正则表达式grep/egrep -sed -awk

grep

1. grep -c 统计过滤符合条件的有多少行

[root@localhost grep]# grep -c 'root' pass
2

2 . grep -i 不区分过滤条件的大小写

[root@localhost grep]# grep -i 'root' pass
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/ROOT:/sbin/nologin
[root@localhost grep]# 

3 . grep -n 显示过滤条件的行号

[root@localhost grep]# grep -n 'root' pass
1:root:x:0:0:root:/root:/bin/bash
[root@localhost grep]# grep -ni 'root' pass
1:root:x:0:0:root:/root:/bin/bash
10:operator:x:11:0:operator:/ROOT:/sbin/nologin

4 . grep -v 取反

[root@localhost grep]# grep -nvi '/sbin/nologin' pass
1:root:x:0:0:root:/root:/bin/bash
6:sync:x:5:0:sync:/sbin:/bin/sync
7:shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8:halt:x:7:0:halt:/sbin:/sbin/halt
23:chengdu:x:1000:1000::/home/chengdu:/bin/bash
24:chongqing:x:1001:1001::/home/chongqing:/bin/bash

5 . grep -r 遍历所有子目录 ，会在/etc/目录下的所有子目录去寻找过滤条件。

[root@localhost grep]# grep 'root' /etc/
grep: /etc/: 是一个目录

6 . grep -A后面跟数字， 过滤出符合条件的行以及下面n行。

[root@localhost grep]# grep -A3 '/sbin/shutdown' pass 
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/ROOT:/sbin/nologin

7 . grep -B后面跟数字， 过滤出符合条件的行以及上面n行。

[root@localhost grep]# grep -B2 '/sbin/shutdown' pass 
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

8 . grep -C 后面跟数字， 过滤出符合条件的行以及上下面n行。

[root@localhost grep]# grep -nC2 '/sbin/shutdown' pass 
5-lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6-sync:x:5:0:sync:/sbin:/bin/sync
7:shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8-halt:x:7:0:halt:/sbin:/sbin/halt
9-mail:x:8:12:mail:/var/spool/mail:/sbin/nologin

9 . grep ‘[0-9]’ 匹配任意数字的行

[root@localhost grep]# grep '[0-9]' pass 
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/ROOT:/sbin/nologin

10 . grep -v ‘[0-9]’ 不包含任何数字的行

[root@localhost grep]# grep -v '[0-9]' pass 
mysql:x:xxx:aaaa::/home/mysql:/sbin/nologin

11 . grep -v ‘^#’ 不显示已#号开头的行

[root@localhost grep]# grep -nv '^#' init 
5: Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target 12: To view current default target, run: [root@localhost grep]# grep -n '^#' init 1:# inittab is no longer used when using systemd. 2:# 3:# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM. 4:# 6:# 7:# systemd uses 'targets' instead of runlevels. By default, there are two main targets: 8:# 9:# multi-user.target: analogous to runlevel 3 10:# graphical.target: analogous to runlevel 5 11:# 13:# systemctl get-default 14:# 15:# To set a default target, run: 16:# systemctl set-default TARGET.target 17:# 

12 . grep ‘[^0-9]’ 过滤出非数字的任何字符。

[root@localhost grep]# grep '[^0-9]' init 
# inittab is no longer used when using systemd.
#
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
#
 Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses 'targets' instead of runlevels. By default, there are two main targets:
#
# multi-user.target: analogous to runlevel 3
# graphical.target: analogous to runlevel 5
#
To view current default target, run:
# systemctl get-default
# To set a default target, run:
# systemctl set-default TARGET.target
1234@111

13 . grep ‘^[^0-9]’ 过滤出非数字开头的行

[root@localhost grep]# grep '^[^0-9]' init 
# inittab is no longer used when using systemd.
#
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
#
 Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses 'targets' instead of runlevels. By default, there are two main targets:
#
# multi-user.target: analogous to runlevel 3
# graphical.target: analogous to runlevel 5
#
To view current default target, run:
# systemctl get-default
# To set a default target, run:
# systemctl set-default TARGET.target 

^在[ ] 里面取非之意 ，^ 在[ ] 外面指以什么开头

14 . grep ‘r.t’ 其中的.表示任意一个字符。

[root@localhost grep]# grep 'p.p' pass 
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

15 . grep ‘o*t’ 其中表示零个或多个前面的字符

root@localhost grep]# grep 'o*t' pass 
roooot:x:0:0:root:/root:/bin/bash
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
operator:x:11:0:operator:/ROOT:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:997:User for polkitd:/:/sbin/nologin
postfix:x:89:89::/var/spoool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin

.* 表示零个或多个任意字符，空行也涵括在内，所有都匹配。
[root@localhost grep]# grep 'mysql.*gin' pass 
mysql:x:xxx:aaaa::/home/mysql:/sbin/nologin

16 . 指定要过滤出的字符出现次数

grep 'o\{2\}'  passwd 或者是egrep 'o{2}' passwd

[root@localhost grep]# grep 'o\{2\}' pass
roooot:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
postfix:x:89:89::/var/spoool/postfix:/sbin/nologin
chongqing:x:1001:1001::/hoome/chongqing:/bin/bash
[root@localhost grep]# egrep 'o{2}' pass
roooot:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
postfix:x:89:89::/var/spoool/postfix:/sbin/nologin
chongqing:x:1001:1001::/hoome/chongqing:/bin/bash
[root@localhost grep]# 

17 .过滤出一个或多个指定的字符。

[root@localhost grep]# egrep 'oo+' pass
roooot:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
postfix:x:89:89::/var/spoool/postfix:/sbin/nologin
chongqing:x:1001:1001::/hoome/chongqing:/bin/bash

符号+ 表示匹配一个或多个+前面的字符，而符号？表示匹配零个或1个？前面的字符

18 . 过滤出字符串1或者字符串2

[root@localhost grep]# egrep 'root|mysql' pass
roooot:x:0:0:root:/root:/bin/bash
mysql:x:xxx:aaaa::/home/mysql:/sbin/nologin

---

---

---

sed

1 . 匹配符合条件的行，并不打印无关的行

[root@localhost sed]# sed -n '/root/'p passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin

2 sed中也是支持. * ? +的。这些需要加上脱意字符，如果不想使用脱意字符，可以使用-r选项

[root@localhost sed]# sed -n '/o+t/'p passwd 
[root@localhost sed]# sed -n '/o\+t/'p passwd 
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[root@localhost sed]# sed -nr '/o+t/'p passwd 
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin

3 打印指定的行或者一个范围

[root@localhost sed]# sed -n '1'p passwd 
root:x:0:0:root:/root:/bin/bash
[root@localhost sed]# 
[root@localhost sed]# sed -n '1,3'p passwd 
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologinROOT    
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[root@localhost sed]# sed -n '18,$'p passwd 
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

4 同一表示式中进行多个动作

[root@localhost sed]# sed -e '16'p  -e '/NAME/'p -n  ip 
NAME=ens33
IPADDR=192.168.244.138

如果某行满足2个条件 ，那么该行会打印2次。

5 . 匹配时不区分大小写

[root@localhost sed]# sed -n '/var/'Ip passwd 
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:998:996::/VAR/lib/chrony:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin

6 , 删除某行或多行 ，不会删除文件内容，只是在屏幕上显示。

[root@localhost sed]# sed '1,20'd passwd 
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

7 . 如果要删除文件中的某行或多行，需要使用-i选项

[root@localhost sed]# wc -l passwd
26 passwd
[root@localhost sed]# sed -i '1,20'd passwd 
[root@localhost sed]# 
[root@localhost sed]# wc -l passwd
6 passwd

8 .删除某个字符相关的行

[root@localhost sed]# sed -i '/mysql/'d passwd
[root@localhost sed]# grep 'mysql' passwd

9 . 针对一个范围内的查找全局替换

[root@localhost sed]# sed -n '1,10s/root/ROOT/g'p passwd
ROOT:x:0:0:ROOT:/ROOT:/bin/bash
operator:x:11:0:operator:/ROOT:/sbin/nologin

10 . 要替换的字符串支持正则表示式，但是需要加上-r选项

[root@localhost sed]# sed -r '1,10s/ro+/r/g' passwd |head
rt:x:0:0:rt:/rt:/bin/bash
bin:x:1:1:bin:/BIN:/sbin/nologinROOT    
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/rt:/sbin/nologin

11 .将第一段与最后一段进行调换位置

[root@localhost sed]# head passwd |sed -r 's/([^:]+):(.*):([^:]+)/\3:\2:\1/'
/bin/bash:x:0:0:root:/root:root
/sbin/nologin:x:1:1:bin:/bin:bin
/sbin/nologin:x:2:2:daemon:/sbin:daemon
/sbin/nologin:x:3:4:adm:/var/adm:adm
/sbin/nologin:x:4:7:lp:/var/spool/lpd:lp
/bin/sync:x:5:0:sync:/sbin:sync
/sbin/shutdown:x:6:0:shutdown:/sbin:shutdown
/sbin/halt:x:7:0:halt:/sbin:halt
/sbin/nologin:x:8:12:mail:/var/spool/mail:mail
/sbin/nologin:x:11:0:operator:/root:operator

12 .在替换时遇到/时，不用转意字符时，可以使用其他符号来分隔

[root@localhost sed]# head passwd |sed 's/\/sbin\/nologin/123/g'
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:123
daemon:x:2:2:daemon:/sbin:123
adm:x:3:4:adm:/var/adm:123
lp:x:4:7:lp:/var/spool/lpd:123
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:123
operator:x:11:0:operator:/root:123

[root@localhost sed]# head passwd |sed 's@/sbin/nologin@456@g'
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:456
daemon:x:2:2:daemon:/sbin:456
adm:x:3:4:adm:/var/adm:456
lp:x:4:7:lp:/var/spool/lpd:456
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:456
operator:x:11:0:operator:/root:456

13 .要删除文件中的所有字符，可以是匹配到所有字母，将它们替换为空

head passwd |sed 's/[a-zA-Z]//g'

[root@localhost sed]# head passwd |sed 's/[a-zA-Z]//g'
::0:0::/://
::1:1::/://
::2:2::/://
::3:4:://://
::4:7::///://
::5:0::/://
::6:0::/://
::7:0::/://
::8:12::///://
::11:0::/://

14 所有行前面加上固定的字符串。&表示前面的小括号。

[root@localhost sed]# head passwd |sed -r 's/(.*)/aaa:&/'
aaa:root:x:0:0:root:/root:/bin/bash
aaa:bin:x:1:1:bin:/bin:/sbin/nologin
aaa:daemon:x:2:2:daemon:/sbin:/sbin/nologin
aaa:adm:x:3:4:adm:/var/adm:/sbin/nologin
aaa:lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
aaa:sync:x:5:0:sync:/sbin:/bin/sync
aaa:shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
aaa:halt:x:7:0:halt:/sbin:/sbin/halt
aaa:mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
aaa:operator:x:11:0:operator:/root:/sbin/nologin

---

---

AWK ##

1 .截取文档中的某个或多个字段

[root@localhost awk]# awk -F ':' '{print $1,$3,$4}' pass  |head
root 0 0
bin 1 1
daemon 2 2
adm 3 4
lp 4 7
sync 5 0
shutdown 6 0
halt 7 0
mail 8 12
operator 11 0

如果不使用-F指定分隔符号，默认已空白字符或者空格作为分隔符

2 .匹配字符或者字符串

[root@localhost awk]# awk '/oo/' pass 
root:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin

高级用法：只打印出第一段含有oo的行

[root@localhost awk]# awk -F ':' '$1 ~ /oo/' pass 
root:x:0:0:root:/root:/bin/bash

匹配多个条件并做输出不同的字段

[root@localhost awk]# awk -F ':' '/root|mysql/ {print $1,$3,$4}' pass 
root 0 0
operator 11 0
mysql 1002 1002
[root@localhost awk]# 
[root@localhost awk]# awk -F ':' '/root/ {print $1} /sshd/ {print $3,$4}' pass 
root
operator
74 74
[root@localhost awk]# 

3 .数字运算表达式
（1 ）打印匹配第3段等于0的行

[root@localhost awk]# awk -F ':' '$3=="0"' pass 
root:x:0:0:root:/root:/bin/bash
[root@localhost awk]# 

（2） 打印第4段大于500的行

[root@localhost awk]# awk -F ':' '$4>=500 {print $1}' pass 
polkitd
chrony
nfsnobody
chengdu
chongqing
mysql
php-fpm
[root@localhost awk]# awk -F ':' '$4>=500 {print $0}' pass 
polkitd:x:999:997:User for polkitd:/:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin
[root@localhost awk]# 

如果需求是针对数字的，不加双引号。不然得不到想要的结果。

（3）打印第7段不等于/sbin/nologin的行

[root@localhost awk]# awk -F ':' '$7!="/sbin/nologin" {print $0}' pass 
root:x:0:0:root:/root:/bin/bash
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
[root@localhost awk]# 

这里如果针对的是字符串，那么是需要加上双引号的。

4 . 2个字段之间的比较

[root@localhost awk]# awk -F ':' '$3<$4 {print $0}' pass 
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

可以2个条件一起使用

[root@localhost awk]# awk -F ':' '$3>5 && 40<$4 {print $0}' pass 
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:997:User for polkitd:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

满足多个条件中的一个

[root@localhost awk]# awk -F ':' '$3>1000 || $7=="/bin/bash" {print $0}' pass 
root:x:0:0:root:/root:/bin/bash
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

[root@localhost awk]# awk -F ':' '$3>1001 || $7 ~ /bash/ {print $0}' pass 
root:x:0:0:root:/root:/bin/bash
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
chengdu:x:1000:1000::/home/chengdu:/bin/bash
chongqing:x:1001:1001::/home/chongqing:/bin/bash
mysql:x:1002:1002::/home/mysql:/sbin/nologin
php-fpm:x:1003:1003::/home/php-fpm:/sbin/nologin

针对打印出的多段改变分隔符

[root@localhost awk]# head -5 pass |awk -F ':' '{OFS="#"} {print $1,$3,$4}'
root#0#0
bin#1#1
daemon#2#2
adm#3#4
lp#4#7

[root@localhost awk]# awk -F ':' '{OFS="#"} {if ($3>1000) {print $1,$3,$4}}' pass 
nfsnobody#65534#65534
chongqing#1001#1001
mysql#1002#1002
php-fpm#1003#1003

内置变量NF、NR的使用

[root@localhost awk]# head -5 pass |awk -F ':' '{print NF}'   
7
7
7
7
7
[root@localhost awk]# head -5 pass |awk -F ':' '{print $NF}'   
/bin/bash
/sbin/nologin
/sbin/nologin
/sbin/nologin
/sbin/nologin
NF是指多少段,$NF是最后一段的值

使用NR作为判断条件

[root@localhost awk]# awk 'NR<10' pass 
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
[root@localhost awk]# awk 'NR<10' pass |nl
     1  root:x:0:0:root:/root:/bin/bash
     2  bin:x:1:1:bin:/bin:/sbin/nologin
     3  daemon:x:2:2:daemon:/sbin:/sbin/nologin
     4  adm:x:3:4:adm:/var/adm:/sbin/nologin
     5  lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
     6  sync:x:5:0:sync:/sbin:/bin/sync
     7  shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
     8  halt:x:7:0:halt:/sbin:/sbin/halt
     9  mail:x:8:12:mail:/var/spool/mail:/sbin/nologin

[root@localhost awk]# awk -F ':' 'NF==6 && /root/' pass 
rootx:0:0:root:/root:/bin/bash

OFS用来定义分隔符号，但是它是在输出的时候定义，NF表示用分隔符分隔后一共有多少段，NR表示行号。

[root@localhost awk]# head pass | awk -F ':'  '{OFS="#"} $1="root" '
root#0#0#root#/root#/bin/bash
root#x#1#1#bin#/bin#/sbin/nologin
root#x#2#2#daemon#/sbin#/sbin/nologin
root#x#3#4#adm#/var/adm#/sbin/nologin
root#x#4#7#lp#/var/spool/lpd#/sbin/nologin
root#x#5#0#sync#/sbin#/bin/sync
root#x#6#0#shutdown#/sbin#/sbin/shutdown
root#x#7#0#halt#/sbin#/sbin/halt
root#x#8#12#mail#/var/spool/mail#/sbin/nologin
root#x#11#0#operator#/root#/sbin/nologin

求和第三段

[root@localhost awk]# awk -F ':' '{(tot=tot+$3)} ; END {print tot}' pass 
72206
[root@localhost awk]#