我的书签
添加书签
移除书签[TOC]
脱掉衬衫
字符串匹配
我们再来看几个字符串匹配的示例：
$ awk '$6 ~ /FIN/ || NR==1 {print NR,$4,$5,$6}' OFS="\t" netstat.txt1 Local-Address Foreign-Address State6 coolshell.cn:80 61.140.101.185:37538 FIN_WAIT29 coolshell.cn:80 116.234.127.77:11502 FIN_WAIT213 coolshell.cn:80 124.152.181.209:26825 FIN_WAIT118 coolshell.cn:80 117.136.20.85:50025 FIN_WAIT2$ $ awk '$6 ~ /WAIT/ || NR==1 {print NR,$4,$5,$6}' OFS="\t" netstat.txt1 Local-Address Foreign-Address State5 coolshell.cn:80 124.205.5.146:18245 TIME_WAIT6 coolshell.cn:80 61.140.101.185:37538 FIN_WAIT29 coolshell.cn:80 116.234.127.77:11502 FIN_WAIT211 coolshell.cn:80 183.60.215.36:36970 TIME_WAIT13 coolshell.cn:80 124.152.181.209:26825 FIN_WAIT115 coolshell.cn:80 183.60.212.163:51082 TIME_WAIT18 coolshell.cn:80 117.136.20.85:50025 FIN_WAIT2
上面的第一个示例匹配FIN状态， 第二个示例匹配WAIT字样的状态。其实 ~ 表示模式开始。/ /中是模式。这就是一个正则表达式的匹配。
其实awk可以像grep一样的去匹配第一行，就像这样：
$ awk '/LISTEN/' netstat.txttcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTENtcp 0 0 0.0.0.0:80 0.0.0.0:* LISTENtcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTENtcp 0 0 :::22 :::* LISTEN
我们可以使用 “/FIN|TIME/” 来匹配 FIN 或者 TIME :
$ awk '$6 ~ /FIN|TIME/ || NR==1 {print NR,$4,$5,$6}' OFS="\t" netstat.txt1 Local-Address Foreign-Address State5 coolshell.cn:80 124.205.5.146:18245 TIME_WAIT6 coolshell.cn:80 61.140.101.185:37538 FIN_WAIT29 coolshell.cn:80 116.234.127.77:11502 FIN_WAIT211 coolshell.cn:80 183.60.215.36:36970 TIME_WAIT13 coolshell.cn:80 124.152.181.209:26825 FIN_WAIT115 coolshell.cn:80 183.60.212.163:51082 TIME_WAIT18 coolshell.cn:80 117.136.20.85:50025 FIN_WAIT2
再来看看模式取反的例子：
$ awk '$6 !~ /WAIT/ || NR==1 {print NR,$4,$5,$6}' OFS="\t" netstat.txt1 Local-Address Foreign-Address State2 0.0.0.0:3306 0.0.0.0:* LISTEN3 0.0.0.0:80 0.0.0.0:* LISTEN4 127.0.0.1:9000 0.0.0.0:* LISTEN7 coolshell.cn:80 110.194.134.189:1032 ESTABLISHED8 coolshell.cn:80 123.169.124.111:49809 ESTABLISHED10 coolshell.cn:80 123.169.124.111:49829 ESTABLISHED12 coolshell.cn:80 61.148.242.38:30901 ESTABLISHED14 coolshell.cn:80 110.194.134.189:4796 ESTABLISHED16 coolshell.cn:80 208.115.113.92:50601 LAST_ACK17 coolshell.cn:80 123.169.124.111:49840 ESTABLISHED19 :::22 :::* LISTEN
或是：
awk ‘!/WAIT/‘ netstat.txt
折分文件
awk拆分文件很简单，使用重定向就好了。下面这个例子，是按第6例分隔文件，相当的简单（其中的NR!=1表示不处理表头）。
$ awk 'NR!=1{print > $6}' netstat.txt$ lsESTABLISHED FIN_WAIT1 FIN_WAIT2 LAST_ACK LISTEN netstat.txt TIME_WAIT$ cat ESTABLISHEDtcp 0 0 coolshell.cn:80 110.194.134.189:1032 ESTABLISHEDtcp 0 0 coolshell.cn:80 123.169.124.111:49809 ESTABLISHEDtcp 0 0 coolshell.cn:80 123.169.124.111:49829 ESTABLISHEDtcp 0 4166 coolshell.cn:80 61.148.242.38:30901 ESTABLISHEDtcp 0 0 coolshell.cn:80 110.194.134.189:4796 ESTABLISHEDtcp 0 0 coolshell.cn:80 123.169.124.111:49840 ESTABLISHED$ cat FIN_WAIT1tcp 0 1 coolshell.cn:80 124.152.181.209:26825 FIN_WAIT1$ cat FIN_WAIT2tcp 0 0 coolshell.cn:80 61.140.101.185:37538 FIN_WAIT2tcp 0 0 coolshell.cn:80 116.234.127.77:11502 FIN_WAIT2tcp 0 0 coolshell.cn:80 117.136.20.85:50025 FIN_WAIT2$ cat LAST_ACKtcp 0 1 coolshell.cn:80 208.115.113.92:50601 LAST_ACK$ cat LISTENtcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTENtcp 0 0 0.0.0.0:80 0.0.0.0:* LISTENtcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTENtcp 0 0 :::22 :::* LISTEN$ cat TIME_WAITtcp 0 0 coolshell.cn:80 124.205.5.146:18245 TIME_WAITtcp 0 0 coolshell.cn:80 183.60.215.36:36970 TIME_WAITtcp 0 0 coolshell.cn:80 183.60.212.163:51082 TIME_WAIT
你也可以把指定的列输出到文件：
awk ‘NR!=1{print $4,$5 > $6}’ netstat.txt
再复杂一点：（注意其中的if-else-if语句，可见awk其实是个脚本解释器）
$ awk 'NR!=1{if($6 ~ /TIME|ESTABLISHED/) print > "1.txt";else if($6 ~ /LISTEN/) print > "2.txt";else print > "3.txt" }' netstat.txt$ ls ?.txt1.txt 2.txt 3.txt$ cat 1.txttcp 0 0 coolshell.cn:80 124.205.5.146:18245 TIME_WAITtcp 0 0 coolshell.cn:80 110.194.134.189:1032 ESTABLISHEDtcp 0 0 coolshell.cn:80 123.169.124.111:49809 ESTABLISHEDtcp 0 0 coolshell.cn:80 123.169.124.111:49829 ESTABLISHEDtcp 0 0 coolshell.cn:80 183.60.215.36:36970 TIME_WAITtcp 0 4166 coolshell.cn:80 61.148.242.38:30901 ESTABLISHEDtcp 0 0 coolshell.cn:80 110.194.134.189:4796 ESTABLISHEDtcp 0 0 coolshell.cn:80 183.60.212.163:51082 TIME_WAITtcp 0 0 coolshell.cn:80 123.169.124.111:49840 ESTABLISHED$ cat 2.txttcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTENtcp 0 0 0.0.0.0:80 0.0.0.0:* LISTENtcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTENtcp 0 0 :::22 :::* LISTEN$ cat 3.txttcp 0 0 coolshell.cn:80 61.140.101.185:37538 FIN_WAIT2tcp 0 0 coolshell.cn:80 116.234.127.77:11502 FIN_WAIT2tcp 0 1 coolshell.cn:80 124.152.181.209:26825 FIN_WAIT1tcp 0 1 coolshell.cn:80 208.115.113.92:50601 LAST_ACKtcp 0 0 coolshell.cn:80 117.136.20.85:50025 FIN_WAIT2
统计
下面的命令计算所有的C文件，CPP文件和H文件的文件大小总和。
$ ls -l *.cpp *.c *.h | awk '{sum+=$5} END {print sum}'2511401
我们再来看一个统计各个connection状态的用法：（我们可以看到一些编程的影子了，大家都是程序员我就不解释了。注意其中的数组的用法）
$ awk 'NR!=1{a[$6]++;} END {for (i in a) print i ", " a[i];}' netstat.txtTIME_WAIT, 3FIN_WAIT1, 1ESTABLISHED, 6FIN_WAIT2, 3LAST_ACK, 1LISTEN, 4
再来看看统计每个用户的进程的占了多少内存（注：sum的RSS那一列）
$ ps aux | awk 'NR!=1{a[$1]+=$6;} END { for(i in a) print i ", " a[i]"KB";}'dbus, 540KBmysql, 99928KBwww, 3264924KBroot, 63644KBhchen, 6020KB
