ifconfig eth0 | head -n 2 | tail -n 1 | tr -s ' ' : | cut -d : -f 4
[root@centos6 ~]#ifconfig eth0 | head -n 2 | tail -n 1 | tr -s ' ' : | cut -d : -f 4 192.168.30.133
df | tr -s ' ' % | cut -d % -f 5 | sort -nr | head -n 1
[root@centos6 ~]#df | tr -s ' ' % | cut -d % -f 5 | sort -nr | head -n 1 100
getent passwd | cut -d : -f 1,3,7 | sort -t : -k 2 -nr | head -n 1
[root@centos6 ~]#getent passwd | cut -d : -f 1,3,7 | sort -t : -k 2 -nr | head -n 1 nfsnobody:65534:/sbin/nologin
stat /tmp/ | head -n 4 | tail -n 1 | tr -s ' ' : | cut -d : -f 2 | cut -b 2-5
[root@centos6 ~]#stat /tmp/ | head -n 4 | tail -n 1 | tr -s ' ' : | cut -d : -f 2 | cut -b 2-5 1777
stat /tmp/ | head -n 4 | tail -n 1 | cut -d / -f 1 | cut -d '(' -f 2
[root@centos6 ~]#stat /tmp/ | head -n 4 | tail -n 1 | cut -d / -f 1 | cut -d '(' -f 2 1777
stat -c %a /tmp/
[root@centos6 ~]#stat -c %a /tmp/ 1777
cat /data/access_log | cut -d ' ' -f 1 | sort | uniq -c | sort -t ' ' -k 2 -nr
[root@centos6 ~]#cat /data/access_log | cut -d ' ' -f 1 | sort | uniq -c | sort -t ' ' -k 2 -nr 159091 172.18.56.3 4004 192.168.27.6 24 172.18.0.100
cat /proc/meminfo | grep -o "^[Ss].*"
[root@centos7 ~]#cat /proc/meminfo | grep -o "^[Ss].*" SwapCached: 1616 kB SwapTotal: 2097148 kB SwapFree: 2088468 kB Shmem: 5420 kB Slab: 86776 kB SReclaimable: 32832 kB SUnreclaim: 53944 kB
cat /proc/meminfo | grep -o "\<[Ss].*"
[root@centos7 ~]#cat /proc/meminfo | grep -o "\<[Ss].*" SwapCached: 1632 kB SwapTotal: 2097148 kB SwapFree: 2088484 kB Shmem: 5436 kB Slab: 86824 kB SReclaimable: 32832 kB SUnreclaim: 53992 kB
getent passwd | grep -v "/bin/bash$"
[root@centos7 ~]#getent passwd | grep -v "/bin/bash$" bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin polkitd:x:999:998:User for polkitd:/:/sbin/nologin abrt:x:173:173::/etc/abrt:/sbin/nologin libstoragemgmt:x:998:997:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin colord:x:997:996:User for colord:/var/lib/colord:/sbin/nologin saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin chrony:x:995:993::/var/lib/chrony:/sbin/nologin qemu:x:107:107:qemu user:/:/sbin/nologin tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin geoclue:x:994:991:User for geoclue:/var/lib/geoclue:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin radvd:x:75:75:radvd user:/:/sbin/nologin setroubleshoot:x:993:990::/var/lib/setroubleshoot:/sbin/nologin pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin gdm:x:42:42::/var/lib/gdm:/sbin/nologin gnome-initial-setup:x:992:987::/run/gnome-initial-setup/:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin tcpdump:x:72:72::/:/sbin/nologin gentoo:x:1002:1002:Gentoo Distribution:/home/gentoo:/bin/csh sarah:x:1005:1006::/home/sarah:/sbin/nologin
getent passwd | grep "\<rpc\>" | cut -d : -f 7
[root@centos7 ~]#getent passwd | grep "\<rpc\>" | cut -d : -f 7 /sbin/nologin
getent passwd | grep -Ewo "[[:digit:]]{2,3}"
[root@centos7 ~]#getent passwd | grep -Ewo "[[:digit:]]{2,3}" 12 11 12 100 14 50 99 99 192 192 81 81 999 998 173 173 998 997 32 32 997 996 996 76 172 172 995 993 107 107 59 59 113 113 994 991 29 29 75 75 993 990 171 171 42 42 992 987 74 74 70 70 89 89 38 38 72 72
getent passwd | grep -Eo "\<[[:digit:]]{2,3}\>"
[root@centos7 ~]#getent passwd | grep -Eo "\<[[:digit:]]{2,3}\>" 12 11 12 100 14 50 99 99 192 192 81 81 999 998 173 173 998 997 32 32 997 996 996 76 172 172 995 993 107 107 59 59 113 113 994 991 29 29 75 75 993 990 171 171 42 42 992 987 74 74 70 70 89 89 38 38 72 72
cat /etc/grub2.cfg | grep -o "^ .*"
[root@centos7 ~]#cat /etc/grub2.cfg | grep -o "^ .*" load_env set default="${next_entry}" set next_entry= save_env next_entry set boot_once=true set default="${saved_entry}" menuentry_id_option="--id" menuentry_id_option="" set saved_entry="${prev_saved_entry}" save_env saved_entry set prev_saved_entry= save_env prev_saved_entry set boot_once=true if [ -z "${boot_once}" ]; then saved_entry="${chosen}" save_env saved_entry fi if [ x$feature_all_video_module = xy ]; then insmod all_video else insmod efi_gop insmod efi_uga insmod ieee1275_fb insmod vbe insmod vga insmod video_bochs insmod video_cirrus fi set timeout_style=menu set timeout=5 set timeout=5 source ${prefix}/user.cfg if [ -n "${GRUB2_PASSWORD}" ]; then set superusers="root" export superusers password_pbkdf2 root ${GRUB2_PASSWORD} fi source ${config_directory}/custom.cfg source $prefix/custom.cfg;
netstat -tan | grep "LISTEN[[:space:]]\+$"
[root@centos7 ~]#netstat -tan | grep "LISTEN[[:space:]]\+$" tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN tcp6 0 0 :::111 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 ::1:6010 :::* LISTEN
getent passwd | grep "/sbin/nologin$" | cut -d : -f 1,3
[root@centos7 ~]#getent passwd | grep "/sbin/nologin$" | cut -d : -f 1,3 bin:1 daemon:2 adm:3 lp:4 mail:8 operator:11 games:12 ftp:14 nobody:99 systemd-network:192 dbus:81 polkitd:999 abrt:173 libstoragemgmt:998 rpc:32 colord:997 saslauth:996 rtkit:172 chrony:995 qemu:107 tss:59 usbmuxd:113 geoclue:994 rpcuser:29 nfsnobody:65534 radvd:75 setroubleshoot:993 pulse:171 gdm:42 gnome-initial-setup:992 sshd:74 avahi:70 postfix:89 ntp:38 tcpdump:72 sarah:1005
useradd
[root@centos7 ~]#useradd bash [root@centos7 ~]#useradd testbash [root@centos7 ~]#useradd basher [root@centos7 ~]#useradd sh [root@centos7 ~]#useradd -s /sbin/nologin nologingetent passwd | grep "^\(\<.*\>\).*\1$"
[root@centos7 ~]#getent passwd | grep "^\(\<.*\>\).*\1$" sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt bash:x:1009:1014::/home/bash:/bin/bash sh:x:1012:1017::/home/sh:/bin/bash nologin:x:1013:1018::/home/nologin:/sbin/nologin
df | grep "/dev/sd" | grep -o "[[:digit:]]\{1,3\}%" | grep -o "[[:digit:]]\+" | sort -nr
[root@centos7 ~]#df | grep "/dev/sd" | grep -o "[[:digit:]]\{1,3\}%" | grep -o "[[:digit:]]\+" | sort -nr 16 9 1
getent passwd | grep -E "^\<(root|mage|wang)\>" | cut -d : -f 1,3,7
[root@centos7 ~]#getent passwd | grep -E "^\<(root|mage|wang)\>" | cut -d : -f 1,3,7 root:0:/bin/bash mage:1014:/bin/bash wang:1015:/bin/bash
getent passwd | grep -Ew "^(root|mage|wang)" | cut -d : -f 1,3,7
[root@centos7 ~]#getent passwd | grep -Ew "^(root|mage|wang)" | cut -d : -f 1,3,7 root:0:/bin/bash mage:1014:/bin/bash wang:1015:/bin/bash
cat /etc/rc.d/init.d/functions | grep -Eo "^.*\>\(\)"
[root@centos7 ~]#cat /etc/rc.d/init.d/functions | grep -Eo "^.*\>\(\)" checkpid() __kill_pids_term_kill_checkpids() __kill_pids_term_kill() __pids_var_run() __pids_pidof() daemon() killproc() pidfileofproc() pidofproc() status() echo_success() echo_failure() echo_passed() echo_warning() update_boot_stage() success() failure() passed() warning() action() strstr() is_ignored_file() is_true() is_false() apply_sysctl()
echo /etc/rc.d/init.d/functions | grep -Eo "[^/]*/?$"
思路:
从行尾开始匹配任意字符,遇到/结束。由于基名可以是文件或目录,所以在$前加上/?匹配0或1次/。
[root@centos7 ~]#echo /etc/rc.d/init.d/functions | grep -Eo "[^/]*/?$" functions
echo /etc/rc.d/init.d/functions | grep -Eo ".*\<"
思路:
从行首开始匹配任意字符,遇到词首结束。由于正则表达式默认为贪婪模式,会匹配到最后一个单词的词首。
[root@centos7 ~]#echo /etc/rc.d/init.d/functions | grep -Eo ".*\<" /etc/rc.d/init.d/
last | grep "^\<root\>" | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep "^\<root\>" | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c 1 127.0.0.1 1 192.168.1.102 1 192.168.1.103 1 192.168.1.108 1 192.168.1.110 37 192.168.30.1 1 192.168.30.133 1 192.168.30.139
由于IP地址格式为X.X.X.X,前三处格式都为X.,可以使用{3}归纳。
last | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c 1 127.0.0.1 1 192.168.1.102 1 192.168.1.103 1 192.168.1.108 1 192.168.1.110 37 192.168.30.1 1 192.168.30.133 1 192.168.30.139
last | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c
[root@centos7 ~]#last | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" | sort | uniq -c 1 127.0.0.1 2 192.168.1.102 1 192.168.1.103 1 192.168.1.108 1 192.168.1.110 37 192.168.30.1 2 192.168.30.133 1 192.168.30.139
思路:
一定要加上\<\>进行单词锚定。
ifconfig | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
[root@centos7 ~]#ifconfig | grep -Eo "\<([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" 192.168.30.139 255.255.255.0 192.168.30.255 192.168.1.110 255.255.255.0 192.168.1.255 127.0.0.1 255.0.0.0 192.168.122.1 255.255.255.0 192.168.122.255
ifconfig | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
由于IP地址格式为X.X.X.X,前三处格式都为X.,可以使用{3}归纳。
[root@centos7 ~]#ifconfig | grep -Eo "\<(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" 192.168.30.139 255.255.255.0 192.168.30.255 192.168.1.110 255.255.255.0 192.168.1.255 127.0.0.1 255.0.0.0 192.168.122.1 255.255.255.0 192.168.122.255
ifconfig | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
[root@centos7 ~]#ifconfig | grep -Eo "\<(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>" 192.168.30.139 255.255.255.0 192.168.30.255 192.168.1.110 255.255.255.0 192.168.1.255 127.0.0.1 255.0.0.0 192.168.122.1 255.255.255.0 192.168.122.255
echo "welcome to magedu linux" | grep -o "." | sort | uniq -c | sort -nr
[root@centos7 ~]#echo "welcome to magedu linux" | grep -o "." | sort | uniq -c | sort -nr 3 e 3 2 u 2 o 2 m 2 l 1 x 1 w 1 t 1 n 1 i 1 g 1 d 1 c 1 a