Linux系统——文本三剑客

一、grep

1.格式

2.选项

2.1 grep重定向

2.2grep -m 匹配到几次停止

2.3grep -i 忽略大小写

2.4grep -n 显示行号

2.5grep -c 统计匹配行数

2.6grep -A 后几行

2.7grep -C 前后三行

2.8grep -B 前三行

2.9grep -e 或

2.10grep -w 匹配整个单词

2.11grep -r 快速过滤

2.12扩展

2.12.1统计当前主机连接状态

2.12.2统计当前连接主机数

二、sed——Stream EDitor

1.格式

2.选项

3.脚本格式

3.1sed 'p' 打印

3.2sed -n 关闭自动打印功能

3.3sed -n ‘kp’（k表示数字）直接显示多少行

3.4sed ‘kq’（q表示退出）到第几行退出

3.5sed -n '/^d/,/^g/p' 以d开头开始到以g开头结束

3.6支持正则表达式

3.7扩展——显示日志

3.8奇偶数

3.9sed 'd' 删除

3.10sed -i 修改文件内容（常用于修改配置文件可以在修改之前先进行备份操作）

3.11sed a 在后面追加

3.12sed i 在前面追加

3.13sed c 替换

3.14sed !取反

3.15sed r 将文件传到该文件第二行

3.16sed “=” 换行显示行号

3.17sed可以当作grep使用

4.搜索替代

4.1不打开文件如何修改文件里的内容

4.2 &指代之前找到的内容

4.3 （）代表分组；\1 代表留下的组——分组后向引用

4.3.1分组后向引用

4.3.2提取ip

方法一

方法二

方法三

4.3.3提取版本号

方法一

方法二

4.3.4提取想要的内容（ifcfg-ens33）

4.3.5提取权限大小（以数字显示）

5.变量

5.1变量使用

5.2修改端口

6.sed高级用法

6.1常见的高级命令

6.1.1 sed -n 'N' 读取匹配到的行的下一行追加至模式空间

6.1.2sed 'G' 从保持空间取出内容追加至模式空间（取反）

6.1.3sed -n '{g;1!p;};h'前一行 sed -nr '{n;p}'后一行

6.1.4奇偶显示

7.总结

7.1sed选项

7.2sed命令空间

7.3查找替换

7.3.1固定格式

7.3.2分组后向引用

三、AWK——一种语言

1.含义

2.工作原理

3.执行原理

4.基础用法

4.1选项

4.3awk '{print "hello"}'——有多少行打印多少hello（支持标准输出）

4.4-F "分隔符" 提取内容

4.5BEGIN——仅在开始处理文件中的文本之前执行一次

4.6BEGIN——小型计算器

4.7END——仅在文本处理完成之后执行一次

4.8提取磁盘占用情况

方法一

方法二

方法三

4.9可以提取ip地址

4.9.1sed awk搭配使用

4.9.2hostname -I

4.9.3awk

4.10可以修改输出内容

5.内置变量

5.1格式

5.2 $0，$1，$3

5.3 FS——指定分隔符

5.3.1FS 指定分隔符

5.3.2使用FS分隔符

5.3.3FS与fs

5.4OFS——指定输出时的分隔符

5.5RS——换行

5.6NF——行内字段的个数

5.6.1统计行内字段个数

5.6.2磁盘挂载

5.7NR——统计/显示行号

5.7.1NR——显示行号

5.7.2NR——筛ip行

5.7.3NR!=——取反

5.7.4如何找出当前系统中的普通用户

5.8FNR——查看多个文件各有多少行

5.9FILENAME——显示处理的文件名

6.自定义变量

7.printf

7.1%s——显示字符串

8.模式PATTERN

8.1模式为空——每一行都匹配成功，没有额外条件

8.2正则匹配——仅能处理匹配到达的行，需要用/ /括起来

8.3line ranges——行范围

8.3.1显示行号

8.3.2行范围用法

8.4找到10:00到11：00的日志

8.4.1通过awk找

8.4.2通过sed找

8.5关系表达式——或且非

8.5.1或且非

8.5.2取反——奇偶

8.6条件判断

8.6.1语法

8.6.2格式

8.6.3总结

9.循环——for while

9.1格式

9.2示例

9.2.1计算

10.awk数组

10.1访问、赋值数组元素

10.1.1统计系统状态

方法一

方法二

方法三

10.1.2去重

10.2数组长度

10.3遍历数组

11.awk脚本——将awk程序写入脚本，调用或执行

四、扩展

1.提取下面的字段中IP地址和时间

1.1方法一——使用awk提取（三种方法）

1.2方法二——使用sed提取

2.提取host.txt主机名后再放回host.txt文件

2.1方法一——使用awk提取

2.2方法二——使用cut、tr命令提取

2.3方法三——使用sed命令提取

3.统计/etc/fstab文件中每个文件系统类型出现的次数

4.统计/etc/fstab文件中每个真单词出现的次数

5.提取出字符串中的所有数字

6.查出/tmp/的权限，以数字方式显示

7.查出用户UID最大值的用户名、UID及shell类型

8.提取主机名并放入原文件

[root@localhost ~]#locale
LANG=zh_CN.UTF-8
LC_CTYPE="zh_CN.UTF-8"
#语言符号及其分类(LC_CTYPE)
LC_NUMERIC="zh_CN.UTF-8"
#数字(LC_NUMERIC)
LC_TIME="zh_CN.UTF-8"
#时间显示格式(LC_TIME)
LC_COLLATE="zh_CN.UTF-8"
#比较和排序习惯(LC_COLLATE)
LC_MONETARY="zh_CN.UTF-8"
#货币单位(LC_MONETARY)
LC_MESSAGES="zh_CN.UTF-8"
#信息主要是提示信息,错误信息,状态信息,标题,标签,按钮和菜单等(LC_MESSAGES)
LC_PAPER="zh_CN.UTF-8"
#默认纸张尺寸大小(LC_PAPER)
LC_NAME="zh_CN.UTF-8"
#姓名书写方式(LC_NAME)
LC_ADDRESS="zh_CN.UTF-8"
#地址书写方式(LC_ADDRESS)
LC_TELEPHONE="zh_CN.UTF-8"
#电话号码书写方式(LC_TELEPHONE)
LC_MEASUREMENT="zh_CN.UTF-8"
#度量衡表达方式 (LC_MEASUREMENT)
LC_IDENTIFICATION="zh_CN.UTF-8"
#对locale自身包含信息的概述(LC_IDENTIFICATION)
LC_ALL=

一、grep

1.格式

grep格式： grep [选项] 查找条件目标文件

[root@localhost ~]#grep
用法: grep [选项]... PATTERN [FILE]...
试用‘grep --help’来获得更多信息。
[root@localhost ~]#grep --help
用法: grep [选项]... PATTERN [FILE]...
在每个 FILE 或是标准输入中查找 PATTERN。
默认的 PATTERN 是一个基本正则表达式(缩写为 BRE)。
例如: grep -i 'hello world' menu.h main.c正则表达式选择与解释:-E, --extended-regexp     PATTERN 是一个可扩展的正则表达式(缩写为 ERE)-F, --fixed-strings       PATTERN 是一组由断行符分隔的定长字符串。-G, --basic-regexp        PATTERN 是一个基本正则表达式(缩写为 BRE)-P, --perl-regexp         PATTERN 是一个 Perl 正则表达式-e, --regexp=PATTERN      用 PATTERN 来进行匹配操作-f, --file=FILE           从 FILE 中取得 PATTERN-i, --ignore-case         忽略大小写-w, --word-regexp         强制 PATTERN 仅完全匹配字词-x, --line-regexp         强制 PATTERN 仅完全匹配一行-z, --null-data           一个 0 字节的数据行，但不是空行Miscellaneous:-s, --no-messages         suppress error messages-v, --invert-match        select non-matching lines-V, --version             display version information and exit--help                display this help text and exit输出控制:-m, --max-count=NUM       NUM 次匹配后停止-b, --byte-offset         输出的同时打印字节偏移-n, --line-number         输出的同时打印行号--line-buffered       每行输出清空-H, --with-filename       为每一匹配项打印文件名-h, --no-filename         输出时不显示文件名前缀--label=LABEL         将LABEL 作为标准输入文件名前缀-o, --only-matching       show only the part of a line matching PATTERN-q, --quiet, --silent     suppress all normal output--binary-files=TYPE   assume that binary files are TYPE;TYPE is 'binary', 'text', or 'without-match'-a, --text                equivalent to --binary-files=text-I                        equivalent to --binary-files=without-match-d, --directories=ACTION  how to handle directories;ACTION is 'read', 'recurse', or 'skip'-D, --devices=ACTION      how to handle devices, FIFOs and sockets;ACTION is 'read' or 'skip'-r, --recursive           like --directories=recurse-R, --dereference-recursivelikewise, but follow all symlinks--include=FILE_PATTERNsearch only files that match FILE_PATTERN--exclude=FILE_PATTERNskip files and directories matching FILE_PATTERN--exclude-from=FILE   skip files matching any file pattern from FILE--exclude-dir=PATTERN directories that match PATTERN will be skipped.-L, --files-without-match print only names of FILEs containing no match-l, --files-with-matches  print only names of FILEs containing matches-c, --count               print only a count of matching lines per FILE-T, --initial-tab         make tabs line up (if needed)-Z, --null                print 0 byte after FILE name文件控制:-B, --before-context=NUM  打印以文本起始的NUM 行-A, --after-context=NUM   打印以文本结尾的NUM 行-C, --context=NUM         打印输出文本NUM 行-NUM                      same as --context=NUM--group-separator=SEP use SEP as a group separator--no-group-separator  use empty string as a group separator--color[=WHEN],--colour[=WHEN]       use markers to highlight the matching strings;WHEN is 'always', 'never', or 'auto'-U, --binary              do not strip CR characters at EOL (MSDOS/Windows)-u, --unix-byte-offsets   report offsets as if CRs were not there(MSDOS/Windows)‘egrep’即‘grep -E’。‘fgrep’即‘grep -F’。
直接使用‘egrep’或是‘fgrep’均已不可行了。
若FILE 为 -，将读取标准输入。不带FILE，读取当前目录，除非命令行中指定了-r 选项。
如果少于两个FILE 参数，就要默认使用-h 参数。
如果有任意行被匹配，那退出状态为 0，否则为 1；
如果有错误产生，且未指定 -q 参数，那退出状态为 2。请将错误报告给: bug-grep@gnu.org
GNU Grep 主页: <http://www.gnu.org/software/grep/>
GNU 软件的通用帮助: <http://www.gnu.org/gethelp/>

2.选项

选项	含义
-color=auto	对匹配到的文本着色显示
-m	匹配到几次停止匹配到几行停止
-v	反选
-i	忽略字符大小写
-n	显示匹配的行号
-c	统计匹配的行数
-o	仅显示匹配到的字符串
-q	静默模式不输出信息（常用在写脚本里类似于将输出信息&>/dev/null）
-A	A（After）后几行
-B	B（Before）前几行
-C	C（Context）前后各几行
-e	实现多个选项间的逻辑关系，如grep -e 'cat' -e 'dog' file；grep -E root\|bash /etc/passwd
-w	匹配整个单词
-E	使用ERE（扩展正则表达式）相当于egrep
-F	不支持正则表达式，相当于fgrep
-f	file 根据模式文件，处理两个文件相同内容，把第一个文件作为匹配条件
-r	递归目录，但不处理软连接快速过滤
-R	递归目录，但处理软连接

2.1 grep重定向

grep支持标准输入和标准输出

2.2grep -m 匹配到几次停止

2.3grep -i 忽略大小写

2.4grep -n 显示行号

2.5grep -c 统计匹配行数

2.6grep -A 后几行

2.7grep -C 前后三行

2.8grep -B 前三行

2.9grep -e 或

2.10grep -w 匹配整个单词

2.11grep -r 快速过滤

2.12扩展

2.12.1统计当前主机连接状态

[root@localhost ~]#ss -natp|grep -v '^State'
LISTEN     0      128          *:111                      *:*                   users:(("systemd",pid=1,fd=40))
LISTEN     0      128          *:10000                    *:*                   users:(("miniserv.pl",pid=1529,fd=4))
LISTEN     0      5      192.168.122.1:53                       *:*                   users:(("dnsmasq",pid=1461,fd=6))
LISTEN     0      128          *:22                       *:*                   users:(("sshd",pid=1005,fd=3))
LISTEN     0      128    127.0.0.1:631                      *:*                   users:(("cupsd",pid=1008,fd=12))
LISTEN     0      100    127.0.0.1:25                       *:*                   users:(("master",pid=1237,fd=13))
LISTEN     0      128    127.0.0.1:6010                     *:*                   users:(("sshd",pid=1074,fd=9))
ESTAB      0      0      192.168.241.11:22                 192.168.241.1:61187               users:(("sshd",pid=1074,fd=3))
LISTEN     0      128         :::111                     :::*                   users:(("systemd",pid=1,fd=39))
LISTEN     0      128         :::22                      :::*                   users:(("sshd",pid=1005,fd=4))
LISTEN     0      128        ::1:631                     :::*                   users:(("cupsd",pid=1008,fd=11))
LISTEN     0      100        ::1:25                      :::*                   users:(("master",pid=1237,fd=14))
LISTEN     0      128        ::1:6010                    :::*                   users:(("sshd",pid=1074,fd=8))
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|grep -v '^State'|cut -d " " -f1|sort|uniq -c1 ESTAB12 LISTEN

2.12.2统计当前连接主机数

[root@localhost ~]#ss -natp|tr -s " "
State Recv-Q Send-Q Local Address:Port Peer Address:Port 
LISTEN 0 128 *:111 *:* users:(("systemd",pid=1,fd=40))
LISTEN 0 128 *:10000 *:* users:(("miniserv.pl",pid=1529,fd=4))
LISTEN 0 5 192.168.122.1:53 *:* users:(("dnsmasq",pid=1461,fd=6))
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1005,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1008,fd=12))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1237,fd=13))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=1074,fd=9))
ESTAB 0 36 192.168.241.11:22 192.168.241.1:61187 users:(("sshd",pid=1074,fd=3))
LISTEN 0 128 :::111 :::* users:(("systemd",pid=1,fd=39))
LISTEN 0 128 :::22 :::* users:(("sshd",pid=1005,fd=4))
LISTEN 0 128 ::1:631 :::* users:(("cupsd",pid=1008,fd=11))
LISTEN 0 100 ::1:25 :::* users:(("master",pid=1237,fd=14))
LISTEN 0 128 ::1:6010 :::* users:(("sshd",pid=1074,fd=8))
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5
Address:Port
*:*
*:*
*:*
*:*
*:*
*:*
*:*
192.168.241.1:61187
:::*
:::*
:::*
:::*
:::*
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1
Address
*
*
*
*
*
*
*
192.168.241.1[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1|sort*
*
*
*
*
*
*
192.168.241.1
Address
[root@localhost ~]#ss -natp|tr -s " "|cut -d " " -f5|cut -d ":" -f1|sort|uniq -c5 7 *1 192.168.241.11 Address

二、sed——Stream EDitor

和vi不同 sed是行编辑器

Sed是从文件或管道中读取一行，处理一行，输出一行；再读取一行，再处理一行，再输出一行，直到最后一行。每当处理一行时，把当前处理的行存储在临时缓冲区中，称为模式空间（PatternSpace），接着用sed命令处理缓冲区中的内容，处理完成后，把缓冲区的内容送往屏幕。接着处理下一行，这样不断重复，直到文件末尾。一次处理一行的设计模式使得sed性能很高，sed在读取大文件时不会出现卡顿的现象。如果使用vi命令打开几十M上百M的文件，明显会出现有卡顿的现象，这是因为vi命令打开文件是一次性将文件加载到内存，然后再打开。Sed就避免了这种情况，一行一行的处理，打开速度非常快，执行速度也很快

1.格式

sed 选项 ‘语法’ 文件或标准输出

sed [option]... ‘script；script；...’ [input file...]

选项自身脚本语法支持标准输入和管道

sed ‘ ’表示查看文件内容

sed也支持管道符

2.选项

[root@localhost ~]#sed --help
用法: sed [选项]... {脚本(如果没有其他脚本)} [输入文件]...-n, --quiet, --silent取消自动打印模式空间-e 脚本, --expression=脚本添加“脚本”到程序的运行列表-f 脚本文件, --file=脚本文件添加“脚本文件”到程序的运行列表--follow-symlinks直接修改文件时跟随软链接-i[SUFFIX], --in-place[=SUFFIX]edit files in place (makes backup if SUFFIX supplied)-c, --copyuse copy instead of rename when shuffling files in -i mode-b, --binarydoes nothing; for compatibility with WIN32/CYGWIN/MSDOS/EMX (open files in binary mode (CR+LFs are not treated specially))-l N, --line-length=N指定“l”命令的换行期望长度--posix关闭所有 GNU 扩展-r, --regexp-extended在脚本中使用扩展正则表达式-s, --separate将输入文件视为各个独立的文件而不是一个长的连续输入-u, --unbuffered从输入文件读取最少的数据，更频繁的刷新输出-z, --null-dataseparate lines by NUL characters--helpdisplay this help and exit--versionoutput version information and exit如果没有 -e, --expression, -f 或 --file 选项，那么第一个非选项参数被视为
sed脚本。其他非选项参数被视为输入文件，如果没有输入文件，那么程序将从标准
输入读取数据。
GNU sed home page: <http://www.gnu.org/software/sed/>.
General help using GNU software: <http://www.gnu.org/gethelp/>.
E-mail bug reports to: <bug-sed@gnu.org>.
Be sure to include the word ``sed'' somewhere in the ``Subject:'' field.

选项	含义
-n	不输出模式空间内容到屏幕，即不自动打印
-e	多点编辑
-f	FILE 从指定文件中读取编辑脚本
-r -E	使用扩展正则表达式
-i.bak	备份文件并原处编辑

3.脚本格式

sed 单引号中间需要写脚本； ‘地址+命令’
不给地址：对全文进行处理（比如行号）
单地址：#：指定的行；$：最后一行；/PATTERN：被此处模式所能够匹配到的每一行
地址范围：#，# 从第几行到第几行（3,6从第三行到第六行）；#，+#从第几行到+的第几行（3，+4，代表从第三行到第七行）；/part1，/part2，第一个正则表达式和第二个正则表达式之间的行；#，/part，从#号开始找直到part为止；/part，#，找到#号个part为止
步进：~ 1~2奇数行 2~2偶数行

命令	选项
p	打印当前模式空间内容，追加到默认输出之后
Ip	忽略大小写输出
d	删除模式空间匹配的行，并立即启用下一轮循环
a[\]text	在指定行后面追加文本，支持使用\n实现多行追加
i[\]text	在行前面插入文本
c[\]text	替换行为单行或多行文本
w file	保存模式匹配的行至指定文件
r file	读取指定文件的文本至模式空间中匹配到的行后
=	为模式空间中的行打印行号
！	模式空间中匹配行取反处理
q	结束或退出sed

3.1sed 'p' 打印

[root@localhost ~]#seq 10 | sed 'p'
#带有自动打印功能，p又再打印一遍
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
10

3.2sed -n 关闭自动打印功能

[root@localhost ~]#seq 10 | sed -n 'p'
#-n 选项关闭自动打印功能
1
2
3
4
5
6
7
8
9
10

3.3sed -n ‘kp’（k表示数字）直接显示多少行

3.4sed ‘kq’（q表示退出）到第几行退出

3.5sed -n '/^d/,/^g/p' 以d开头开始到以g开头结束

3.6支持正则表达式

3.7扩展——显示日志

[root@localhost opt]#sed -n '/2018:09:37:18/,/2018:10:23:43/p' access_log\(2\) 
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:21 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:37:24 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:40:18 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:36 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:42:37 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:54:03 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "OPTIONS /magedu30 HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:53 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.103 - - [20/May/2018:09:54:54 +0800] "PROPFIND /magedu30 HTTP/1.1" 405 310 "-" "Microsoft-WebDAV-MiniRedir/10.0.17134"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:05 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.16.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.16.102.29 - - [20/May/2018:09:57:11 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.16.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:13 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:16 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:03:20 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:05:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:05:57 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.108.10 - - [20/May/2018:10:06:00 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.127 - - [20/May/2018:10:07:22 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.130 - - [20/May/2018:10:11:47 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:15:08 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:28 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:31 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.104 - - [20/May/2018:10:16:33 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.37.22 - - [20/May/2018:10:17:25 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.18.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.18.118.132 - - [20/May/2018:10:21:40 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.18.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "POST /webnoauth/model.cgi HTTP/1.1" 404 293 "http://172.20.0.1/webnoauth/model.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:41 +0800] "GET /router/get_rand_key.cgi HTTP/1.1" 404 297 "http://172.20.0.1/router/get_rand_key.cgi" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"
172.20.107.134 - - [20/May/2018:10:23:43 +0800] "GET / HTTP/1.1" 200 912 "-" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)"

3.8奇偶数

3.9sed 'd' 删除

3.10sed -i 修改文件内容（常用于修改配置文件可以在修改之前先进行备份操作）

[root@localhost ~]#seq 10 >test.txt
[root@localhost ~]#cat test.txt 
1
2
3
4
5
6
7
8
9
10
[root@localhost ~]#sed -i.cxk '2~2d' test.txt 
[root@localhost ~]#cat test.txt
1
3
5
7
9
[root@localhost ~]#ls
anaconda-ks.cfg       test.txt.cxk               模板  文档  桌面
initial-setup-ks.cfg  webmin-2.100-1.noarch.rpm  视频  下载
test.txt              公共                       图片  音乐
[root@localhost ~]#cat test.txt.cxk 
1
2
3
4
5
6
7
8
9
10

3.11sed a 在后面追加

3.12sed i 在前面追加

3.13sed c 替换

3.14sed !取反

3.15sed r 将文件传到该文件第二行

[root@localhost ~]#vim testS
M
L
XL[root@localhost ~]#vim /etc/issue\S
Kernel \r on an \m[root@localhost ~]#sed '2r /etc/issue'  test
S
M
\S
Kernel \r on an \mL
XL

3.16sed “=” 换行显示行号

[root@localhost ~]#sed "=" /etc/passwd
1
root:x:0:0:root:/root:/bin/bash
2
bin:x:1:1:bin:/bin:/sbin/nologin
3
daemon:x:2:2:daemon:/sbin:/sbin/nologin
4
adm:x:3:4:adm:/var/adm:/sbin/nologin
5
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6
sync:x:5:0:sync:/sbin:/bin/sync
7
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8
halt:x:7:0:halt:/sbin:/sbin/halt
9
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10
operator:x:11:0:operator:/root:/sbin/nologin
11
games:x:12:100:games:/usr/games:/sbin/nologin
12
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
13
nobody:x:99:99:Nobody:/:/sbin/nologin
14
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
15
dbus:x:81:81:System message bus:/:/sbin/nologin
16
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
17
abrt:x:173:173::/etc/abrt:/sbin/nologin
18
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
19
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
20
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
21
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
22
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
23
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
24
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
25
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
26
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
27
ntp:x:38:38::/etc/ntp:/sbin/nologin
28
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
29
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
30
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
31
qemu:x:107:107:qemu user:/:/sbin/nologin
32
radvd:x:75:75:radvd user:/:/sbin/nologin
33
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
34
sssd:x:992:987:User for sssd:/:/sbin/nologin
35
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
36
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
37
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
38
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
39
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
40
tcpdump:x:72:72::/:/sbin/nologin
41
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash

3.17sed可以当作grep使用

4.搜索替代

格式：s/pattern/string/修饰符

查找替换，支持使用其他分隔符，可以是其它形式（s@@@；s###）

替换修饰符
修饰符	含义
g	行内全局替换
p	显示替换成功的行
w	/PATH/FILE 将替换成功的行保存至文件中
I，i	忽略大小写

4.1不打开文件如何修改文件里的内容

[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#sed 's/root/admin/g' /etc/passwd
admin:x:0:0:admin:/admin:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/admin:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash

4.2 &指代之前找到的内容

[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#sed 's/root/&er/g' /etc/passwd
rooter:x:0:0:rooter:/rooter:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/rooter:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash

4.3 （）代表分组；\1 代表留下的组——分组后向引用

4.3.1分组后向引用

[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1/'
123
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2/'
123abc
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2\3/'
123abcxyz

r表示扩展正则表达式

4.3.2提取ip

方法一

方法二

方法三

4.3.3提取版本号

方法一

[root@localhost ~]#vim testant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar[root@localhost ~]#cat test 
ant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar
[root@localhost ~]#sed -nr 's/.*-(.*).jar/\1/p'
^C
[root@localhost ~]#sed -nr 's/.*-(.*).jar/\1/p' test 
1.9.7
1.9.7
2.7.7
3.4
1.0
0.7.6
5.0.4
1.9.5
1.64
1.46
1.64
2.5.5

方法二

[root@localhost ~]#cat test 
ant-1.9.7.jar
ant-launcher-1.9.7.jar
antlr-2.7.7.jar
antlr-runtime-3.4.jar
aopalliance-1.0.jar
archaius-core-0.7.6.jar
asm-5.0.4.jar
aspectjweaver-1.9.5.jar
bcpkix-jdk15on-1.64.jar
bcprov-jdk15-1.46.jar
bcprov-jdk15on-1.64.jar
checker-compat-qual-2.5.5.jar
[root@localhost ~]#rev test 
raj.7.9.1-tna
raj.7.9.1-rehcnual-tna
raj.7.7.2-rltna
raj.4.3-emitnur-rltna
raj.0.1-ecnaillapoa
raj.6.7.0-eroc-suiahcra
raj.4.0.5-msa
raj.5.9.1-revaewjtcepsa
raj.46.1-no51kdj-xikpcb
raj.64.1-51kdj-vorpcb
raj.46.1-no51kdj-vorpcb
raj.5.5.2-lauq-tapmoc-rekcehc
[root@localhost ~]#rev test |awk -F'raj.' '{print $2}'|awk -F'-' '{print $1}'|rev
1.9.7
1.9.7
2.7.7
3.4
1.0
0.7.6
5.0.4
1.9.5
1.64
1.46
1.64
2.5.5

4.3.4提取想要的内容（ifcfg-ens33）

4.3.5提取权限大小（以数字显示）

5.变量

5.1变量使用

5.2修改端口

6.sed高级用法

插播！我有很多项目，只有一台服务器，如何管理？

启用自配置文件进行维护

sed中除了模式空间，还另外支持保持空间（Hold Space），利用此空间，可以将模式空间中的数量，临时保存至保持空间，从而后续接着处理，实现更为强大的功能

6.1常见的高级命令

命令选项	含义
P	打印模式空间开端至\n内容，并追加到默认输出之前
h	把模式空间中的内容覆盖至保持空间中
H	把模式空间中的内容追加至保持空间中
g	从保持空间中取出数据覆盖至模式空间
G	从保持空间取出内容追加至模式空间
x	把模式空间中的内容与保持空间中的内容进行互换
n	读取匹配到行的下一行覆盖至模式空间
N	读取匹配到的行的下一行追加至模式空间
d	删除模式空间中的行
D	如果模式空间包含换行符，则删除直到第一个换行符的模式空间中的文本，并不会读取新的输入行，而使用合成的模式空间重新启动循环，如果模式空间不包含换行符，则会像发出d命令那样启动正常的新循环

6.1.1 sed -n 'N' 读取匹配到的行的下一行追加至模式空间

6.1.2sed 'G' 从保持空间取出内容追加至模式空间（取反）

[root@localhost ~]#seq 10 |sed '1G;h'
12
3
4
5
6
7
8
9
10
[root@localhost ~]#seq 10 |sed '1G;h;$d'
12
3
4
5
6
7
8
9
[root@localhost ~]#seq 10 |sed '1!G;h'
1
2
1
3
2
1
4
3
2
1
5
4
3
2
1
6
5
4
3
2
1
7
6
5
4
3
2
1
8
7
6
5
4
3
2
1
9
8
7
6
5
4
3
2
1
10
9
8
7
6
5
4
3
2
1
[root@localhost ~]#seq 10 |sed '1!G;h;$!d'
10
9
8
7
6
5
4
3
2
1

6.1.3sed -n '{g;1!p;};h'前一行 sed -nr '{n;p}'后一行

6.1.4奇偶显示

7.总结

7.1sed选项

选项	含义
-n	关闭自动打印
-i	真正修改编辑文件
-i.bak	修改前先备份文件，在源文件后面加上bak也可以写成-i.cxk
-r	扩展正则
-e	多点编辑

7.2sed命令空间

命令	含义
a	在下面插入内容，要像真正修改，需要搭配-i选项使用
i	前面插入
c	替换
p	打印
q	退出
d	删除

7.3查找替换

7.3.1固定格式

s/旧内容（可以使用正则表达式替代）/新内容（固定的字符串）/修饰符

7.3.2分组后向引用

[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1/'
123
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2/'
123abc
[root@localhost ~]#echo 123abcxyz|sed -r 's/(123)(abc)(xyz)/\1\2\3/'
123abcxyz

三、AWK——一种语言

1.含义

AWK（Aho, Weinberger, Kernighan ）报告生成器，格式化文本输出，GNU/Linux发布的AWK目前由自由软件基金会（FSF）进行开发和维护，通常也称它为 GNU AWK。

在 Linux/UNIX 系统中，awk 是一个功能强大的编辑工具，逐行读取输入文本，默认以空格或tab键作为分隔符作为分隔，并按模式或者条件执行编辑命令。而awk比较倾向于将一行分成多个字段然后进行处理。AWK信息的读入也是逐行指定的匹配模式进行查找，对符合条件的内容进行格式化输出或者过滤处理，可以在无交互的情况下实现相当复杂的文本操作，被广泛应用于 Shell 脚本，完成各种自动化配置任务。

有多种版本：

AWK：原先来源于 AT & T 实验室的的AWK
NAWK：New awk，AT & T 实验室的AWK的升级版
GAWK：即GNU AWK。所有的GNU/Linux发布版都自带GAWK，它与AWK和NAWK完全兼容

awk是一种语言，读取一行处理一行

2.工作原理

前面提到 sed 命令常用于一整行的处理,而 awk 比较倾向于将一行分成多个“字段”然后再进行处理，且默认情况下字段的分隔符为空格或 tab 键。awk 执行结果可以通过 print 的功能将字段数据打印显示。

格式：awk [options] 'program' var=value file...

program通常是被放在单引号中，并可以由三种部分组成

BEGIN语句块
模式匹配的通用语句块
END语句块

Program格式 pattern {action statements}

pattern：决定动作语句何时触发及触发事件，比如：BEGIN,END,正则表达式等
action statements：对数据进行处理，放在{}内指明，常见：print, printf

output statements：print,printf
Expressions：算术，比较表达式等
Compound statements：组合语句
Control statements：if, while等
input statements

正则表达式 {print }只有打印；默认打印全部

3.执行原理

第一步：执行BEGIN{action;… }{print}语句块中的语句
第二步：从文件或标准输入(stdin)读取一行，然后执行pattern{ action;… }语句块，它逐行扫描文件，从第一行到最后一行重复这个过程，直到文件全部被读取完毕。
第三步：当读至输入流末尾时，执行END{action;…}语句块

BEGIN语句块在awk开始从输入流中读取行之前被执行，这是一个可选的语句块，比如变量初始化、打印输出表格的表头等语句通常可以写在BEGIN语句块中 END语句块在awk从输入流中读取完所有的行之后即被执行，比如打印所有行的分析结果这类信息汇总都是在END语句块中完成，它也是一个可选语句块；
pattern语句块中的通用命令是最重要的部分，也是可选的。如果没有提供pattern语句块，则默认执行{ print }，即打印每一个读取到的行，awk读取的每一行都会执行该语句块

4.基础用法

awk 'patterm{action}

4.1选项

选项	含义
-F “分隔符”	指明输入时用到的字符分隔符，默认的分隔符是若干个连续空白符
-v	var=value 变量赋值

4.2awk '{print}' 再打印一遍

4.3awk '{print "hello"}'——有多少行打印多少hello（支持标准输出）

[root@localhost ~]#awk '{print "hello"}' </etc/passwd
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello
hello

4.4-F "分隔符" 提取内容

[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd

4.5BEGIN——仅在开始处理文件中的文本之前执行一次

[root@localhost ~]#awk -F: 'BEGIN{print "hello"}{print $1}' /etc/passwd
hello
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd

4.6BEGIN——小型计算器

4.7END——仅在文本处理完成之后执行一次

[root@localhost ~]#awk -F: 'END{print "hello"}{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
hello

4.8提取磁盘占用情况

方法一

[root@localhost ~]#df
文件系统                   1K-块    已用     可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270732 47132468   11% /
devtmpfs                  917604       0   917604    0% /dev
tmpfs                     933524       0   933524    0% /dev/shm
tmpfs                     933524    9208   924316    1% /run
tmpfs                     933524       0   933524    0% /sys/fs/cgroup
/dev/sda1                5232640  182368  5050272    4% /boot
tmpfs                     186708      12   186696    1% /run/user/42
tmpfs                     186708       0   186708    0% /run/user/0
[root@localhost ~]#df|awk '{print $5}'
已用%
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $5}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $5}'|tail -n+2|tr -d %
11
0
0
1
0
4
1
0

方法二

方法三

[root@localhost ~]#df
文件系统                   1K-块    已用     可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270264 47132936   11% /
devtmpfs                  917604       0   917604    0% /dev
tmpfs                     933524       0   933524    0% /dev/shm
tmpfs                     933524    9208   924316    1% /run
tmpfs                     933524       0   933524    0% /sys/fs/cgroup
/dev/sda1                5232640  182368  5050272    4% /boot
tmpfs                     186708      12   186696    1% /run/user/42
tmpfs                     186708       0   186708    0% /run/user/0
[root@localhost ~]#df|awk -F"[[:space:]]+" '{print $5}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk -F"[[:space:]]+|%" '{print $5}'|tail -n+2
11
0
0
1
0
4
1
0

4.9可以提取ip地址

4.9.1sed awk搭配使用

4.9.2hostname -I

4.9.3awk

4.10可以修改输出内容

[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000[root@localhost ~]#awk -F: '{print $1"++++++"$3}' /etc/passwd
root++++++0
bin++++++1
daemon++++++2
adm++++++3
lp++++++4
sync++++++5
shutdown++++++6
halt++++++7
mail++++++8
operator++++++11
games++++++12
ftp++++++14
nobody++++++99
systemd-network++++++192
dbus++++++81
polkitd++++++999
abrt++++++173
libstoragemgmt++++++998
rpc++++++32
colord++++++997
saslauth++++++996
rtkit++++++172
pulse++++++171
chrony++++++995
rpcuser++++++29
nfsnobody++++++65534
ntp++++++38
tss++++++59
usbmuxd++++++113
geoclue++++++994
qemu++++++107
radvd++++++75
setroubleshoot++++++993
sssd++++++992
gdm++++++42
gnome-initial-setup++++++991
sshd++++++74
avahi++++++70
postfix++++++89
tcpdump++++++72
ghd++++++1000[root@localhost ~]#awk -F: '{print $1"\t"$3}' /etc/passwd
#\t表示tab键
root	0
bin	1
daemon	2
adm	3
lp	4
sync	5
shutdown	6
halt	7
mail	8
operator	11
games	12
ftp	14
nobody	99
systemd-network	192
dbus	81
polkitd	999
abrt	173
libstoragemgmt	998
rpc	32
colord	997
saslauth	996
rtkit	172
pulse	171
chrony	995
rpcuser	29
nfsnobody	65534
ntp	38
tss	59
usbmuxd	113
geoclue	994
qemu	107
radvd	75
setroubleshoot	993
sssd	992
gdm	42
gnome-initial-setup	991
sshd	74
avahi	70
postfix	89
tcpdump	72
ghd	1000

5.内置变量

变量	含义
FS	指定每行文本的字段分隔符，缺省默认为空格或制表符（tab）。与 “-F”作用相同 -v "FS=:"
OFS	输出时的分隔符
NF	当前处理的行的字段个数
NR	当前处理的行的行号（序数）
$0	当前处理的行的整行内容
$n	当前处理行的第n个字段（第n列）
FILENAME	被处理的文件名
RS	行分隔符。awk从文件上读取资料时，将根据RS的定义就把资料切割成许多条记录，而awk一次仅读入一条记录进行处理。预设值是\n

5.1格式

awk 选项 '模式{print}'

awk中的变量，不会影响bash 环境中的变量

5.2 $0，$1，$3

[root@localhost ~]#awk -F: '{print $0}' /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd[root@localhost ~]#awk -F: '{print $3}' /etc/passwd
0
1
2
3
4
5
6
7
8
11
12
14
99
192
81
999
173
998
32
997
996
172
171
995
29
65534
38
59
113
994
107
75
993
992
42
991
74
70
89
72
1000[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000

5.3 FS——指定分隔符

5.3.1FS 指定分隔符

[root@localhost ~]#awk -v FS=: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd

5.3.2使用FS分隔符

[root@localhost ~]#awk -v FS=: '{print $1FS$3}' /etc/passwd
root:0
bin:1
daemon:2
adm:3
lp:4
sync:5
shutdown:6
halt:7
mail:8
operator:11
games:12
ftp:14
nobody:99
systemd-network:192
dbus:81
polkitd:999
abrt:173
libstoragemgmt:998
rpc:32
colord:997
saslauth:996
rtkit:172
pulse:171
chrony:995
rpcuser:29
nfsnobody:65534
ntp:38
tss:59
usbmuxd:113
geoclue:994
qemu:107
radvd:75
setroubleshoot:993
sssd:992
gdm:42
gnome-initial-setup:991
sshd:74
avahi:70
postfix:89
tcpdump:72
ghd:1000

5.3.3FS与fs

[root@localhost ~]#fs=:
[root@localhost ~]#echo $fs
:
[root@localhost ~]#echo $FS[root@localhost ~]#awk -v FS=$fs '{print $1FS$3}' /etc/passwd
root:0
bin:1
daemon:2
adm:3
lp:4
sync:5
shutdown:6
halt:7
mail:8
operator:11
games:12
ftp:14
nobody:99
systemd-network:192
dbus:81
polkitd:999
abrt:173
libstoragemgmt:998
rpc:32
colord:997
saslauth:996
rtkit:172
pulse:171
chrony:995
rpcuser:29
nfsnobody:65534
ntp:38
tss:59
usbmuxd:113
geoclue:994
qemu:107
radvd:75
setroubleshoot:993
sssd:992
gdm:42
gnome-initial-setup:991
sshd:74
avahi:70
postfix:89
tcpdump:72
ghd:1000

5.4OFS——指定输出时的分隔符

[root@localhost ~]#awk -v FS=: -v OFS="==" '{print $1,$3}' /etc/passwd
root==0
bin==1
daemon==2
adm==3
lp==4
sync==5
shutdown==6
halt==7
mail==8
operator==11
games==12
ftp==14
nobody==99
systemd-network==192
dbus==81
polkitd==999
abrt==173
libstoragemgmt==998
rpc==32
colord==997
saslauth==996
rtkit==172
pulse==171
chrony==995
rpcuser==29
nfsnobody==65534
ntp==38
tss==59
usbmuxd==113
geoclue==994
qemu==107
radvd==75
setroubleshoot==993
sssd==992
gdm==42
gnome-initial-setup==991
sshd==74
avahi==70
postfix==89
tcpdump==72
ghd==1000[root@localhost ~]#awk -v FS=: -v OFS="++" '{print $1,$3}' /etc/passwd
root++0
bin++1
daemon++2
adm++3
lp++4
sync++5
shutdown++6
halt++7
mail++8
operator++11
games++12
ftp++14
nobody++99
systemd-network++192
dbus++81
polkitd++999
abrt++173
libstoragemgmt++998
rpc++32
colord++997
saslauth++996
rtkit++172
pulse++171
chrony++995
rpcuser++29
nfsnobody++65534
ntp++38
tss++59
usbmuxd++113
geoclue++994
qemu++107
radvd++75
setroubleshoot++993
sssd++992
gdm++42
gnome-initial-setup++991
sshd++74
avahi++70
postfix++89
tcpdump++72
ghd++1000[root@localhost ~]#awk -v FS=: -v OFS="  " '{print $1,$3}' /etc/passwd
root  0
bin  1
daemon  2
adm  3
lp  4
sync  5
shutdown  6
halt  7
mail  8
operator  11
games  12
ftp  14
nobody  99
systemd-network  192
dbus  81
polkitd  999
abrt  173
libstoragemgmt  998
rpc  32
colord  997
saslauth  996
rtkit  172
pulse  171
chrony  995
rpcuser  29
nfsnobody  65534
ntp  38
tss  59
usbmuxd  113
geoclue  994
qemu  107
radvd  75
setroubleshoot  993
sssd  992
gdm  42
gnome-initial-setup  991
sshd  74
avahi  70
postfix  89
tcpdump  72
ghd  1000

5.5RS——换行

[root@localhost ~]#echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@localhost ~]#echo $PATH|awk '{print $1}'
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@localhost ~]#echo $PATH|awk -v RS=: '{print $1}'
/usr/local/sbin
/usr/local/bin
/usr/sbin
/usr/bin
/root/bin

5.6NF——行内字段的个数

5.6.1统计行内字段个数

[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#awk -F: '{print NF}' /etc/passwd
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7

5.6.2磁盘挂载

[root@localhost ~]#df
文件系统                   1K-块    已用     可用 已用% 挂载点
/dev/mapper/centos-root 52403200 5270276 47132924   11% /
devtmpfs                  917604       0   917604    0% /dev
tmpfs                     933524       0   933524    0% /dev/shm
tmpfs                     933524    9208   924316    1% /run
tmpfs                     933524       0   933524    0% /sys/fs/cgroup
/dev/sda1                5232640  182368  5050272    4% /boot
tmpfs                     186708      12   186696    1% /run/user/42
tmpfs                     186708       0   186708    0% /run/user/0
[root@localhost ~]#df|awk '{print $NF-1}'
-1
-1
-1
-1
-1
-1
-1
-1
-1
[root@localhost ~]#df|awk '{print $(NF-1)}'
已用%
11%
0%
0%
1%
0%
4%
1%
0%
[root@localhost ~]#df|awk '{print $(NF-1)}'|tail -n+2
11%
0%
0%
1%
0%
4%
1%
0%

5.7NR——统计/显示行号

5.7.1NR——显示行号

[root@localhost ~]#awk -F: '{print NR}' /etc/passwd
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41[root@localhost ~]#awk -F: '{print NR,$1}' /etc/passwd
1 root
2 bin
3 daemon
4 adm
5 lp
6 sync
7 shutdown
8 halt
9 mail
10 operator
11 games
12 ftp
13 nobody
14 systemd-network
15 dbus
16 polkitd
17 abrt
18 libstoragemgmt
19 rpc
20 colord
21 saslauth
22 rtkit
23 pulse
24 chrony
25 rpcuser
26 nfsnobody
27 ntp
28 tss
29 usbmuxd
30 geoclue
31 qemu
32 radvd
33 setroubleshoot
34 sssd
35 gdm
36 gnome-initial-setup
37 sshd
38 avahi
39 postfix
40 tcpdump
41 ghd

5.7.2NR——筛ip行

5.7.3NR!=——取反

5.7.4如何找出当前系统中的普通用户

[root@localhost ~]#awk -F: '{print $1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd
[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}' /etc/passwd
nfsnobody 65534
ghd 1000

5.8FNR——查看多个文件各有多少行

[root@localhost ~]#cat /etc/issue
\S
Kernel \r on an \m[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#cat /etc/issue|wc -l
3
[root@localhost ~]#cat /etc/passwd|wc -l
41
[root@localhost ~]#awk '{print FNR}'  /etc/issue  /etc/passwd
1
2
3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

5.9FILENAME——显示处理的文件名

[root@localhost ~]#awk -F: '{print FILENAME}' /etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd
/etc/passwd

6.自定义变量

7.printf

选项	含义
%s	显示字符串
%d，%i	显示十进制整数
%f	显示为浮点数
%e，%E	显示科学计数法数值
%c	显示字符的ASCII码
%g，%G	以科学计数法或浮点形式显示数值
%u	无符号整数
%%	显示%自身

7.1%s——显示字符串

[root@localhost ~]#awk -F: '{printf "%s",$1}' /etc/passwd
rootbindaemonadmlpsyncshutdownhaltmailoperatorgamesftpnobodysystemd-networkdbuspolkitdabrtlibstoragemgmtrpccolordsaslauthrtkitpulsechronyrpcusernfsnobodyntptssusbmuxdgeoclueqemuradvdsetroubleshootsssdgdmgnome-initial-setupsshdavahipostfixtcpdumpghd[root@localhost ~]#awk -F: '{printf "%s\n",$1}' /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
abrt
libstoragemgmt
rpc
colord
saslauth
rtkit
pulse
chrony
rpcuser
nfsnobody
ntp
tss
usbmuxd
geoclue
qemu
radvd
setroubleshoot
sssd
gdm
gnome-initial-setup
sshd
avahi
postfix
tcpdump
ghd

[root@localhost ~]#awk -F: '{printf "%20s\n",$1}' /etc/passwdrootbindaemonadmlpsyncshutdownhaltmailoperatorgamesftpnobodysystemd-networkdbuspolkitdabrtlibstoragemgmtrpccolordsaslauthrtkitpulsechronyrpcusernfsnobodyntptssusbmuxdgeoclueqemuradvdsetroubleshootsssdgdmgnome-initial-setupsshdavahipostfixtcpdumpghd
[root@localhost ~]#awk -F: '{printf "%-20s\n",$1}' /etc/passwd
root                
bin                 
daemon              
adm                 
lp                  
sync                
shutdown            
halt                
mail                
operator            
games               
ftp                 
nobody              
systemd-network     
dbus                
polkitd             
abrt                
libstoragemgmt      
rpc                 
colord              
saslauth            
rtkit               
pulse               
chrony              
rpcuser             
nfsnobody           
ntp                 
tss                 
usbmuxd             
geoclue             
qemu                
radvd               
setroubleshoot      
sssd                
gdm                 
gnome-initial-setup 
sshd                
avahi               
postfix             
tcpdump             
ghd

[root@localhost ~]#awk -F: '{printf "%-20s %10d\n",$1,$3}' /etc/passwd
root                          0
bin                           1
daemon                        2
adm                           3
lp                            4
sync                          5
shutdown                      6
halt                          7
mail                          8
operator                     11
games                        12
ftp                          14
nobody                       99
systemd-network             192
dbus                         81
polkitd                     999
abrt                        173
libstoragemgmt              998
rpc                          32
colord                      997
saslauth                    996
rtkit                       172
pulse                       171
chrony                      995
rpcuser                      29
nfsnobody                 65534
ntp                          38
tss                          59
usbmuxd                     113
geoclue                     994
qemu                        107
radvd                        75
setroubleshoot              993
sssd                        992
gdm                          42
gnome-initial-setup         991
sshd                         74
avahi                        70
postfix                      89
tcpdump                      72
ghd                        1000

[root@localhost ~]#awk -F: '{printf "Username: %s\n",$1}' /etc/passwd
Username: root
Username: bin
Username: daemon
Username: adm
Username: lp
Username: sync
Username: shutdown
Username: halt
Username: mail
Username: operator
Username: games
Username: ftp
Username: nobody
Username: systemd-network
Username: dbus
Username: polkitd
Username: abrt
Username: libstoragemgmt
Username: rpc
Username: colord
Username: saslauth
Username: rtkit
Username: pulse
Username: chrony
Username: rpcuser
Username: nfsnobody
Username: ntp
Username: tss
Username: usbmuxd
Username: geoclue
Username: qemu
Username: radvd
Username: setroubleshoot
Username: sssd
Username: gdm
Username: gnome-initial-setup
Username: sshd
Username: avahi
Username: postfix
Username: tcpdump
Username: ghd
[root@localhost ~]#awk -F: '{printf "Username: %sUID:%d\n",$1,$3}' /etc/passwd 
Username: rootUID:0
Username: binUID:1
Username: daemonUID:2
Username: admUID:3
Username: lpUID:4
Username: syncUID:5
Username: shutdownUID:6
Username: haltUID:7
Username: mailUID:8
Username: operatorUID:11
Username: gamesUID:12
Username: ftpUID:14
Username: nobodyUID:99
Username: systemd-networkUID:192
Username: dbusUID:81
Username: polkitdUID:999
Username: abrtUID:173
Username: libstoragemgmtUID:998
Username: rpcUID:32
Username: colordUID:997
Username: saslauthUID:996
Username: rtkitUID:172
Username: pulseUID:171
Username: chronyUID:995
Username: rpcuserUID:29
Username: nfsnobodyUID:65534
Username: ntpUID:38
Username: tssUID:59
Username: usbmuxdUID:113
Username: geoclueUID:994
Username: qemuUID:107
Username: radvdUID:75
Username: setroubleshootUID:993
Username: sssdUID:992
Username: gdmUID:42
Username: gnome-initial-setupUID:991
Username: sshdUID:74
Username: avahiUID:70
Username: postfixUID:89
Username: tcpdumpUID:72
Username: ghdUID:1000
[root@localhost ~]#awk -F: '{printf "Username: %25sUID:%d\n",$1,$3}' /etc/passwd
Username:                      rootUID:0
Username:                       binUID:1
Username:                    daemonUID:2
Username:                       admUID:3
Username:                        lpUID:4
Username:                      syncUID:5
Username:                  shutdownUID:6
Username:                      haltUID:7
Username:                      mailUID:8
Username:                  operatorUID:11
Username:                     gamesUID:12
Username:                       ftpUID:14
Username:                    nobodyUID:99
Username:           systemd-networkUID:192
Username:                      dbusUID:81
Username:                   polkitdUID:999
Username:                      abrtUID:173
Username:            libstoragemgmtUID:998
Username:                       rpcUID:32
Username:                    colordUID:997
Username:                  saslauthUID:996
Username:                     rtkitUID:172
Username:                     pulseUID:171
Username:                    chronyUID:995
Username:                   rpcuserUID:29
Username:                 nfsnobodyUID:65534
Username:                       ntpUID:38
Username:                       tssUID:59
Username:                   usbmuxdUID:113
Username:                   geoclueUID:994
Username:                      qemuUID:107
Username:                     radvdUID:75
Username:            setroubleshootUID:993
Username:                      sssdUID:992
Username:                       gdmUID:42
Username:       gnome-initial-setupUID:991
Username:                      sshdUID:74
Username:                     avahiUID:70
Username:                   postfixUID:89
Username:                   tcpdumpUID:72
Username:                       ghdUID:1000
[root@localhost ~]#awk -F: '{printf "Username: %-25sUID:%d\n",$1,$3}' /etc/passwd
Username: root                     UID:0
Username: bin                      UID:1
Username: daemon                   UID:2
Username: adm                      UID:3
Username: lp                       UID:4
Username: sync                     UID:5
Username: shutdown                 UID:6
Username: halt                     UID:7
Username: mail                     UID:8
Username: operator                 UID:11
Username: games                    UID:12
Username: ftp                      UID:14
Username: nobody                   UID:99
Username: systemd-network          UID:192
Username: dbus                     UID:81
Username: polkitd                  UID:999
Username: abrt                     UID:173
Username: libstoragemgmt           UID:998
Username: rpc                      UID:32
Username: colord                   UID:997
Username: saslauth                 UID:996
Username: rtkit                    UID:172
Username: pulse                    UID:171
Username: chrony                   UID:995
Username: rpcuser                  UID:29
Username: nfsnobody                UID:65534
Username: ntp                      UID:38
Username: tss                      UID:59
Username: usbmuxd                  UID:113
Username: geoclue                  UID:994
Username: qemu                     UID:107
Username: radvd                    UID:75
Username: setroubleshoot           UID:993
Username: sssd                     UID:992
Username: gdm                      UID:42
Username: gnome-initial-setup      UID:991
Username: sshd                     UID:74
Username: avahi                    UID:70
Username: postfix                  UID:89
Username: tcpdump                  UID:72
Username: ghd                      UID:1000

[root@localhost ~]#awk -F:   'BEGIN{printf "--------------------------------\n%-20s|%10s|\n--------------------------------\n","username","uid"}{printf "%-20s|%10d|\n--------------------------------\n",$1,$3}' /etc/passwd
--------------------------------
username            |       uid|
--------------------------------
root                |         0|
--------------------------------
bin                 |         1|
--------------------------------
daemon              |         2|
--------------------------------
adm                 |         3|
--------------------------------
lp                  |         4|
--------------------------------
sync                |         5|
--------------------------------
shutdown            |         6|
--------------------------------
halt                |         7|
--------------------------------
mail                |         8|
--------------------------------
operator            |        11|
--------------------------------
games               |        12|
--------------------------------
ftp                 |        14|
--------------------------------
nobody              |        99|
--------------------------------
systemd-network     |       192|
--------------------------------
dbus                |        81|
--------------------------------
polkitd             |       999|
--------------------------------
abrt                |       173|
--------------------------------
libstoragemgmt      |       998|
--------------------------------
rpc                 |        32|
--------------------------------
colord              |       997|
--------------------------------
saslauth            |       996|
--------------------------------
rtkit               |       172|
--------------------------------
pulse               |       171|
--------------------------------
chrony              |       995|
--------------------------------
rpcuser             |        29|
--------------------------------
nfsnobody           |     65534|
--------------------------------
ntp                 |        38|
--------------------------------
tss                 |        59|
--------------------------------
usbmuxd             |       113|
--------------------------------
geoclue             |       994|
--------------------------------
qemu                |       107|
--------------------------------
radvd               |        75|
--------------------------------
setroubleshoot      |       993|
--------------------------------
sssd                |       992|
--------------------------------
gdm                 |        42|
--------------------------------
gnome-initial-setup |       991|
--------------------------------
sshd                |        74|
--------------------------------
avahi               |        70|
--------------------------------
postfix             |        89|
--------------------------------
tcpdump             |        72|
--------------------------------
ghd                 |      1000|
--------------------------------

echo和printf可以修饰脚本格式

8.模式PATTERN

模式"其实就是选择的"条件"，awk是逐行处理文本的，也就是说，awk会先处理完当前行，再处理下一行，当不指定任何"条件"，awk会一行一行的处理文本中的每一行，如果指定了"条件"，只有满足"条件"的行才会被处理，不满足"条件"的行就不会被处理。

awk '模式（处理动作）'

PATTERN：根据pattern条件，过滤匹配的行，再做处理

8.1模式为空——每一行都匹配成功，没有额外条件

[root@localhost ~]#awk -F: '{print $1,$3}' /etc/passwd
root 0
bin 1
daemon 2
adm 3
lp 4
sync 5
shutdown 6
halt 7
mail 8
operator 11
games 12
ftp 14
nobody 99
systemd-network 192
dbus 81
polkitd 999
abrt 173
libstoragemgmt 998
rpc 32
colord 997
saslauth 996
rtkit 172
pulse 171
chrony 995
rpcuser 29
nfsnobody 65534
ntp 38
tss 59
usbmuxd 113
geoclue 994
qemu 107
radvd 75
setroubleshoot 993
sssd 992
gdm 42
gnome-initial-setup 991
sshd 74
avahi 70
postfix 89
tcpdump 72
ghd 1000

8.2正则匹配——仅能处理匹配到达的行，需要用/ /括起来

[root@localhost ~]#cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:996:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:995:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
chrony:x:995:991::/var/lib/chrony:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:989:User for geoclue:/var/lib/geoclue:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash
[root@localhost ~]#awk 'NR==3{print $1}' /etc/passwd
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#seq 10|awk 'NR>=3 && NR<=6'
3
4
5
6
[root@localhost ~]#awk 'NR>=3 && NR<=6{print NR,$0}' /etc/passwd
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync

8.3line ranges——行范围

不支持使用行号，但是可以使用变量NR；间接指定行号加上比较操作符或者逻辑关系

算术操作符
x+y
x-y
x*y
x/y
x^y
x%y（取余）
-x 转换为负数
+x 将字符串转换为数值

比较操作符
==
!=
>
>=
<
<=

逻辑符号
逻辑符号	含义
与：&&	并且关系
或：\|\|	或者关系
非：！	取反

8.3.1显示行号

[root@localhost ~]#awk '{print $1,NR}' /etc/passwd
root:x:0:0:root:/root:/bin/bash 1
bin:x:1:1:bin:/bin:/sbin/nologin 2
daemon:x:2:2:daemon:/sbin:/sbin/nologin 3
adm:x:3:4:adm:/var/adm:/sbin/nologin 4
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin 5
sync:x:5:0:sync:/sbin:/bin/sync 6
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown 7
halt:x:7:0:halt:/sbin:/sbin/halt 8
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin 9
operator:x:11:0:operator:/root:/sbin/nologin 10
games:x:12:100:games:/usr/games:/sbin/nologin 11
ftp:x:14:50:FTP 12
nobody:x:99:99:Nobody:/:/sbin/nologin 13
systemd-network:x:192:192:systemd 14
dbus:x:81:81:System 15
polkitd:x:999:998:User 16
abrt:x:173:173::/etc/abrt:/sbin/nologin 17
libstoragemgmt:x:998:996:daemon 18
rpc:x:32:32:Rpcbind 19
colord:x:997:995:User 20
saslauth:x:996:76:Saslauthd 21
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin 22
pulse:x:171:171:PulseAudio 23
chrony:x:995:991::/var/lib/chrony:/sbin/nologin 24
rpcuser:x:29:29:RPC 25
nfsnobody:x:65534:65534:Anonymous 26
ntp:x:38:38::/etc/ntp:/sbin/nologin 27
tss:x:59:59:Account 28
usbmuxd:x:113:113:usbmuxd 29
geoclue:x:994:989:User 30
qemu:x:107:107:qemu 31
radvd:x:75:75:radvd 32
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin 33
sssd:x:992:987:User 34
gdm:x:42:42::/var/lib/gdm:/sbin/nologin 35
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin 36
sshd:x:74:74:Privilege-separated 37
avahi:x:70:70:Avahi 38
postfix:x:89:89::/var/spool/postfix:/sbin/nologin 39
tcpdump:x:72:72::/:/sbin/nologin 40
ghd:x:1000:1000:ghd:/home/ghd:/bin/bash 41
[root@localhost ~]#awk '{print NR,$1}' /etc/passwd
1 root:x:0:0:root:/root:/bin/bash
2 bin:x:1:1:bin:/bin:/sbin/nologin
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
7 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8 halt:x:7:0:halt:/sbin:/sbin/halt
9 mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10 operator:x:11:0:operator:/root:/sbin/nologin
11 games:x:12:100:games:/usr/games:/sbin/nologin
12 ftp:x:14:50:FTP
13 nobody:x:99:99:Nobody:/:/sbin/nologin
14 systemd-network:x:192:192:systemd
15 dbus:x:81:81:System
16 polkitd:x:999:998:User
17 abrt:x:173:173::/etc/abrt:/sbin/nologin
18 libstoragemgmt:x:998:996:daemon
19 rpc:x:32:32:Rpcbind
20 colord:x:997:995:User
21 saslauth:x:996:76:Saslauthd
22 rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
23 pulse:x:171:171:PulseAudio
24 chrony:x:995:991::/var/lib/chrony:/sbin/nologin
25 rpcuser:x:29:29:RPC
26 nfsnobody:x:65534:65534:Anonymous
27 ntp:x:38:38::/etc/ntp:/sbin/nologin
28 tss:x:59:59:Account
29 usbmuxd:x:113:113:usbmuxd
30 geoclue:x:994:989:User
31 qemu:x:107:107:qemu
32 radvd:x:75:75:radvd
33 setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
34 sssd:x:992:987:User
35 gdm:x:42:42::/var/lib/gdm:/sbin/nologin
36 gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
37 sshd:x:74:74:Privilege-separated
38 avahi:x:70:70:Avahi
39 postfix:x:89:89::/var/spool/postfix:/sbin/nologin
40 tcpdump:x:72:72::/:/sbin/nologin
41 ghd:x:1000:1000:ghd:/home/ghd:/bin/bash

8.3.2行范围用法

[root@localhost ~]#awk 'NR==2{print $1}' /etc/passwd
#只取第二行的第一个字段
bin:x:1:1:bin:/bin:/sbin/nologin
[root@localhost ~]#awk 'NR==1{print $1}' /etc/passwd
#只取第一行的第一个字段
root:x:0:0:root:/root:/bin/bash
[root@localhost ~]#awk 'NR==1,NR==3{print}' /etc/passwd
#打印出1行到3行
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#awk 'NR==1||NR==3{print}' /etc/passwd
#打印出1行和3行
root:x:0:0:root:/root:/bin/bash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost ~]#awk '(NR%2)==0{print NR}' /etc/passwd
#打印出函数取余为0的行（偶数行）
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
[root@localhost ~]#awk '(NR%2)==1{print NR}' /etc/passwd
#打印出函数取余为1的行（奇数行）
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37
39
41
[root@localhost ~]#awk 'NR>=3 && NR<=6{print NR,$0}' /etc/passwd
#打印出3行到6行 显示行号 并打印出内容
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
[root@localhost ~]#seq 10|awk 'NR>5 && NR<10'
#打印出大于5小于10的数
6
7
8
9
[root@localhost ~]#awk -F: '$3>1000{print}' /etc/passwd
#打印出普通用户  第三列大于1000的行
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin

8.4找到10:00到11：00的日志

8.4.1通过awk找

awk '/10/,//11/' 文件名

8.4.2通过sed找

sed -nr '/10/,/11/p' 文件名

8.5关系表达式——或且非

关系表达式结果为“真”才会被处理

真：结果为非0值，非空字符串

假：结果为空字符串或0值

8.5.1或且非

8.5.2取反——奇偶

8.6条件判断

awk 选项 '模式{actions}'

条件判断写在actions里

8.6.1语法

if(condition){statement;…}[else statement]
if(condition1){statement1}else if(condition2){statement2}else if(condition3){statement3}...... else {statementN}

condition：条件

statement：语句

8.6.2格式

if语句：awk的if语句也分为单分支、双分支和多分支

单分支为if(判断条件){执行语句}
双分支为if(判断条件){执行语句}else{执行语句}
多分支为if(判断条件){执行语句}else if(判断条件){执行语句}else if(判断条件){执行语句}else if(判断条件){执行语句

示例：

awk -F: '{if($3>1000){print $1,$3}else{print $3}}' /etc/passwd
#如果第三列大于1000，那么就输出第三列
0
1
2
3
4
5
6
7
8
11
12
14
99
192
81
999
173
998
32
997
996
172
171
995
29
nfsnobody 65534
38
59
113
994
107
75
993
992
42
991
74
70
89
72
1000

8.6.3总结

条件判断的格式为： '{if（条件判断）{命令序列1}else{命令序列2}}'

9.循环——for while

9.1格式

for(expr1;expr2;expr3) {statement;…}
for(variable assignment;condition;iteration process) {for-body}
for(var in array) {for-body}

9.2示例

9.2.1计算

[root@localhost ~]#awk 'BEGIN{i=0;print i++,i}'
0 1
[root@localhost ~]#awk 'BEGIN{i=0;print ++i,i}'
1 1
[root@localhost ~]#awk 'BEGIN{x=0;print x}'
0
[root@localhost ~]#awk 'BEGIN{x=10;print x}'
10
[root@localhost ~]#awk 'BEGIN{x=10;print x+1}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
11
[root@localhost ~]#awk 'BEGIN{x=10;x++;print x}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
11
[root@localhost ~]#awk 'BEGIN{x=10;x++;print x+1}'
#BEGIN在处理文件之前，所以后面不跟文件名也不影响
12
[root@localhost ~]#awk 'BEGIN{print x+1}'
#不指定初始值，初始值就为0，如果是字符串，则默认为空
1
[root@localhost ~]#awk 'BEGIN{print 2.5+3.5}'
#小数也可以运算
6
[root@localhost ~]#awk 'BEGIN{print 5-3}'
2
[root@localhost ~]#awk 'BEGIN{print 6*6}'
36
[root@localhost ~]#awk 'BEGIN{print 3**2}'
#幂运算
9
[root@localhost ~]#awk 'BEGIN{print 2^3}'
#幂运算
8
[root@localhost ~]#awk 'BEGIN{print 1/2}'
0.5

10.awk数组

awk数组特性

awk的数组是关联数组(即key/value方式的hash数据结构)，索引下标可为数值(甚至是负数、小数等)，也可为字符串
awk数组支持数组的数组
在内部，awk数组的索引全都是字符串，即使是数值索引在使用时内部也会转换成字符串
awk的数组元素的顺序和元素插入时的顺序很可能是不相同的

10.1访问、赋值数组元素

索引可以是整数、负数、0、小数、字符串。如果是数值索引，会按照CONVFMT变量指定的格式先转换成字符串

[root@localhost ~]#awk 'BEGIN{a[1]="cxk";print a[1]}'
cxk
[root@localhost ~]#awk 'BEGIN{a[1]="cxk";b[2]="wsc";print a[1]}'
cxk
[root@localhost ~]#awk 'BEGIN{a[1]="cxk";b[2]="wsc";print b[2]}'
wsc

[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["cc"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk
[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["cc"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk
[root@localhost ~]#awk 'BEGIN{a["aa"]="cxk";a['bb']="wsc";a["bb"]="wyb";for(i in a)print a[i]}'
wsc
wyb
cxk

关联数组，数组的位置是随机的

10.1.1统计系统状态

方法一

[root@localhost ~]#ss -natp
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN     0      128         *:111                     *:*                   users:(("systemd",pid=1,fd=44))
LISTEN     0      128         *:10000                   *:*                   users:(("miniserv.pl",pid=1486,fd=4))
LISTEN     0      5      192.168.122.1:53                      *:*                   users:(("dnsmasq",pid=1379,fd=6))
LISTEN     0      128         *:22                      *:*                   users:(("sshd",pid=1011,fd=3))
LISTEN     0      128    127.0.0.1:631                     *:*                   users:(("cupsd",pid=1012,fd=12))
LISTEN     0      100    127.0.0.1:25                      *:*                   users:(("master",pid=1233,fd=13))
LISTEN     0      128    127.0.0.1:6010                    *:*                   users:(("sshd",pid=1535,fd=9))
ESTAB      0      132    192.168.241.11:22                 192.168.241.1:52599               users:(("sshd",pid=1535,fd=3))
LISTEN     0      128        :::111                    :::*                   users:(("systemd",pid=1,fd=43))
LISTEN     0      128        :::22                     :::*                   users:(("sshd",pid=1011,fd=4))
LISTEN     0      128       ::1:631                    :::*                   users:(("cupsd",pid=1012,fd=11))
LISTEN     0      100       ::1:25                     :::*                   users:(("master",pid=1233,fd=14))
LISTEN     0      128       ::1:6010                   :::*                   users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -antp|awk 'NR!=1{print $1}'|sort|uniq -c1 ESTAB12 LISTEN

方法二

[root@localhost ~]#ss -natp
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN     0      128         *:111                     *:*                   users:(("systemd",pid=1,fd=44))
LISTEN     0      128         *:10000                   *:*                   users:(("miniserv.pl",pid=1486,fd=4))
LISTEN     0      5      192.168.122.1:53                      *:*                   users:(("dnsmasq",pid=1379,fd=6))
LISTEN     0      128         *:22                      *:*                   users:(("sshd",pid=1011,fd=3))
LISTEN     0      128    127.0.0.1:631                     *:*                   users:(("cupsd",pid=1012,fd=12))
LISTEN     0      100    127.0.0.1:25                      *:*                   users:(("master",pid=1233,fd=13))
LISTEN     0      128    127.0.0.1:6010                    *:*                   users:(("sshd",pid=1535,fd=9))
ESTAB      0      36     192.168.241.11:22                 192.168.241.1:52599               users:(("sshd",pid=1535,fd=3))
LISTEN     0      128        :::111                    :::*                   users:(("systemd",pid=1,fd=43))
LISTEN     0      128        :::22                     :::*                   users:(("sshd",pid=1011,fd=4))
LISTEN     0      128       ::1:631                    :::*                   users:(("cupsd",pid=1012,fd=11))
LISTEN     0      100       ::1:25                     :::*                   users:(("master",pid=1233,fd=14))
LISTEN     0      128       ::1:6010                   :::*                   users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'
LISTEN 12
ESTAB 1
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'|sort
ESTAB 1
LISTEN 12
[root@localhost ~]#ss -natp|awk 'NR!=1{a[$1]++}END{for(i in a)print i,a[i]}'|sort|uniq -c1 ESTAB 11 LISTEN 12

方法三

[root@localhost ~]#ss -natp
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN     0      128         *:111                     *:*                   users:(("systemd",pid=1,fd=44))
LISTEN     0      128         *:10000                   *:*                   users:(("miniserv.pl",pid=1486,fd=4))
LISTEN     0      5      192.168.122.1:53                      *:*                   users:(("dnsmasq",pid=1379,fd=6))
LISTEN     0      128         *:22                      *:*                   users:(("sshd",pid=1011,fd=3))
LISTEN     0      128    127.0.0.1:631                     *:*                   users:(("cupsd",pid=1012,fd=12))
LISTEN     0      100    127.0.0.1:25                      *:*                   users:(("master",pid=1233,fd=13))
LISTEN     0      128    127.0.0.1:6010                    *:*                   users:(("sshd",pid=1535,fd=9))
ESTAB      0      36     192.168.241.11:22                 192.168.241.1:52599               users:(("sshd",pid=1535,fd=3))
LISTEN     0      128        :::111                    :::*                   users:(("systemd",pid=1,fd=43))
LISTEN     0      128        :::22                     :::*                   users:(("sshd",pid=1011,fd=4))
LISTEN     0      128       ::1:631                    :::*                   users:(("cupsd",pid=1012,fd=11))
LISTEN     0      100       ::1:25                     :::*                   users:(("master",pid=1233,fd=14))
LISTEN     0      128       ::1:6010                   :::*                   users:(("sshd",pid=1535,fd=8))
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'|sort
ESTAB
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
LISTEN
[root@localhost ~]#ss -natp|awk 'NR!=1{print $1}'|sort|uniq -c1 ESTAB12 LISTEN

10.1.2去重

[root@localhost ~]#vim testaa
bb
cc
dd
aa
aa
cc          
dd [root@localhost ~]#awk '!line[$0]++' test 
aa
bb
cc
dd
[root@localhost ~]#awk 'line[$0]++' test 
aa
aa
cc
dd
[root@localhost ~]#cat test 
aa
bb
cc
dd
aa
aa
cc
dd
[root@localhost ~]#awk '!line[$0]++' test 
aa
bb
cc
dd[root@localhost ~]#cat test 
aa
bb
cc
dd
aa
aa
cc
dd
dd
cc
bb

10.2数组长度

awk提供了 length() 函数来获取数组的元素个数，它也可以用于获取字符串的字符数量。还可以获取数值转换成字符串后的字符数量

将下标转换成字母a；aa后就不确定

10.3遍历数组

for（var in array）{for-body}

11.awk脚本——将awk程序写入脚本，调用或执行

[root@localhost ~]#vim test.awk {if($3>=1000)print $1,$3}[root@localhost ~]#awk -F: -f test.awk  /etc/passwd
nfsnobody 65534
ghd 1000

四、扩展

1.提取下面的字段中IP地址和时间

58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo

1.1方法一——使用awk提取（三种方法）

[root@localhost ~]#vim test58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo[root@localhost ~]#cat test 
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"]" '{print $1}'
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800
[root@localhost ~]#cat test |awk -F"]" '{print $1}'|awk '{print $1,$4}'
58.87.87.99 [09/Jun/2020:03:42:43
128.14.209.154 [09/Jun/2020:03:42:43
64.90.40.100 [09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"]" '{print $1}'|awk '{print $1,$4}'|tr -d 
[
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11

[root@localhost ~]#cat test 
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1}'
58.87.87.99
128.14.209.154
64.90.40.100
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1,$5}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]" '{print $1"\t"$5}'
58.87.87.99	09/Jun/2020:03:42:43
128.14.209.154	09/Jun/2020:03:42:43
64.90.40.100	09/Jun/2020:03:43:11

[root@localhost ~]#cat test 
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $4}'
09/Jun/2020:03:42:43
09/Jun/2020:03:42:43
09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $1,$4}'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |awk -F"[[ ]+" '{print $1"\t"$4}'
58.87.87.99	09/Jun/2020:03:42:43
128.14.209.154	09/Jun/2020:03:42:43
64.90.40.100	09/Jun/2020:03:43:11

1.2方法二——使用sed提取

[root@localhost ~]#cat test 
58.87.87.99 - - [09/Jun/2020:03:42:43 +0800] "POST /wp-cron.php?doing_wp_cron=1591645363.2316548824310302734375 HTTP/1.1" ""sendfileon
128.14.209.154 - - [09/Jun/2020:03:42:43 +0800] "GET / HTTP/1.1" ""sendfileon
64.90.40.100 - - [09/Jun/2020:03:43:11 +0800] "GET /wp-login.php HTTP/1.1"""sendfileo
[root@localhost ~]#cat test |sed -nr 's/(.*)- - .*/\1/p'
58.87.87.99 
128.14.209.154 
64.90.40.100 
[root@localhost ~]#cat test |sed -nr 's/(.*)- - \[(.*) \+.*/\1\2/p'
58.87.87.99 09/Jun/2020:03:42:43
128.14.209.154 09/Jun/2020:03:42:43
64.90.40.100 09/Jun/2020:03:43:11
[root@localhost ~]#cat test |sed -nr 's/(.*)- - \[(.*) \+.*/\1 \2/p'
58.87.87.99  09/Jun/2020:03:42:43
128.14.209.154  09/Jun/2020:03:42:43
64.90.40.100  09/Jun/2020:03:43:11

2.提取host.txt主机名后再放回host.txt文件

1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com

2.1方法一——使用awk提取

[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |awk -F"[ .]" '{print $2}'
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |awk -F"[ .]" '{print $2}' >> host.txt 
[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog

2.2方法二——使用cut、tr命令提取

[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |cut -d "." -f1
1 www
2 mail
3 ftp
4 linux
5 blog
[root@localhost ~]#cat host.txt |cut -d "." -f1|tr -d "[0-9 ]"
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |cut -d "." -f1|tr -d "[0-9 ]" >>host.txt 
[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog

2.3方法三——使用sed命令提取

[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
[root@localhost ~]#cat host.txt |sed -nr 's/[0-9] (.*)\.kgc\.com/\1/p'
www
mail
ftp
linux
blog
[root@localhost ~]#cat host.txt |sed -nr 's/[0-9] (.*)\.kgc\.com/\1/p' >> host.txt 
[root@localhost ~]#cat host.txt 
1 www.kgc.com
2 mail.kgc.com
3 ftp.kgc.com
4 linux.kgc.com
5 blog.kgc.com
www
mail
ftp
linux
blog

3.统计/etc/fstab文件中每个文件系统类型出现的次数

[root@localhost ~]#cat /etc/fstab #
# /etc/fstab
# Created by anaconda on Tue Dec 19 00:11:27 2023
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/centos-root /                       xfs     defaults        0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot                   xfs     defaults        0 0
/dev/mapper/centos-swap swap                    swap    defaults        0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"/dev/mapper/centos-root /                       xfs     defaults        0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot                   xfs     defaults        0 0
/dev/mapper/centos-swap swap                    swap    defaults        0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"
/dev/mapper/centos-root /                       xfs     defaults        0 0
UUID=0ebf43c7-c647-4e61-ab4f-cf6c64fb6a0c /boot                   xfs     defaults        0 0
/dev/mapper/centos-swap swap                    swap    defaults        0 0
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'
xfs
xfs
swap
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'|sort
swap
xfs
xfs
[root@localhost ~]#cat /etc/fstab |grep -v "^#"|grep -v "^$"|awk '{print $3}'|sort|uniq -c1 swap2 xfs

4.统计/etc/fstab文件中每个真单词出现的次数

[root@localhost ~]#cat /etc/fstab |grep -Eo "\b[a-zA-Z]+\b"
etc
fstab
Created
by
anaconda
on
Tue
Dec
Accessible
filesystems
by
reference
are
maintained
under
dev
disk
See
man
pages
fstab
findfs
mount
and
or
blkid
for
more
info
dev
mapper
centos
root
xfs
defaults
UUID
boot
xfs
defaults
dev
mapper
centos
swap
swap
swap
defaults
[root@localhost ~]#cat /etc/fstab |grep -Eo "\b[[:alpha:]]+\b"
etc
fstab
Created
by
anaconda
on
Tue
Dec
Accessible
filesystems
by
reference
are
maintained
under
dev
disk
See
man
pages
fstab
findfs
mount
and
or
blkid
for
more
info
dev
mapper
centos
root
xfs
defaults
UUID
boot
xfs
defaults
dev
mapper
centos
swap
swap
swap
defaults

5.提取出字符串中的所有数字

Yd$C@M05MB%9&Bdh7dq+YVixp3vpw

[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"
Yd@M05MB%9&Bdh7dq+YVixp3vpw
[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|grep [0-9]
Yd@M05MB%9&Bdh7dq+YVixp3vpw
[root@localhost ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|grep -o [0-9]
0
5
9
7
3

6.查出/tmp/的权限，以数字方式显示

[root@localhost ~]#stat /tmp文件："/tmp"大小：4096      	块：8          IO 块：4096   目录
设备：fd00h/64768d	Inode：33554504    硬链接：14
权限：(1777/drwxrwxrwt)  Uid：(    0/    root)   Gid：(    0/    root)
最近访问：2016-11-05 23:38:36.000000000 +0800
最近更改：2024-01-30 20:18:34.957891615 +0800
最近改动：2024-01-30 20:18:34.957891615 +0800
创建时间：-
[root@localhost ~]#stat /tmp|awk -F"[(/]" 'NR==4{print $2}'
1777

7.查出用户UID最大值的用户名、UID及shell类型

[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}'  /etc/passwd
nfsnobody 65534
ghd 1000
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3}'  /etc/passwd|sort -n
ghd 1000
nfsnobody 65534
[root@localhost ~]#awk -F: '$3>=1000{print $1,$3,$7}'  /etc/passwd|sort -n
ghd 1000 /bin/bash
nfsnobody 65534 /sbin/nologin

8.提取主机名并放入原文件

http://mail.kgc.com/index.html

http://www.kgc.com/test.html

http://study.kgc.com/index.html

http://blog.kgc.com/index.html

http://www.kgc.com/images/logo.jpg

http://blog.kgc.com/20080102.html

http://www.kgc.com/images/kgc.jpg

[root@localhost ~]#cat test 
http://mail.kgc.com/index.html
http://www.kgc.com/test.html
http://study.kgc.com/index.html
http://blog.kgc.com/index.html
http://www.kgc.com/images/logo.jpg
http://blog.kgc.com/20080102.html
http://www.kgc.com/images/kgc.jpg
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'
mail
www
study
blog
www
blog
www
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'|sort -nr
www
www
www
study
mail
blog
blog
[root@localhost ~]#
[root@localhost ~]#cat test |awk -F[/.] '{print $3}'|sort -nr|uniq -c3 www1 study1 mail2 blog
[root@localhost ~]#cat test |awk -F[/.] '{print $3}' >> test 
[root@localhost ~]#cat test 
http://mail.kgc.com/index.html
http://www.kgc.com/test.html
http://study.kgc.com/index.html
http://blog.kgc.com/index.html
http://www.kgc.com/images/logo.jpg
http://blog.kgc.com/20080102.html
http://www.kgc.com/images/kgc.jpg
mail
www
study
blog
www
blog
www