awk commands

The awk action is inside braces {}

ps | awk '{print $1}''

Default separator is spaces

Change it to , for csv

awk -F ","

Change to : for passwd file

awk -F ":"

awk -F ":" '{print $1}' /etc/passwd

Print out multiple columns

awk -F ":" '{print $1 $6 $7}' /etc/passwd

Add some tabs between outputs to make it more readable

awk -F ":" '{print $1"\t"$6"\t"$7}' /etc/passwd

Change the field separator

Work on data that has : as field separator

But output the data with - as the field separator 

awk 'BEGIN{FS=":" OFS="-"} {print $1,$6,$7}' /etc/password

Print the last column

awk -F "/" '/^\//' {print $NF} /etc/shells | uniq | sort

the /'s need to be escaped \/dev

df | awk '/\/dev\/loop/' {print $1"\t"$2}

Find all the /bin/fish running

ps -ef | awk '{if ($NF == "/bin/fish") print $0}'

For loop

awk 'BEGIN {for 1=1; i<=10; i++) print "The square root of", i, "is", i*i';}'

Matching a pattern

awk '$1 ~ /^[b,c]/ {print $0}' .bashrc

awk 'match ($0, /mystring/' {print $0}'' numbered.txt

Print a section (NR number of records, line numbers)

between lines 7 and 11

df | awk 'NR==7, NR==11 {print NR, $0}'

Getting a line count

awk 'END {print NR}' /etc/shells

tracking what servers are using port 25 with linux CLI tools

There was an issue with an unknown server sending out emails and getting the public IPs blacklisted, one of my colleagues came up with this line to find what that server was by searching the syslog.

grep 'Built outbound TCP connection' my-asa-log.log | grep '/25' | grep -v 'INSIDE:192.160.10.50' | awk -F " " '{print $15}' | awk -F "/" '{print $1} | sort | uniq -c


grep 'Built outbound TCP connection' my-asa-log.log
search for outbound connections in the ASA syslog file

grep '/25'
Search for connections to port 25

grep -v 'INSIDE:192.160.10.50'
Remove entires for 192.160.10.50 (the real email server)

awk -F " " '{print $15}'
Print column 15 which was

awk -F "/" '{print $1}'
I think this was the date

sort
sorts the data alpha numeric

uniq -c
Only shows one instance of an IP address and shows the count of how many times it appeared