Read, search and change text files

$cat /etc/hostname
$cat -n /etc/fstab
$cat -A script.sh
$tac /var/log/dnf.log | head

• -n numbers the lines.
• -A shows hidden characters: tabs as ^I, line ends as $, Windows ends as ^M$.
• tac is cat backwards: the last line first.

$head /etc/passwd
$head -n 3 /etc/passwd
$tail -n 20 /var/log/secure
#tail -f /var/log/messages
$head -n 10 /etc/passwd | tail -n 1

The last line prints only line 10: the first 10 lines, then the last of them.

$cut -d: -f1 /etc/passwd
$cut -d: -f1,7 /etc/passwd
$cut -c1-8 /etc/passwd

In /etc/passwd the fields are separated by :. Field 1 is the user name, field 7 the shell.

$sort /etc/passwd
$sort -t: -k3 -n /etc/passwd
$du -sh /var/* 2>/dev/null | sort -h
$cut -d: -f7 /etc/passwd | sort | uniq -c | sort -rn

The last example counts how many users use each shell: sort first, then uniq -c counts, then sort the counts.

$wc /etc/passwd
  45   95 2512 /etc/passwd
$wc -l /etc/passwd
$grep -c bash /etc/passwd
$ls /etc | wc -l

The numbers are lines, words, bytes.

$grep '^root' /etc/passwd
$grep 'nologin$' /etc/passwd
$grep -E '^[a-z]+[0-9]{2}$' users.txt
$grep -v '^#' /etc/ssh/sshd_config | grep -v '^$'

Basic regex (BRE) is the default; extended regex (ERE) with grep -E lets you use + ? {} | () without backslashes.

$awk -F: '{print $1, $7}' /etc/passwd
$awk -F: '$3 >= 1000 {print $1}' /etc/passwd
$df -h | awk 'NR>1 {print $5, $6}'
$ps aux | awk '{sum += $6} END {print sum/1024 " MiB"}'
$awk '/Failed password/ {print $(NF-3)}' /var/log/secure | sort | uniq -c | sort -rn

• -F: sets the field separator (default: spaces and tabs).
• $0 is the whole line, NF the number of fields, NR the line number.
• A pattern before { } selects lines: $3 >= 1000 = normal users.

The last example counts failed SSH logins per IP address.

$echo "Hello" > hello.txt
$cat > ~/notes.txt <<'EOF'
server1 192.168.122.10
server2 192.168.122.20
EOF
#cat >> /etc/hosts <<'EOF'
192.168.122.30 server3.example.com server3
EOF

<<'EOF' reads lines until a line with only EOF. With quotes around EOF, variables like $HOME stay as they are.

• less pages through a file (/word to search, q to quit); cat prints a whole file; head and tail show the start and end.
• tail -f follows a file live, for example a log file.
• cut takes columns, sort orders lines, uniq removes repeated lines, wc counts lines, words and bytes.
• A regular expression describes text: ^ start, $ end, . any character, * repeat, [ ] a set.
• grep finds lines: -i ignore case, -v invert, -r recursive, -E extended regex, -n line numbers.
• awk works with fields (awk -F: '{print $1}'); sed changes text (sed -i 's/old/new/g' file).
• Quote regular expressions with single quotes, so the shell does not change them.