标签:练习
1.显示/proc/meminfo文件中以大小s开头的行;(要求:使用两种方式) 可有四种方式
[root@CentOS7 ~]# cat /proc/meminfo | grep -E "^(s|S)" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -E -i "^s" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -E "^[sS]" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -e "^s" -e "^S" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]#
2.显示/etc/passwd文件中不以/bin/bash结尾的行
[root@CentOS6 ~]# grep -E -v "/bin/bash$" /etc/passwd bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin rtkit:x:499:499:RealtimeKit:/proc:/sbin/nologin avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin abrt:x:173:173::/etc/abrt:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin saslauth:x:498:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin gdm:x:42:42::/var/lib/gdm:/sbin/nologin pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin tcpdump:x:72:72::/:/sbin/nologin nologin:x:510:514::/home/nologin:/sbin/nologin [root@CentOS6 ~]#
3.显示用户rpc默认的shell程序
[root@CentOS6 ~]# grep -E "^rpc\>" /etc/passwd #取出rpc用户信息 rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin [root@CentOS6 ~]# grep -E "^rpc\>" /etc/passwd | cut -d: -f7 #取出shell /sbin/nologin [root@CentOS6 ~]#
4.找出/etc/passwd中的两位或三位数
[root@CentOS6 ~]# grep -o "\<[0-9]\{2,3\}\>" /etc/passwd
12
10
14
11
12
100
13
30
14
50
99
99
81
81
113
113
32
32
499
499
170
170
69
69
173
173
29
29
68
68
38
38
48
48
498
76
89
89
27
27
42
42
497
495
74
74
72
72
500
500
501
501
502
503
503
507
504
508
505
509
506
510
507
511
508
512
509
513
510
514
511
515
512
516
[root@CentOS6 ~]#5.显示/etc/grub.conf文件中,至少以一个空白字符开头的且后面存非空白字符的行
[root@CentOS6 ~]# grep "^[[:space:]]\+[^[:space:]]" /etc/grub.conf root (hd0,0) kernel /vmlinuz-2.6.32-642.el6.x86_64 ro root=UUID=f4d977bb-af76-4617-b07f-9c70ae42a056 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet initrd /initramfs-2.6.32-642.el6.x86_64.img [root@CentOS6 ~]#
6.找出"netstat -tan"命令的结果中以‘LISTEN‘后跟0、1或多个空白字符结尾的行
[root@CentOS7 ~]# netstat -tan | grep -o "LISTEN[[:space:]]*$" LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN [root@CentOS7 ~]#
7.添加用户bash、testbash、basher以及nologin(其shell为/sbin/nologin),而后找出/etc/passwd文件中用户名同shell名的行
[root@CentOS6 ~]# grep "^\([^:]\+\>\).*\<\1\>$" /etc/passwd sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt bash:x:507:511::/home/bash:/bin/bash nologin:x:510:514::/home/nologin:/sbin/nologin [root@CentOS6 ~]#
扩展正则表达式
1.显示当前系统root、mage或wang用户的UID和默认shell
[root@CentOS6 ~]# cat /etc/passwd | grep -E "^(root|mage|wang)\>" #匹配出root、mage、wang三个用户信息 root:x:0:0:root:/root:/bin/bash mage:x:511:515::/home/mage:/bin/bash wang:x:512:516::/home/wang:/bin/bash [root@CentOS6 ~]# cat /etc/passwd | grep -E "^(root|mage|wang)\>" | cut -d: -f1,3,7 #取出用户名、UID、shell root:0:/bin/bash mage:511:/bin/bash wang:512:/bin/bash [root@CentOS6 ~]#
2.找出/etc/rc.d/init.d/functions文件中行首为某单词(包括下划线)后面跟一个小括号的行
[root@CentOS6 ~]# cat /etc/rc.d/init.d/functions | grep -E "[_[:alpha:]]+\(\)"
fstab_decode_str() {
checkpid() {
__readlink() {
__fgrep() {
__kill_pids_term_kill_checkpids() {
__kill_pids_term_kill() {
__umount_loop() {
__source_netdevs_fstab() {
__source_netdevs_mtab() {
__umount_loopback_loop() {
__find_mounts() {
__pids_var_run() {
__pids_pidof() {
daemon() {
killproc() {
pidfileofproc() {
pidofproc() {
status() {
echo_success() {
echo_failure() {
echo_passed() {
echo_warning() {
update_boot_stage() {
success() {
failure() {
passed() {
warning() {
action() {
action_silent() {
strstr() {
confirm() {
get_numeric_dev() {
is_ignored_file() {
is_true() {
is_false() {
apply_sysctl() {
key_is_random() {
find_crypto_mount_point() {
init_crypto() {
[root@CentOS6 ~]#3.使用egrep取出/etc/rc.d/init.d/functions中其基名
[root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "[^/]+/?$" #匹配以非斜线结尾的字符至少一次 functions/ [root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "[^/]+/?$" | grep -E -o "[^/]+" #过滤掉结尾的/ functions [root@CentOS6 ~]#
4.使用egrep取出上面路径的目录名
[root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "^/.*[^/]" #首先过滤掉结尾的/ /etc/rc.d/init.d/functions [root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "^/.*[^/]" | grep -E -o "^/.*/" #取出目录名 /etc/rc.d/init.d/ [root@CentOS6 ~]#
5.统计以root身份登录的每个远程主机IP地址的登录次数
[root@CentOS7 ~]# last | grep -E -o "^root\>.*([[:digit:]]+\.){3}[[:digit:]]+" | tr -s ‘ ‘ | cut -d‘ ‘ -f1,3 #取出当前系统已root身份登录的IP
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 172.18.19.139
root 192.168.0.107
root 192.168.0.109
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
root 10.1.250.60
[root@CentOS7 ~]# last | grep -E -o "^root\>.*([[:digit:]]+\.){3}[[:digit:]]+" | tr -s ‘ ‘ | cut -d‘ ‘ -f1,3 | sort | uniq -c #取出重复次数
22 root 10.1.250.60
1 root 172.18.19.139
1 root 192.168.0.107
1 root 192.168.0.109
[root@CentOS7 ~]#6.利用扩展正则表达式分别表示0-9、10-99、100-199、200-249、250-255
[root@CentOS6 ~]# grep "[0-9] [1-9][0-9] 1[0-9]{2} 2[0-4][0-9] 25[0-5]"7.显示ifconfig命令结果中所有IPv4地址
[root@CentOS6 ~]# ifconfig | grep -E -o "(\<([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\>\.){3}\<([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\>"
10.1.252.233
10.1.255.255
255.255.0.0
127.0.0.1
255.0.0.0
[root@CentOS6 ~]#8.统计/etc/init.d/functions 文件中每个单词出现的次数,并按频率从高到低显示
[root@CentOS6 ~]# cat /etc/rc.d/init.d/functions | tr -sc ‘[:alpha:]‘ ‘\n‘ | sort | uniq -c | sort -nr -t‘ ‘ -k1 83 if 77 then 75 pid 73 echo 72 fi 61 return 57 dev 54 file 50 n 46 local 42 kill 39 z 36 base 35 remaining 31 a 30 d 27 in 25 null 24 key 23 is 23 fstab 23 done 23 do 23 awk 22 pids 22 list 21 for 21 BOOTUP 20 to 20 p 20 dst 19 shift ...
9.正则表达式表示身份证号
[root@CentOS7 ~]# egrep "\<((1[1-5])|(2[1-3])|(3[1-7])|(4[1-6])|(5[0-4])|(6[1-5])|(71|81|82))([0-9]){4}(19|20)([0-9]){2}((0[1-9])|(1[0-2]))(0[1-9]|([0-9])|(2[0-9])|(3[0-1]))([0-9]){3}([0-9]|X)\>" number.txt
210905197807210546
370205197405213513
372922198012224773
370722197812222517
230803197906010035
152801198703025310
511428196305026357
[root@CentOS7 ~]#10.正则表达式表示手机号
[root@CentOS7 ~]# grep -E -o "(\+86)?1[38][0-9]{9}|14[57][0-9]{8}|15[0-35-9][0-9]{8}|17[0678][0-9]{8}" iphone.txt
+8613868233891
15003107238
[root@CentOS7 ~]#11.正则表达式表示邮箱
[root@CentOS7 ~]# egrep "\<([[:alnum:]]+(-|_)*[[:alnum:]]*)\>@([[:alnum:]]+\.)+[[:alnum:]]+" mail.txt 993667135@qq.com servername@163.com [root@CentOS7 ~]#
12.正则表达式表示QQ号
[root@CentOS7 ~]# grep -E -o ‘\b[1-9][0-9]{4,12}\b‘ qq.txt
333449
521521
796898
765423
93796117258
[root@CentOS7 ~]#标签:练习
原文地址:http://zhaizhai.blog.51cto.com/11881047/1839894