一、找出ifconfig “网卡名” 命令结果中本机的IPv4地址
ifconfig eth0 | head -n 2 | tail -n 1 | tr -s ' ' : | cut -d : -f 4
[root@centos6 ~]#ifconfig eth0 | head -n 2 | tail -n 1 | tr -s ' ' : | cut -d : -f 4
192.168.30.133
二、查出分区空间使用率的最大百分比值
df | tr -s ' ' % | cut -d % -f 5 | sort -nr | head -n 1
[root@centos6 ~]#df | tr -s ' ' % | cut -d % -f 5 | sort -nr | head -n 1
100
三、查出用户UID最大值的用户名、 UID及shell类型
getent passwd | cut -d : -f 1,3,7 | sort -t : -k 2 -nr | head -n 1
[root@centos6 ~]#getent passwd | cut -d : -f 1,3,7 | sort -t : -k 2 -nr | head -n 1
nfsnobody:65534:/sbin/nologin
四、查出/tmp的权限,以数字方式显示
方法1:
stat /tmp/ | head -n 4 | tail -n 1 | tr -s ' ' : | cut -d : -f 2 | cut -b 2-5
[root@centos6 ~]#stat /tmp/ | head -n 4 | tail -n 1 | tr -s ' ' : | cut -d : -f 2 | cut -b 2-5
1777
方法2:
stat /tmp/ | head -n 4 | tail -n 1 | cut -d / -f 1 | cut -d '(' -f 2
[root@centos6 ~]#stat /tmp/ | head -n 4 | tail -n 1 | cut -d / -f 1 | cut -d '(' -f 2
1777
方法3
stat -c %a /tmp/
[root@centos6 ~]#stat -c %a /tmp/
1777
五、统计当前连接本机的每个远程主机IP的连接数,并按从大到小排序
cat /data/access_log | cut -d ' ' -f 1 | sort | uniq -c | sort -t ' ' -k 2 -nr
[root@centos6 ~]#cat /data/access_log | cut -d ' ' -f 1 | sort | uniq -c | sort -t ' ' -k 2 -nr
159091 172.18.56.3
4004 192.168.27.6
24 172.18.0.100
六、显示/proc/meminfo文件中以大小s开头的行(要求:使用两种方法)
方法一:
cat /proc/meminfo | grep -o "^[Ss].*"
[root@centos7 ~]#cat /proc/meminfo | grep -o "^[Ss].*"
SwapCached: 1616 kB
SwapTotal: 2097148 kB
SwapFree: 2088468 kB
Shmem: 5420 kB
Slab: 86776 kB
SReclaimable: 32832 kB
SUnreclaim: 53944 kB
方法二:
cat /proc/meminfo | grep -o "\<[Ss].*"
[root@centos7 ~]#cat /proc/meminfo | grep -o "\<[Ss].*"
SwapCached: 1632 kB
SwapTotal: 2097148 kB
SwapFree: 2088484 kB
Shmem: 5436 kB
Slab: 86824 kB
SReclaimable: 32832 kB
SUnreclaim: 53992 kB
七、显示/etc/passwd文件中不以/bin/bash结尾的行
getent passwd | grep -v "/bin/bash$"
[root@centos7 ~]#getent passwd | grep -v "/bin/bash$"
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
libstoragemgmt:x:998:997:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
colord:x:997:996:User for colord:/var/lib/colord:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
chrony:x:995:993::/var/lib/chrony:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
geoclue:x:994:991:User for geoclue:/var/lib/geoclue:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:993:990::/var/lib/setroubleshoot:/sbin/nologin
pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:992:987::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
gentoo:x:1002:1002:Gentoo Distribution:/home/gentoo:/bin/csh
sarah:x:1005:1006::/home/sarah:/sbin/nologin
八、显示用户rpc默认的shell程序
getent passwd | grep "\<rpc\>" | cut -d : -f 7
[root@centos7 ~]#getent passwd | grep "\<rpc\>" | cut -d : -f 7
/sbin/nologin
九、找出/etc/passwd中的两位或三位数
方法一:
getent passwd | grep -Ewo "[[:digit:]]{2,3}"
[root@centos7 ~]#getent passwd | grep -Ewo "[[:digit:]]{2,3}"
12
11
12
100
14
50
99
99
192
192
81
81
999
998
173
173
998
997
32
32
997
996
996
76
172
172
995
993
107
107
59
59
113
113
994
991
29
29
75
75
993
990
171
171
42
42
992
987
74
74
70
70
89
89
38
38
72
72
方法二:
getent passwd | grep -Eo "\<[[:digit:]]{2,3}\>"
[root@centos7 ~]#getent passwd | grep -Eo "\<[[:digit:]]{2,3}\>"
12
11
12
100
14
50
99
99
192
192
81
81
999
998
173
173
998
997
32
32
997
996
996
76
172
172
995
993
107
107
59
59
113
113
994
991
29
29
75
75
993
990
171
171
42
42
992
987
74
74
70
70
89
89
38
38
72
72
十、显示CentOS7的/etc/grub2.cfg文件中,至少以一个空白字符开头的且后面存非空白字符的行
cat /etc/grub2.cfg | grep -o "^ .*"
[root@centos7 ~]#cat /etc/grub2.cfg | grep -o "^ .*"
load_env
set default="${next_entry}"
set next_entry=
save_env next_entry
set boot_once=true
set default="${saved_entry}"
menuentry_id_option="--id"
menuentry_id_option=""
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
save_env saved_entry
fi
if [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
set timeout_style=menu
set timeout=5
set timeout=5
source ${prefix}/user.cfg
if [ -n "${GRUB2_PASSWORD}" ]; then
set superusers="root"
export superusers
password_pbkdf2 root ${GRUB2_PASSWORD}
fi
source ${config_directory}/custom.cfg
source $prefix/custom.cfg;
十一、找出“netstat -tan”命令的结果中以‘LISTEN’后跟任意多个空白字符结尾的行
netstat -tan | grep "LISTEN[[:space:]]\+$"
[root@centos7 ~]#netstat -tan | grep "LISTEN[[:space:]]\+$"
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN
tcp6 0 0 :::111 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
tcp6 0 0 ::1:6010 :::* LISTEN
十二、显示CentOS7上所有系统用户的用户名和UID
getent passwd | grep "/sbin/nologin$" | cut -d : -f 1,3
[root@centos7 ~]#getent passwd | grep "/sbin/nologin$" | cut -d : -f 1,3
bin:1
daemon:2
adm:3
lp:4
mail:8
operator:11
games:12
ftp:14
nobody:99
systemd-network:192
dbus:81
polkitd:999
abrt:173
libstoragemgmt:998
rpc:32
colord:997
saslauth:996
rtkit:172
chrony:995
qemu:107
tss:59
usbmuxd:113
geoclue:994
rpcuser:29
nfsnobody:65534
radvd:75
setroubleshoot:993
pulse:171
gdm:42
gnome-initial-setup:992
sshd:74
avahi:70
postfix:89
ntp:38
tcpdump:72
sarah:1005
十三、添加用户bash、 testbash、 basher、 sh、 nologin(其shell为/sbin/nologin),找出/etc/passwd用户名同shell名的行
1. 添加用户
useradd
[root@centos7 ~]#useradd bash
[root@centos7 ~]#useradd testbash
[root@centos7 ~]#useradd basher
[root@centos7 ~]#useradd sh
[root@centos7 ~]#useradd -s /sbin/nologin nologin
2. 找出/etc/passwd用户名同shell名的行
getent passwd | grep "^\(\<.*\>\).*\1$"
[root@centos7 ~]#getent passwd | grep "^\(\<.*\>\).*\1$"
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
bash:x:1009:1014::/home/bash:/bin/bash
sh:x:1012:1017::/home/sh:/bin/bash
nologin:x:1013:1018::/home/nologin:/sbin/nologin
十四、利用df和grep,取出磁盘各分区利用率,并从大到小排序
df | grep "/dev/sd" | grep -o "[[:digit:]]\{1,3\}%" | grep -o "[[:digit:]]\+" | sort -nr
[root@centos7 ~]#df | grep "/dev/sd" | grep -o "[[:digit:]]\{1,3\}%" | grep -o "[[:digit:]]\+" | sort -nr
16
9
1
十五、显示三个用户root、 mage、 wang的UID和默认shell
方法一:
getent passwd | grep -E "^\<(root|mage|wang)\>" | cut -d : -f 1,3,7
[root@centos7 ~]#getent passwd | grep -E "^\<(root|mage|wang)\>" | cut -d : -f 1,3,7
root:0:/bin/bash
mage:1014:/bin/bash
wang:1015:/bin/bash
方法二:
getent passwd | grep -Ew "^(root|mage|wang)" | cut -d : -f 1,3,7
[root@centos7 ~]#getent passwd | grep -Ew "^(root|mage|wang)" | cut -d : -f 1,3,7
root:0:/bin/bash
mage:1014:/bin/bash
wang:1015:/bin/bash
十六、找出/etc/rc.d/init.d/functions文件中行首为某单词(包括下划线)后面跟一个小括号的行
cat /etc/rc.d/init.d/functions | grep -Eo "^.*\>\(\)"
[root@centos7 ~]#cat /etc/rc.d/init.d/functions | grep -Eo "^.*\>\(\)"
checkpid()
__kill_pids_term_kill_checkpids()
__kill_pids_term_kill()
__pids_var_run()
__pids_pidof()
daemon()
killproc()
pidfileofproc()
pidofproc()
status()
echo_success()
echo_failure()
echo_passed()
echo_warning()
update_boot_stage()
success()
failure()
passed()
warning()
action()
strstr()
is_ignored_file()
is_true()
is_false()
apply_sysctl()
十七、使用egrep取出/etc/rc.d/init.d/functions中其基名
echo /etc/rc.d/init.d/functions | grep -Eo "[^/]*/?$"
思路:
从行尾开始匹配任意字符,遇到/结束。由于基名可以是文件或目录,所以在$前加上/?匹配0或1次/。
[root@centos7 ~]#echo /etc/rc.d/init.d/functions | grep -Eo "[^/]*/?$"
functions
十八、使用egrep取出上面路径的目录名
echo /etc/rc.d/init.d/functions | grep -Eo ".*\<"
思路:
从行首开始匹配任意字符,遇到词首结束。由于正则表达式默认为贪婪模式,会匹配到最后一个单词的词首。
[root@centos7 ~]#echo /etc/rc.d/init.d/functions | grep -Eo ".*\<"
/etc/rc.d/init.d/
十九、统计last命令中以root登录的每个主机IP地址登录次数
方法一:
last | grep "^\<root\>" | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep "^\<root\>" | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
1 127.0.0.1
1 192.168.1.102
1 192.168.1.103
1 192.168.1.108
1 192.168.1.110
37 192.168.30.1
1 192.168.30.133
1 192.168.30.139
方法二:
思路:
由于IP地址格式为X.X.X.X,前三处格式都为X.,可以使用{3}归纳。
last | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
1 127.0.0.1
1 192.168.1.102
1 192.168.1.103
1 192.168.1.108
1 192.168.1.110
37 192.168.30.1
1 192.168.30.133
1 192.168.30.139
方法三:
last | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
1 127.0.0.1
2 192.168.1.102
1 192.168.1.103
1 192.168.1.108
1 192.168.1.110
37 192.168.30.1
2 192.168.30.133
1 192.168.30.139
二十、利用扩展正则表达式分别表示0-9、10-99、100-199、200-249、250-255
0-9:
[0-9]
10-99:
[1-9][0-9]
100-199:
1[0-9][0-9]
200-249:
2[0-4][0-9]
250-255:
25[0-5]
二十一、显示ifconfig命令结果中所有IPv4地址
思路:
一定要加上\<\>进行单词锚定。
方法一:
ifconfig | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
[root@centos7 ~]#ifconfig | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
192.168.30.139
255.255.255.0
192.168.30.255
192.168.1.110
255.255.255.0
192.168.1.255
127.0.0.1
255.0.0.0
192.168.122.1
255.255.255.0
192.168.122.255
方法二:
ifconfig | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
思路:
由于IP地址格式为X.X.X.X,前三处格式都为X.,可以使用{3}归纳。
[root@centos7 ~]#ifconfig | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
192.168.30.139
255.255.255.0
192.168.30.255
192.168.1.110
255.255.255.0
192.168.1.255
127.0.0.1
255.0.0.0
192.168.122.1
255.255.255.0
192.168.122.255
方法三:
ifconfig | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
[root@centos7 ~]#ifconfig | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
192.168.30.139
255.255.255.0
192.168.30.255
192.168.1.110
255.255.255.0
192.168.1.255
127.0.0.1
255.0.0.0
192.168.122.1
255.255.255.0
192.168.122.255
二十二、将此字符串:welcome to magedu linux 中的每个字符去重并排序,重复次数多的排到前面
echo "welcome to magedu linux" | grep -o "." | sort | uniq -c | sort -nr
[root@centos7 ~]#echo "welcome to magedu linux" | grep -o "." | sort | uniq -c | sort -nr
3 e
3
2 u
2 o
2 m
2 l
1 x
1 w
1 t
1 n
1 i
1 g
1 d
1 c
1 a