1.顯示/proc/meminfo文件中以大小s開頭的行;(要求:使用兩種方式) 可有四種方式git
[root@CentOS7 ~]# cat /proc/meminfo | grep -E "^(s|S)" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -E -i "^s" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -E "^[sS]" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]# cat /proc/meminfo | grep -e "^s" -e "^S" SwapCached: 0 kB SwapTotal: 2097148 kB SwapFree: 2097148 kB Shmem: 7320 kB Slab: 74112 kB SReclaimable: 28308 kB SUnreclaim: 45804 kB [root@CentOS7 ~]#
2.顯示/etc/passwd文件中不以/bin/bash結尾的行正則表達式
[root@CentOS6 ~]# grep -E -v "/bin/bash$" /etc/passwd bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin rtkit:x:499:499:RealtimeKit:/proc:/sbin/nologin avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin abrt:x:173:173::/etc/abrt:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin saslauth:x:498:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin gdm:x:42:42::/var/lib/gdm:/sbin/nologin pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin tcpdump:x:72:72::/:/sbin/nologin nologin:x:510:514::/home/nologin:/sbin/nologin [root@CentOS6 ~]#
3.顯示用戶rpc默認的shell程序shell
[root@CentOS6 ~]# grep -E "^rpc\>" /etc/passwd #取出rpc用戶信息 rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin [root@CentOS6 ~]# grep -E "^rpc\>" /etc/passwd | cut -d: -f7 #取出shell /sbin/nologin [root@CentOS6 ~]#
4.找出/etc/passwd中的兩位或三位數apache
[root@CentOS6 ~]# grep -o "\<[0-9]\{2,3\}\>" /etc/passwd 12 10 14 11 12 100 13 30 14 50 99 99 81 81 113 113 32 32 499 499 170 170 69 69 173 173 29 29 68 68 38 38 48 48 498 76 89 89 27 27 42 42 497 495 74 74 72 72 500 500 501 501 502 503 503 507 504 508 505 509 506 510 507 511 508 512 509 513 510 514 511 515 512 516 [root@CentOS6 ~]#
5.顯示/etc/grub.conf文件中,至少以一個空白字符開頭的且後面存非空白字符的行bash
[root@CentOS6 ~]# grep "^[[:space:]]\+[^[:space:]]" /etc/grub.conf root (hd0,0) kernel /vmlinuz-2.6.32-642.el6.x86_64 ro root=UUID=f4d977bb-af76-4617-b07f-9c70ae42a056 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet initrd /initramfs-2.6.32-642.el6.x86_64.img [root@CentOS6 ~]#
6.找出"netstat -tan"命令的結果中以'LISTEN'後跟0、1或多個空白字符結尾的行app
[root@CentOS7 ~]# netstat -tan | grep -o "LISTEN[[:space:]]*$" LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN [root@CentOS7 ~]#
7.添加用戶bash、testbash、basher以及nologin(其shell爲/sbin/nologin),然後找出/etc/passwd文件中用戶名同shell名的行dom
[root@CentOS6 ~]# grep "^\([^:]\+\>\).*\<\1\>$" /etc/passwd sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt bash:x:507:511::/home/bash:/bin/bash nologin:x:510:514::/home/nologin:/sbin/nologin [root@CentOS6 ~]#
擴展正則表達式ssh
1.顯示當前系統root、mage或wang用戶的UID和默認shelliphone
[root@CentOS6 ~]# cat /etc/passwd | grep -E "^(root|mage|wang)\>" #匹配出root、mage、wang三個用戶信息 root:x:0:0:root:/root:/bin/bash mage:x:511:515::/home/mage:/bin/bash wang:x:512:516::/home/wang:/bin/bash [root@CentOS6 ~]# cat /etc/passwd | grep -E "^(root|mage|wang)\>" | cut -d: -f1,3,7 #取出用戶名、UID、shell root:0:/bin/bash mage:511:/bin/bash wang:512:/bin/bash [root@CentOS6 ~]#
2.找出/etc/rc.d/init.d/functions文件中行首爲某單詞(包括下劃線)後面跟一個小括號的行tcp
[root@CentOS6 ~]# cat /etc/rc.d/init.d/functions | grep -E "[_[:alpha:]]+\(\)" fstab_decode_str() { checkpid() { __readlink() { __fgrep() { __kill_pids_term_kill_checkpids() { __kill_pids_term_kill() { __umount_loop() { __source_netdevs_fstab() { __source_netdevs_mtab() { __umount_loopback_loop() { __find_mounts() { __pids_var_run() { __pids_pidof() { daemon() { killproc() { pidfileofproc() { pidofproc() { status() { echo_success() { echo_failure() { echo_passed() { echo_warning() { update_boot_stage() { success() { failure() { passed() { warning() { action() { action_silent() { strstr() { confirm() { get_numeric_dev() { is_ignored_file() { is_true() { is_false() { apply_sysctl() { key_is_random() { find_crypto_mount_point() { init_crypto() { [root@CentOS6 ~]#
3.使用egrep取出/etc/rc.d/init.d/functions中其基名
[root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "[^/]+/?$" #匹配以非斜線結尾的字符至少一次 functions/ [root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "[^/]+/?$" | grep -E -o "[^/]+" #過濾掉結尾的/ functions [root@CentOS6 ~]#
4.使用egrep取出上面路徑的目錄名
[root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "^/.*[^/]" #首先過濾掉結尾的/ /etc/rc.d/init.d/functions [root@CentOS6 ~]# echo /etc/rc.d/init.d/functions/ | grep -E -o "^/.*[^/]" | grep -E -o "^/.*/" #取出目錄名 /etc/rc.d/init.d/ [root@CentOS6 ~]#
5.統計以root身份登陸的每一個遠程主機IP地址的登陸次數
[root@CentOS7 ~]# last | grep -E -o "^root\>.*([[:digit:]]+\.){3}[[:digit:]]+" | tr -s ' ' | cut -d' ' -f1,3 #取出當前系統已root身份登陸的IP root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 172.18.19.139 root 192.168.0.107 root 192.168.0.109 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 root 10.1.250.60 [root@CentOS7 ~]# last | grep -E -o "^root\>.*([[:digit:]]+\.){3}[[:digit:]]+" | tr -s ' ' | cut -d' ' -f1,3 | sort | uniq -c #取出重複次數 22 root 10.1.250.60 1 root 172.18.19.139 1 root 192.168.0.107 1 root 192.168.0.109 [root@CentOS7 ~]#
6.利用擴展正則表達式分別表示0-九、10-9九、100-19九、200-24九、250-255
[root@CentOS6 ~]# grep "[0-9] [1-9][0-9] 1[0-9]{2} 2[0-4][0-9] 25[0-5]"
7.顯示ifconfig命令結果中全部IPv4地址
[root@CentOS6 ~]# ifconfig | grep -E -o "(\<([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\>\.){3}\<([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\>" 10.1.252.233 10.1.255.255 255.255.0.0 127.0.0.1 255.0.0.0 [root@CentOS6 ~]#
8.統計/etc/init.d/functions 文件中每一個單詞出現的次數,並按頻率從高到低顯示
[root@CentOS6 ~]# cat /etc/rc.d/init.d/functions | tr -sc '[:alpha:]' '\n' | sort | uniq -c | sort -nr -t' ' -k1 83 if 77 then 75 pid 73 echo 72 fi 61 return 57 dev 54 file 50 n 46 local 42 kill 39 z 36 base 35 remaining 31 a 30 d 27 in 25 null 24 key 23 is 23 fstab 23 done 23 do 23 awk 22 pids 22 list 21 for 21 BOOTUP 20 to 20 p 20 dst 19 shift ...
9.正則表達式表示×××號
[root@CentOS7 ~]# egrep "\<((1[1-5])|(2[1-3])|(3[1-7])|(4[1-6])|(5[0-4])|(6[1-5])|(71|81|82))([0-9]){4}(19|20)([0-9]){2}((0[1-9])|(1[0-2]))(0[1-9]|([0-9])|(2[0-9])|(3[0-1]))([0-9]){3}([0-9]|X)\>" number.txt 210905197807210546 370205197405213513 372922198012224773 370722197812222517 230803197906010035 152801198703025310 511428196305026357 [root@CentOS7 ~]#
10.正則表達式表示手機號
[root@CentOS7 ~]# grep -E -o "(\+86)?1[38][0-9]{9}|14[57][0-9]{8}|15[0-35-9][0-9]{8}|17[0678][0-9]{8}" iphone.txt +8613868233891 15003107238 [root@CentOS7 ~]#
11.正則表達式表示郵箱
[root@CentOS7 ~]# egrep "\<([[:alnum:]]+(-|_)*[[:alnum:]]*)\>@([[:alnum:]]+\.)+[[:alnum:]]+" mail.txt 993667135@qq.com servername@163.com [root@CentOS7 ~]#
12.正則表達式表示QQ號
[root@CentOS7 ~]# grep -E -o '\b[1-9][0-9]{4,12}\b' qq.txt 333449 521521 796898 765423 93796117258 [root@CentOS7 ~]#