
3
2
1
8
7
6
5
4
3
2
1
9
8
7
6
5
4
3
2
1
10
9
8
7
6
5
4
3
2
1
[root@localhost ~]#seq 10 |sed '1!G;h;$!d'
10
9
8
7
6
5
4
3
2
1
6.1.3sed -n '{g;1!p;};h'前一行 sed -nr '{n;p}'后一行
6.1.4奇偶显示
7.总结
7.1sed选项
| 选项 | 含义 |
|---|---|
| -n | 关闭自动打印 |
| -i | 真正修改编辑文件 |
| -i.bak | 修改前先备份文件，在源文件后面加上bak也可以写成-i.cxk |
| -r | 扩展正则 |
| -e | 多点编辑 |
7.2sed命令空间
| 命令 | 含义 |
|---|---|
| a | 在下面插入内容，要像真正修改，需要搭配-i选项使用 |
| i | 前面插入 |
| c | 替换 |
| p | 打印 |
| q | 退出 |
| d | 删除 |
7.3查找替换
7.3.1固定格式
s/旧内容（可以使用正则表达式替代）/新内容（固定的字符串）/修饰符
7.3.2分组后向引用
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1/'
123
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2/'
123abc
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2\3/'
123abcxyz三、AWK——一种语言
1.含义
AWK（Aho, Weinberger, Kernighan ）报告生成器，格式化文本输出，GNU/Linux发布的AWK目前由自由软件基金会（FSF）进行开发和维护，通常也称它为 GNU AWK。
在 Linux/UNIX 系统中，awk 是一个功能强大的编辑工具，逐行读取输入文本，默认以空格或tab键作为分隔符作为分隔，并按模式或者条件执行编辑命令。而awk比较倾向于将一行分成多个字段然后进行处理。AWK信息的读入也是逐行指定的匹配模式进行查找，对符合条件的内容进行格式化输出或者过滤处理，可以在无交互的情况下实现相当复杂的文本操作，被广泛应用于 Shell 脚本，完成各种自动化配置任务 。
有多种版本：
- AWK：原先来源于 AT & T 实验室的的AWK
- NAWK：New awk，AT & T 实验室的AWK的升级版
- GAWK：即GNU AWK。所有的GNU/Linux发布版都自带GAWK，它与AWK和NAWK完全兼容
awk是一种语言，读取一行处理一行
2.工作原理
前面提到 sed 命令常用于一整行的处理,而 awk 比较倾向于将一行分成多个“字段”然后再进行处理，且默认情况下字段的分隔符为空格或 tab 键。awk 执行结果可以通过 print 的功能将字段数据打印显示。
格式：awk [options] 'program' var=value file...
program通常是被放在单引号中，并可以由三种部分组成
- BEGIN语句块
- 模式匹配的通用语句块
- END语句块
Program格式 pattern {action statements}
- pattern：决定动作语句何时触发及触发事件，比如：BEGIN,END,正则表达式等
- action statements：对数据进行处理，放在{}内指明，常见：print, printf
- output statements：print,printf
- Expressions：算术，比较表达式等
- Compound statements：组合语句
- Control statements：if, while等
- input statements
正则表达式 {print }只有打印；默认打印全部
3.执行原理
- 第一步：执行BEGIN{action;… }{print}语句块中的语句
- 第二步：从文件或标准输入(stdin)读取一行，然后执行pattern{ action;… }语句块，它逐行扫描文件， 从第一行到最后一行重复这个过程，直到文件全部被读取完毕。
- 第三步：当读至输入流末尾时，执行END{action;…}语句块
- BEGIN语句块在awk开始从输入流中读取行之前被执行，这是一个可选的语句块，比如变量初始化、打印输出表格的表头等语句通常可以写在BEGIN语句块中 END语句块在awk从输入流中读取完所有的行之后即被执行，比如打印所有行的分析结果这类信息汇总都是在END语句块中完成，它也是一个可选语句块；
- pattern语句块中的通用命令是最重要的部分，也是可选的。如果没有提供pattern语句块，则默认执行{ print }，即打印每一个读取到的行，awk读取的每一行都会执行该语句块
4.基础用法
awk 'patterm{action}
4.1选项
| 选项 | 含义 |
|---|---|
| -F “分隔符” | 指明输入时用到的字符分隔符，默认的分隔符是若干个连续空白符 |
| -v | var=value 变量赋值 |
4.2awk '{print}' 再打印一遍
4.3awk '{print "hello"}'——有多少行打印多少hello（支持标准输出）
[root@localhost ~]#awk '{print "hello"}' 4.4-F "分隔符" 提取内容
[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
4.5BEGIN——仅在开始处理文件中的文本之前执行一次
[root@localhost ~]#awk -F: 'BEGIN{print "hello"}{print $1}' /etc/passwd
hello
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
4.6BEGIN——小型计算器
4.7END——仅在文本处理完成之后执行一次
[root@localhost ~]#awk -F: 'END{print "hello"}{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
hello4.8提取磁盘占用情况
方法一
[root@localhost ~]#df
文件系统 1K-块 已用 可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270732 47132468 11% /
devtmpfs 917604 0 917604 0% /dev
tmpfs 933524 0 933524 0% /dev/shm
tmpfs 933524 9208 924316 1% /run
tmpfs 933524 0 933524 0% /sys/fs/cgroup
/dev/sda1 5232640 182368 5050272 4% /boot
tmpfs 186708 12 186696 1% /run/user/42
tmpfs 186708 0 186708 0% /run/user/0
[root@localhost ~]#df|awk '{print $5}'
已用%
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $5}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $5}'|tail -n+2|tr -d %
11
0
0
1
0
4
1
0方法二
方法三
[root@localhost ~]#df
文件系统 1K-块 已用 可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270264 47132936 11% /
devtmpfs 917604 0 917604 0% /dev
tmpfs 933524 0 933524 0% /dev/shm
tmpfs 933524 9208 924316 1% /run
tmpfs 933524 0 933524 0% /sys/fs/cgroup
/dev/sda1 5232640 182368 5050272 4% /boot
tmpfs 186708 12 186696 1% /run/user/42
tmpfs 186708 0 186708 0% /run/user/0
[root@localhost ~]#df|awk -F"[[:space:]]+" '{print $5}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk -F"[[:space:]]+|%" '{print $5}'|tail -n+2
11
0
0
1
0
4
1
0
4.9可以提取ip地址
4.9.1sed awk搭配使用
4.9.2hostname -I
4.9.3awk
4.10可以修改输出内容
[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000
[root@localhost ~]#awk -F: '{print $1"++++++"$3}' /etc/passwd
root++++++0
bin++++++1
daemon++++++2
adm++++++3
lp++++++4
sync++++++5
shutdown++++++6
halt++++++7
mail++++++8
operator++++++11
games++++++12
ftp++++++14
nobody++++++99
systemd-network++++++192
dbus++++++81
polkitd++++++999
abrt++++++173
libstoragemgmt++++++998
rpc++++++32
colord++++++997
saslauth++++++996
rtkit++++++172
pulse++++++171
chrony++++++995
rpcuser++++++29
nfsnobody++++++65534
ntp++++++38
tss++++++59
usbmuxd++++++113
geoclue++++++994
qemu++++++107
radvd++++++75
setroubleshoot++++++993
sssd++++++992
gdm++++++42
gnome-initial-setup++++++991
sshd++++++74
avahi++++++70
postfix++++++89
tcpdump++++++72
ghd++++++1000
[root@localhost ~]#awk -F: '{print $1"\t"$3}' /etc/passwd
#\t表示tab键
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000
5.内置变量
| 变量 | 含义 |
|---|---|
| FS | 指定每行文本的字段分隔符，缺省默认为空格或制表符（tab）。与 “-F”作用相同 -v "FS=:" |
| OFS | 输出时的分隔符 |
| NF | 当前处理的行的字段个数 |
| NR | 当前处理的行的行号（序数） |
| $0 | 当前处理的行的整行内容 |
| $n | 当前处理行的第n个字段（第n列） |
| FILENAME | 被处理的文件名 |
| RS | 行分隔符。awk从文件上读取资料时，将根据RS的定义就把资料切割成许多条记录，而awk一次仅读入一条记录进行处理。预设值是\n |
5.1格式
awk 选项 '模式{print}'
awk中的变量，不会影响bash 环境中的变量
5.2 $0，$1，$3
[root@localhost ~]#awk -F: '{print $0}' /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
[root@localhost ~]#awk -F: '{print $3}' /etc/passwd
0
1
2
3
4
5
6
7
8
11
12
14
99
192
81
999
173
998
32
997
996
172
171
995
29
65534
38
59
113
994
107
75
993
992
42
991
74
70
89
72
1000
[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 10005.3 FS——指定分隔符
5.3.1FS 指定分隔符
[root@localhost ~]#awk -v FS=: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
5.3.2使用FS分隔符
[root@localhost ~]#awk -v FS=: '{print $1FS$3}' /etc/passwd
root:0
bin:1
daemon:2
adm:3
lp:4
sync:5
shutdown:6
halt:7
mail:8
operator:11
games:12
ftp:14
nobody:99
systemd-network:192
dbus:81
polkitd:999
abrt:173
libstoragemgmt:998
rpc:32
colord:997
saslauth:996
rtkit:172
pulse:171
chrony:995
rpcuser:29
nfsnobody:65534
ntp:38
tss:59
usbmuxd:113
geoclue:994
qemu:107
radvd:75
setroubleshoot:993
sssd:992
gdm:42
gnome-initial-setup:991
sshd:74
avahi:70
postfix:89
tcpdump:72
ghd:1000
5.3.3FS与fs
[root@localhost ~]#fs=:
[root@localhost ~]#echo $fs
:
[root@localhost ~]#echo $FS
[root@localhost ~]#awk -v FS=$fs '{print $1FS$3}' /etc/passwd
root:0
bin:1
daemon:2
adm:3
lp:4
sync:5
shutdown:6
halt:7
mail:8
operator:11
games:12
ftp:14
nobody:99
systemd-network:192
dbus:81
polkitd:999
abrt:173
libstoragemgmt:998
rpc:32
colord:997
saslauth:996
rtkit:172
pulse:171
chrony:995
rpcuser:29
nfsnobody:65534
ntp:38
tss:59
usbmuxd:113
geoclue:994
qemu:107
radvd:75
setroubleshoot:993
sssd:992
gdm:42
gnome-initial-setup:991
sshd:74
avahi:70
postfix:89
tcpdump:72
ghd:1000
5.4OFS——指定输出时的分隔符
[root@localhost ~]#awk -v FS=: -v OFS="==" '{print $1,$3}' /etc/passwd
root==0
bin==1
daemon==2
adm==3
lp==4
sync==5
shutdown==6
halt==7
mail==8
operator==11
games==12
ftp==14
nobody==99
systemd-network==192
dbus==81
polkitd==999
abrt==173
libstoragemgmt==998
rpc==32
colord==997
saslauth==996
rtkit==172
pulse==171
chrony==995
rpcuser==29
nfsnobody==65534
ntp==38
tss==59
usbmuxd==113
geoclue==994
qemu==107
radvd==75
setroubleshoot==993
sssd==992
gdm==42
gnome-initial-setup==991
sshd==74
avahi==70
postfix==89
tcpdump==72
ghd==1000
[root@localhost ~]#awk -v FS=: -v OFS="++" '{print $1,$3}' /etc/passwd
root++0
bin++1
daemon++2
adm++3
lp++4
sync++5
shutdown++6
halt++7
mail++8
operator++11
games++12
ftp++14
nobody++99
systemd-network++192
dbus++81
polkitd++999
abrt++173
libstoragemgmt++998
rpc++32
colord++997
saslauth++996
rtkit++172
pulse++171
chrony++995
rpcuser++29
nfsnobody++65534
ntp++38
tss++59
usbmuxd++113
geoclue++994
qemu++107
radvd++75
setroubleshoot++993
sssd++992
gdm++42
gnome-initial-setup++991
sshd++74
avahi++70
postfix++89
tcpdump++72
ghd++1000
[root@localhost ~]#awk -v FS=: -v OFS=" " '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 10005.5RS——换行
[root@localhost ~]#echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@localhost ~]#echo $PATH|awk '{print $1}'
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@localhost ~]#echo $PATH|awk -v RS=: '{print $1}'
/usr/local/sbin
/usr/local/bin
/usr/sbin
/usr/bin
/root/bin5.6NF——行内字段的个数
5.6.1统计行内字段个数
[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#awk -F: '{print NF}' /etc/passwd
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
5.6.2磁盘挂载
[root@localhost ~]#df
文件系统 1K-块 已用 可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270276 47132924 11% /
devtmpfs 917604 0 917604 0% /dev
tmpfs 933524 0 933524 0% /dev/shm
tmpfs 933524 9208 924316 1% /run
tmpfs 933524 0 933524 0% /sys/fs/cgroup
/dev/sda1 5232640 182368 5050272 4% /boot
tmpfs 186708 12 186696 1% /run/user/42
tmpfs 186708 0 186708 0% /run/user/0
[root@localhost ~]#df|awk '{print $NF-1}'
-1
-1
-1
-1
-1
-1
-1
-1
-1
[root@localhost ~]#df|awk '{print $(NF-1)}'
已用%
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $(NF-1)}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%
5.7NR——统计/显示行号
5.7.1NR——显示行号
[root@localhost ~]#awk -F: '{print NR}' /etc/passwd
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
[root@localhost ~]#awk -F: '{print NR,$1}' /etc/passwd
1 root
2 bin
3 daemon
4 adm
5 lp
6 sync
7 shutdown
8 halt
9 mail
10 operator
11 games
12 ftp
13 nobody
14 systemd-network
15 dbus
16 polkitd
17 abrt
18 libstoragemgmt
19 rpc
20 colord
21 saslauth
22 rtkit
23 pulse
24 chrony
25 rpcuser
26 nfsnobody
27 ntp
28 tss
29 usbmuxd
30 geoclue
31 qemu
32 radvd
33 setroubleshoot
34 sssd
35 gdm
36 gnome-initial-setup
37 sshd
38 avahi
39 postfix
40 tcpdump
41 ghd5.7.2NR——筛ip行
5.7.3NR!=——取反
5.7.4如何找出当前系统中的普通用户
[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}' /etc/passwd
nfsnobody 65534
ghd 10005.8FNR——查看多个文件各有多少行
[root@localhost ~]#cat /etc/issue
\S
Kernel \r on an \m
[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#cat /etc/issue|wc -l
3
[root@localhost ~]#cat /etc/passwd|wc -l
41
[root@localhost ~]#awk '{print FNR}' /etc/issue /etc/passwd
1
2
3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
415.9FILENAME——显示处理的文件名
[root@localhost ~]#awk -F: '{print FILENAME}' /etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd6.自定义变量
7.printf
| 选项 | 含义 |
|---|---|
| %s | 显示字符串 |
| %d，%i | 显示十进制整数 |
| %f | 显示为浮点数 |
| %e，%E | 显示科学计数法数值 |
| %c | 显示字符的ASCII码 |
| %g，%G | 以科学计数法或浮点形式显示数值 |
| %u | 无符号整数 |
| %% | 显示%自身 |
7.1%s——显示字符串
[root@localhost ~]#awk -F: '{printf "%s",$1}' /etc/passwd
rootbindaemonadmlpsyncshutdownhaltmailoperatorgamesftpnobodysystemd-networkdbuspolkitdabrtlibstoragemgmtrpccolordsaslauthrtkitpulsechronyrpcusernfsnobodyntptssusbmuxdgeoclueqemuradvdsetroubleshootsssdgdmgnome-initial-setupsshdavahipostfixtcpdumpghd[root@localhost ~]#awk -F: '{printf "%s\n",$1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd[root@localhost ~]#awk -F: '{printf "%20s\n",$1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
[root@localhost ~]#awk -F: '{printf "%-20s\n",$1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd[root@localhost ~]#awk -F: '{printf "%-20s %10d\n",$1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000[root@localhost ~]#awk -F: '{printf "Username: %s\n",$1}' /etc/passwd
Username: root
Username: bin
Username: daemon
Username: adm
Username: lp
Username: sync
Username: shutdown
Username: halt
Username: mail
Username: operator
Username: games
Username: ftp
Username: nobody
Username: systemd-network
Username: dbus
Username: polkitd
Username: abrt
Username: libstoragemgmt
Username: rpc
Username: colord
Username: saslauth
Username: rtkit
Username: pulse
Username: chrony
Username: rpcuser
Username: nfsnobody
Username: ntp
Username: tss
Username: usbmuxd
Username: geoclue
Username: qemu
Username: radvd
Username: setroubleshoot
Username: sssd
Username: gdm
Username: gnome-initial-setup
Username: sshd
Username: avahi
Username: postfix
Username: tcpdump
Username: ghd
[root@localhost ~]#awk -F: '{printf "Username: %sUID:%d\n",$1,$3}' /etc/passwd
Username: rootUID:0
Username: binUID:1
Username: daemonUID:2
Username: admUID:3
Username: lpUID:4
Username: syncUID:5
Username: shutdownUID:6
Username: haltUID:7
Username: mailUID:8
Username: operatorUID:11
Username: gamesUID:12
Username: ftpUID:14
Username: nobodyUID:99
Username: systemd-networkUID:192
Username: dbusUID:81
Username: polkitdUID:999
Username: abrtUID:173
Username: libstoragemgmtUID:998
Username: rpcUID:32
Username: colordUID:997
Username: saslauthUID:996
Username: rtkitUID:172
Username: pulseUID:171
Username: chronyUID:995
Username: rpcuserUID:29
Username: nfsnobodyUID:65534
Username: ntpUID:38
Username: tssUID:59
Username: usbmuxdUID:113
Username: geoclueUID:994
Username: qemuUID:107
Username: radvdUID:75
Username: setroubleshootUID:993
Username: sssdUID:992
Username: gdmUID:42
Username: gnome-initial-setupUID:991
Username: sshdUID:74
Username: avahiUID:70
Username: postfixUID:89
Username: tcpdumpUID:72
Username: ghdUID:1000
[root@localhost ~]#awk -F: '{printf "Username: %25sUID:%d\n",$1,$3}' /etc/passwd
Username: rootUID:0
Username: binUID:1
Username: daemonUID:2
Username: admUID:3
Username: lpUID:4
Username: syncUID:5
Username: shutdownUID:6
Username: haltUID:7
Username: mailUID:8
Username: operatorUID:11
Username: gamesUID:12
Username: ftpUID:14
Username: nobodyUID:99
Username: systemd-networkUID:192
Username: dbusUID:81
Username: polkitdUID:999
Username: abrtUID:173
Username: libstoragemgmtUID:998
Username: rpcUID:32
Username: colordUID:997
Username: saslauthUID:996
Username: rtkitUID:172
Username: pulseUID:171
Username: chronyUID:995
Username: rpcuserUID:29
Username: nfsnobodyUID:65534
Username: ntpUID:38
Username: tssUID:59
Username: usbmuxdUID:113
Username: geoclueUID:994
Username: qemuUID:107
Username: radvdUID:75
Username: setroubleshootUID:993
Username: sssdUID:992
Username: gdmUID:42
Username: gnome-initial-setupUID:991
Username: sshdUID:74
Username: avahiUID:70
Username: postfixUID:89
Username: tcpdumpUID:72
Username: ghdUID:1000
[root@localhost ~]#awk -F: '{printf "Username: %-25sUID:%d\n",$1,$3}' /etc/passwd
Username: root UID:0
Username: bin UID:1
Username: daemon UID:2
Username: adm UID:3
Username: lp UID:4
Username: sync UID:5
Username: shutdown UID:6
Username: halt UID:7
Username: mail UID:8
Username: operator UID:11
Username: games UID:12
Username: ftp UID:14
Username: nobody UID:99
Username: systemd-network UID:192
Username: dbus UID:81
Username: polkitd UID:999
Username: abrt UID:173
Username: libstoragemgmt UID:998
Username: rpc UID:32
Username: colord UID:997
Username: saslauth UID:996
Username: rtkit UID:172
Username: pulse UID:171
Username: chrony UID:995
Username: rpcuser UID:29
Username: nfsnobody UID:65534
Username: ntp UID:38
Username: tss UID:59
Username: usbmuxd UID:113
Username: geoclue UID:994
Username: qemu UID:107
Username: radvd UID:75
Username: setroubleshoot UID:993
Username: sssd UID:992
Username: gdm UID:42
Username: gnome-initial-setup UID:991
Username: sshd UID:74
Username: avahi UID:70
Username: postfix UID:89
Username: tcpdump UID:72
Username: ghd UID:1000[root@localhost ~]#awk -F: 'BEGIN{printf "--------------------------------\n%-20s|%10s|\n--------------------------------\n","username","uid"}{printf "%-20s|%10d|\n--------------------------------\n",$1,$3}' /etc/passwd
--------------------------------
username | uid|
--------------------------------
root | 0|
--------------------------------
bin | 1|
--------------------------------
daemon | 2|
--------------------------------
adm | 3|
--------------------------------
lp | 4|
--------------------------------
sync | 5|
--------------------------------
shutdown | 6|
--------------------------------
halt | 7|
--------------------------------
mail | 8|
--------------------------------
operator | 11|
--------------------------------
games | 12|
--------------------------------
ftp | 14|
--------------------------------
nobody | 99|
--------------------------------
systemd-network | 192|
--------------------------------
dbus | 81|
--------------------------------
polkitd | 999|
--------------------------------
abrt | 173|
--------------------------------
libstoragemgmt | 998|
--------------------------------
rpc | 32|
--------------------------------
colord | 997|
--------------------------------
saslauth | 996|
--------------------------------
rtkit | 172|
--------------------------------
pulse | 171|
--------------------------------
chrony | 995|
--------------------------------
rpcuser | 29|
--------------------------------
nfsnobody | 65534|
--------------------------------
ntp | 38|
--------------------------------
tss | 59|
--------------------------------
usbmuxd | 113|
--------------------------------
geoclue | 994|
--------------------------------
qemu | 107|
--------------------------------
radvd | 75|
--------------------------------
setroubleshoot | 993|
--------------------------------
sssd | 992|
--------------------------------
gdm | 42|
--------------------------------
gnome-initial-setup | 991|
--------------------------------
sshd | 74|
--------------------------------
avahi | 70|
--------------------------------
postfix | 89|
--------------------------------
tcpdump | 72|
--------------------------------
ghd | 1000|
--------------------------------echo和printf可以修饰脚本格式
8.模式PATTERN
模式"其实就是选择的"条件"，awk是逐行处理文本的，也就是说，awk会先处理完当前行，再处理下一行，当不指定任何"条件"，awk会一行一行的处理文本中的每一行，如果指定了"条件"，只有满足"条件"的行才会被处理，不满足"条件"的行就不会被处理。
awk '模式（处理动作）'
PATTERN：根据pattern条件，过滤匹配的行，再做处理
8.1模式为空——每一行都匹配成功，没有额外条件
[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 10008.2正则匹配——仅能处理匹配到达的行，需要用/ /括起来
[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#awk 'NR==3{print $1}' /etc/passwd
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#seq 10|awk 'NR>=3 && NR<=6'
3
4
5
6
[root@localhost ~]#awk 'NR>=3 && NR<=6{print NR,$0}' /etc/passwd
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
8.3line ranges——行范围
不支持使用行号，但是可以使用变量NR；间接指定行号加上比较操作符 或者逻辑关系
| x+y |
| x-y |
| x*y |
| x/y |
| x^y |
| x%y（取余） |
| -x 转换为负数 |
| +x 将字符串转换为数值 |
| == |
| != |
| > |
| >= |
| < |
| <= |
| 逻辑符号 | 含义 |
|---|---|
| 与：&& | 并且关系 |
| 或：|| | 或者关系 |
| 非：！ | 取反 |
8.3.1显示行号
[root@localhost ~]#awk '{print $1,NR}' /etc/passwd
root:x:0:0:root:/root:/bin/bash 1
bin:x:1:1:bin:/bin:/sbin/nologin 2
daemon:x:2:2:daemon:/sbin:/sbin/nologin 3
adm:x:3:4:adm:/var/adm:/sbin/nologin 4
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin 5
sync:x:5:0:sync:/sbin:/bin/sync 6
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown 7
halt:x:7:0:halt:/sbin:/sbin/halt 8
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin 9
operator:x:11:0:operator:/root:/sbin/nologin 10
games:x:12:100:games:/usr/games:/sbin/nologin 11
ftp:x:14:50:FTP 12
nobody:x:99:99:Nobody:/:/sbin/nologin 13
systemd-network:x:192:192:systemd 14
dbus:x:81:81:System 15
polkitd:x:999:998:User 16
abrt:x:173:173::/etc/abrt:/sbin/nologin 17
libstoragemgmt:x:998:996:daemon 18
rpc:x:32:32:Rpcbind 19
colord:x:997:995:User 20
saslauth:x:996:76:Saslauthd 21
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin 22
pulse:x:171:171:PulseAudio 23
chrony:x:995:991::/var/lib/chrony:/sbin/nologin 24
rpcuser:x:29:29:RPC 25
nfsnobody:x:65534:65534:Anonymous 26
ntp:x:38:38::/etc/ntp:/sbin/nologin 27
tss:x:59:59:Account 28
usbmuxd:x:113:113:usbmuxd 29
geoclue:x:994:989:User 30
qemu:x:107:107:qemu 31
radvd:x:75:75:radvd 32
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin 33
sssd:x:992:987:User 34
gdm:x:42:42::/var/lib/gdm:/sbin/nologin 35
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin 36
sshd:x:74:74:Privilege-separated 37
avahi:x:70:70:Avahi 38
postfix:x:89:89::/var/spool/postfix:/sbin/nologin 39
tcpdump:x:72:72::/:/sbin/nologin 40
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash 41
[root@localhost ~]#awk '{print NR,$1}' /etc/passwd
1 root:x:0:0:root:/root:/bin/bash
2 bin:x:1:1:bin:/bin:/sbin/nologin
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
7 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8 halt:x:7:0:halt:/sbin:/sbin/halt
9 mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10 operator:x:11:0:operator:/root:/sbin/nologin
11 games:x:12:100:games:/usr/games:/sbin/nologin
12 ftp:x:14:50:FTP
13 nobody:x:99:99:Nobody:/:/sbin/nologin
14 systemd-network:x:192:192:systemd
15 dbus:x:81:81:System
16 polkitd:x:999:998:User
17 abrt:x:173:173::/etc/abrt:/sbin/nologin
18 libstoragemgmt:x:998:996:daemon
19 rpc:x:32:32:Rpcbind
20 colord:x:997:995:User
21 saslauth:x:996:76:Saslauthd
22 rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
23 pulse:x:171:171:PulseAudio
24 chrony:x:995:991::/var/lib/chrony:/sbin/nologin
25 rpcuser:x:29:29:RPC
26 nfsnobody:x:65534:65534:Anonymous
27 ntp:x:38:38::/etc/ntp:/sbin/nologin
28 tss:x:59:59:Account
29 usbmuxd:x:113:113:usbmuxd
30 geoclue:x:994:989:User
31 qemu:x:107:107:qemu
32 radvd:x:75:75:radvd
33 setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
34 sssd:x:992:987:User
35 gdm:x:42:42::/var/lib/gdm:/sbin/nologin
36 gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
37 sshd:x:74:74:Privilege-separated
38 avahi:x:70:70:Avahi
39 postfix:x:89:89::/var/spool/postfix:/sbin/nologin
40 tcpdump:x:72:72::/:/sbin/nologin
41 ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
8.3.2行范围用法
[root@localhost ~]#awk 'NR==2{print $1}' /etc/passwd
#只取第二行的第一个字段
bin:x:1:1:bin:/bin:/sbin/nologin
[root@localhost ~]#awk 'NR==1{print $1}' /etc/passwd
#只取第一行的第一个字段
root:x:0:0:root:/root:/bin/bash
[root@localhost ~]#awk 'NR==1,NR==3{print}' /etc/passwd
#打印出1行到3行
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#awk 'NR==1||NR==3{print}' /etc/passwd
#打印出1行和3行
root:x:0:0:root:/root:/bin/bash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#awk '(NR%2)==0{print NR}' /etc/passwd
#打印出函数取余为0的行（偶数行）
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
[root@localhost ~]#awk '(NR%2)==1{print NR}' /etc/passwd
#打印出函数取余为1的行（奇数行）
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37
39
41
[root@localhost ~]#awk 'NR>=3 && NR<=6{print NR,$0}' /etc/passwd
#打印出3行到6行 显示行号 并打印出内容
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
[root@localhost ~]#seq 10|awk 'NR>5 && NR<10'
#打印出大于5小于10的数
6
7
8
9
[root@localhost ~]#awk -F: '$3>1000{print}' /etc/passwd
#打印出普通用户 第三列大于1000的行
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
8.4找到10:00到11：00的日志
8.4.1通过awk找
awk '/10/,//11/' 文件名
8.4.2通过sed找
sed -nr '/10/,/11/p' 文件名
8.5关系表达式——或且非
关系表达式结果为“真”才会被处理
真：结果为非0值，非空字符串
假：结果为空字符串或0值
8.5.1或且非
8.5.2取反——奇偶
8.6条件判断
awk 选项 '模式{actions}'
条件判断写在actions里
8.6.1语法
if(condition){statement;…}[else statement]
if(condition1){statement1}else if(condition2){statement2}else if(condition3){statement3}...... else {statementN}
condition：条件
statement：语句
8.6.2格式
if语句：awk的if语句也分为单分支、双分支和多分支
- 单分支为if(判断条件){执行语句}
- 双分支为if(判断条件){执行语句}else{执行语句}
- 多分支为if(判断条件){执行语句}else if(判断条件){执行语句}else if(判断条件){执行语句}else if(判断条件){执行语句
示例：
awk -F: '{if($3>1000){print $1,$3}else{print $3}}' /etc/passwd
#如果第三列大于1000，那么就输出第三列
0
1
2
3
4
5
6
7
8
11
12
14
99
192
81
999
173
998
32
997
996
172
171
995
29
nfsnobody 65534
38
59
113
994
107
75
993
992
42
991
74
70
89
72
10008.6.3总结
条件判断的格式为： '{if（条件判断）{命令序列1}else{命令序列2}}'
9.循环——for while
9.1格式
for(expr1;expr2;expr3) {statement;…}
for(variable assignment;condition;iteration process) {for-body}
for(var in array) {for-body}
9.2示例
9.2.1计算
[root@localhost ~]#awk 'BEGIN{i=0;print i++,i}'
0 1
[root@localhost ~]#awk 'BEGIN{i=0;print ++i,i}'
1 1
[root@localhost ~]#awk 'BEGIN{x=0;print x}'
0
[root@localhost ~]#awk 'BEGIN{x=10;print x}'
10
[root@localhost ~]#awk 'BEGIN{x=10;print x+1}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
11
[root@localhost ~]#awk 'BEGIN{x=10;x++;print x}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
11
[root@localhost ~]#awk 'BEGIN{x=10;x++;print x+1}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
12
[root@localhost ~]#awk 'BEGIN{print x+1}'
#不指定初始值，初始值就为0，如果是字符串，则默认为空
1
[root@localhost ~]#awk 'BEGIN{print 2.5+3.5}'
#小数也可以运算
6
[root@localhost ~]#awk 'BEGIN{print 5-3}'
2
[root@localhost ~]#awk 'BEGIN{print 6*6}'
36
[root@localhost ~]#awk 'BEGIN{print 3**2}'
#幂运算
9
[root@localhost ~]#awk 'BEGIN{print 2^3}'
#幂运算
8
[root@localhost ~]#awk 'BEGIN{print 1/2}'
0.510.awk数组
awk数组特性
- awk的数组是关联数组(即key/value方式的hash数据结构)，索引下标可为数值(甚至是负数、小数等)，也可为字符串
- awk数组支持数组的数组
- 在内部，awk数组的索引全都是字符串，即使是数值索引在使用时内部也会转换成字符串
- awk的数组元素的顺序和元素插入时的顺序很可能是不相同的
10.1访问、赋值数组元素
索引可以是整数、负数、0、小数、字符串。如果是数值索引，会按照CONVFMT变量指定的格式先转换成字符串
[root@localhost ~]#awk 'BEGIN{a[1]="cxk";print a[1]}'
cxk
[root@localhost ~]#awk 'BEGIN{a[1]="cxk";b[2]="wsc";print a[1]}'
cxk
[root@localhost ~]#awk 'BEGIN{a[1]="cxk";b[2]="wsc";print b[2]}'
wsc[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["cc"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk
[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["cc"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk
[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["bb"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk
关联数组，数组的位置是随机的
10.1.1统计系统状态
方法一
[root@localhost ~]#ss -natp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=44))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1486,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1379,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1011,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1012,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1233,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1535,fd=9))
ESTAB 0 132 192.168.241.11:22 192.168.241.1:52599 users:(("sshd",pid=1535,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=43))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1011,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1012,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1233,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'|sort|uniq -c
1 ESTAB
12 LISTEN方法二
[root@localhost ~]#ss -natp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=44))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1486,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1379,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1011,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1012,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1233,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1535,fd=9))
ESTAB 0 36 192.168.241.11:22 192.168.241.1:52599 users:(("sshd",pid=1535,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=43))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1011,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1012,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1233,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'
LISTEN 12
ESTAB 1
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'|sort
ESTAB 1
LISTEN 12
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'|sort|uniq -c
1 ESTAB 1
1 LISTEN 12方法三
[root@localhost ~]#ss -natp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=44))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1486,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1379,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1011,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1012,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1233,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1535,fd=9))
ESTAB 0 36 192.168.241.11:22 192.168.241.1:52599 users:(("sshd",pid=1535,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=43))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1011,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1012,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1233,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'|sort|uniq -c
1 ESTAB
12 LISTEN10.1.2去重
[root@localhost ~]#vim test
aa
bb
cc
dd
aa
aa
cc
dd
[root@localhost ~]#awk '!line[$0]++' test
aa
bb
cc
dd
[root@localhost ~]#awk 'line[$0]++' test
aa
aa
cc
dd
[root@localhost ~]#cat test
aa
bb
cc
dd
aa
aa
cc
dd
[root@localhost ~]#awk '!line[$0]++' test
aa
bb
cc
dd
[root@localhost ~]#cat test
aa
bb
cc
dd
aa
aa
cc
dd
dd
cc
bb10.2数组长度
awk提供了 length() 函数来获取数组的元素个数，它也可以用于获取字符串的字符数量。还可以获取数值转换成字符串后的字符数量
将下标转换成字母a；aa后就不确定
10.3遍历数组
for（var in array）{for-body}
11.awk脚本——将awk程序写入脚本，调用或执行
[root@localhost ~]#vim test.awk
{if($3>=1000)print $1,$3}
[root@localhost ~]#awk -F: -f test.awk /etc/passwd
nfsnobody 65534
ghd 1000四、扩展
1.提取下面的字段中IP地址和时间
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
1.1方法一——使用awk提取（三种方法）
[root@localhost ~]#vim test
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"]" '{print $1}'
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800
[root@localhost ~]#cat test |awk -F"]" '{print $1}'|awk '{print $1,$4}'
58.87.87.99 [09/Jun/2020:03:42:43
128.14.209.154 [09/Jun/2020:03:42:43
64.90.40.100 [09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"]" '{print $1}'|awk '{print $1,$4}'|tr -d
[
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11[root@localhost ~]#cat test
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1}'
58.87.87.99
128.14.209.154
64.90.40.100
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1,$5}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1"\t"$5}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $4}'
09/Jun/2020:03:42:43
09/Jun/2020:03:42:43
09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $1,$4}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $1"\t"$4}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:111.2方法二——使用sed提取
[root@localhost ~]#cat test
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |sed -nr 's/(.*)- - .*/\1/p'
58.87.87.99
128.14.209.154
64.90.40.100
[root@localhost ~]#cat test |sed -nr 's/(.*)- - \[(.*) \+.*/\1\2/p'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |sed -nr 's/(.*)- - \[(.*) \+.*/\1 \2/p'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
2.提取host.txt主机名后再放回host.txt文件
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
2.1方法一——使用awk提取
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |awk -F"[ .]" '{print $2}'
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |awk -F"[ .]" '{print $2}' >> host.txt
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog2.2方法二——使用cut、tr命令提取
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |cut -d "." -f1
1 www
2 mail
3 ftp
4 linux
5 blog
[root@localhost ~]#cat host.txt |cut -d "." -f1|tr -d "[0-9 ]"
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |cut -d "." -f1|tr -d "[0-9 ]" >>host.txt
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog
2.3方法三——使用sed命令提取
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |sed -nr 's/[0-9] (.*)\.kgc\.com/\1/p'
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |sed -nr 's/[0-9] (.*)\.kgc\.com/\1/p' >> host.txt
[root@localhost ~]#cat host.txt
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog
3.统计/etc/fstab文件中每个文件系统类型出现的次数
[root@localhost ~]#cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Tue Dec 19 00:11:27 2023
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/centos-root / xfs defaults 0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot xfs defaults 0 0
/dev/mapper/centos-swap swap swap defaults 0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"
/dev/mapper/centos-root / xfs defaults 0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot xfs defaults 0 0
/dev/mapper/centos-swap swap swap defaults 0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"
/dev/mapper/centos-root / xfs defaults 0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot xfs defaults 0 0
/dev/mapper/centos-swap swap swap defaults 0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'
xfs
xfs
swap
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'|sort
swap
xfs
xfs
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'|sort|uniq -c
1 swap
2 xfs
4.统计/etc/fstab文件中每个真单词出现的次数
[root@localhost ~]#cat /etc/fstab |grep -Eo "\b[a-zA-Z]+\b"
etc
fstab
Created
by
anaconda
on
Tue
Dec
Accessible
filesystems
by
reference
are
maintained
under
dev
disk
See
man
pages
fstab
findfs
mount
and
or
blkid
for
more
info
dev
mapper
centos
root
xfs
defaults
UUID
boot
xfs
defaults
dev
mapper
centos
swap
swap
swap
defaults
[root@localhost ~]#cat /etc/fstab |grep -Eo "\b[[:alpha:]]+\b"
etc
fstab
Created
by
anaconda
on
Tue
Dec
Accessible
filesystems
by
reference
are
maintained
under
dev
disk
See
man
pages
fstab
findfs
mount
and
or
blkid
for
more
info
dev
mapper
centos
root
xfs
defaults
UUID
boot
xfs
defaults
dev
mapper
centos
swap
swap
swap
defaults
5.提取出字符串中的所有数字
Yd$C@M05MB%9&Bdh7dq+YVixp3vpw
[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"
Yd@M05MB%9&Bdh7dq+YVixp3vpw
[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|grep [0-9]
Yd@M05MB%9&Bdh7dq+YVixp3vpw
[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|grep -o [0-9]
0
5
9
7
36.查出/tmp/的权限，以数字方式显示
[root@localhost ~]#stat /tmp
文件："/tmp"
大小：4096 块：8 IO 块：4096 目录
设备：fd00h/64768d Inode：33554504 硬链接：14
权限：(1777/drwxrwxrwt) Uid：( 0/ root) Gid：( 0/ root)
最近访问：2016-11-05 23:38:36.000000000 +0800
最近更改：2024-01-30 20:18:34.957891615 +0800
最近改动：2024-01-30 20:18:34.957891615 +0800
创建时间：-
[root@localhost ~]#stat /tmp|awk -F"[(/]" 'NR==4{print $2}'
17777.查出用户UID最大值的用户名、UID及shell类型
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}' /etc/passwd
nfsnobody 65534
ghd 1000
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}' /etc/passwd|sort -n
ghd 1000
nfsnobody 65534
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3,$7}' /etc/passwd|sort -n
ghd 1000 /bin/bash
nfsnobody 65534 /sbin/nologin8.提取主机名并放入原文件
http://mail.kgc.com/index.html
http://www.kgc.com/test.html
http://study.kgc.com/index.html
http://blog.kgc.com/index.html
http://www.kgc.com/images/logo.jpg
http://blog.kgc.com/20080102.html
http://www.kgc.com/images/kgc.jpg
[root@localhost ~]#cat test
http://mail.kgc.com/index.html
http://www.kgc.com/test.html
http://study.kgc.com/index.html
http://blog.kgc.com/index.html
http://www.kgc.com/images/logo.jpg
http://blog.kgc.com/20080102.html
http://www.kgc.com/images/kgc.jpg
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'
mail
www
study
blog
www
blog
www
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'|sort -nr
www
www
www
study
mail
blog
blog
[root@localhost ~]#
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'|sort -nr|uniq -c
3 www
1 study
1 mail
2 blog
[root@localhost ~]#cat test |awk -F[/.] '{print $3}' >> test
[root@localhost ~]#cat test
http://mail.kgc.com/index.html
http://www.kgc.com/test.html
http://study.kgc.com/index.html
http://blog.kgc.com/index.html
http://www.kgc.com/images/logo.jpg
http://blog.kgc.com/20080102.html
http://www.kgc.com/images/kgc.jpg
mail
www
study
blog
www
blog
www