grep命令与正则表达式

三:grep与正则表达式

3.1 grep

grep是Linux中常用的文件搜索命令，用于在文件或命令输出中查找匹配指定模式的行。

常用选项：

选项	说明
-i	忽略大小写
-E	支持扩展正则表达式
-v	反向匹配，排除不想要的行
-n	显示行号
-c	显示匹配的行号
-o	只显示匹配的部分
-C n	显示匹配行的前后各几行
-r	递归搜索目录
-A n	显示匹配行的后几行
-B n	显示匹配行的前几行

实例

准备环境:

root@studry:~# cp -rp /etc/passwd backup/config/
root@studry:~# cd backup/config/
root@studry:~/backup/config# pwd
/root/backup/config

忽略大小写，搜索root匹配的行：

root@studry:~/backup/config# grep -i "root" passwd 
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
ROOT:x:1001:1001:ROOT:/home/ROOT:/bin/bash

显示行号，排故障看所在的位置:

root@studry:~/backup/config# grep -i -n "root" passwd 
1:root:x:0:0:Super User:/root:/bin/bash
10:operator:x:11:0:operator:/root:/usr/sbin/nologin
47:ROOT:x:1001:1001:ROOT:/home/ROOT:/bin/bash

反向匹配(排除root所在的行)

root@studry:~/backup/config# grep -v "root" passwd
bin:x:1:1:bin:/bin:/usr/sbin/nologin
daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
games:x:12:100:games:/usr/games:/usr/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin

匹配行数，快速知道有多少条:

root@studry:~/backup/config# grep -c -i "root" passwd
3

只显示匹配的部分(提取关键信息)

root@studry:~/backup/config# grep -o "root" passwd
root
root
root

显示匹配的行及前后各2行:

root@studry:~/backup/config# grep -C 2 "root" passwd
root:x:0:0:Super User:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/sbin/nologin
daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
--
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator:x:11:0:operator:/root:/usr/sbin/nologin
games:x:12:100:games:/usr/games:/usr/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin

显示匹配的行和后1行：

root@studry:~/backup/config# grep -A 1 "root" passwd
root:x:0:0:Super User:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/sbin/nologin
--
operator:x:11:0:operator:/root:/usr/sbin/nologin
games:x:12:100:games:/usr/games:/usr/sbin/nologin

显示匹配的行和前1行:

root@studry:~/backup/config# grep -B 1 "root" passwd
root:x:0:0:Super User:/root:/bin/bash
--
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator:x:11:0:operator:/root:/usr/sbin/nologin

3.2 正则表达式

正则表达式式一套匹配文本的规则，用特定的符合描写所要查找什么样的内容。

3.2.1 基础元字符

元字符	含义	示例
.	匹配任意单个字符	r..t匹配root、roOt、r!@t
^	匹配行首	^root匹配行首以root开头
$	匹配行尾	root$匹配行尾以root结尾
[]	匹配括号内任意一个字符	[0..9]匹配任意数字
[^]	不匹配括号内任意一个字符	[^{0..9]：不匹配数字。[}0..9a..zA..Z]:不匹配任何字符，匹配其他字符
\	特殊字符转换成普通字符	\. 匹配点号本身

例子：

匹配任意一个字符:

root@studry:~/backup/config# grep 'r..t' passwd 
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
clevis:x:997:996:Clevis Decryption Framework unprivileged user:/var/cache/clevis:/usr/sbin/nologin

匹配行首:

root@studry:~/backup/config# grep "^root" passwd
root:x:0:0:Super User:/root:/bin/bash

匹配行尾:

root@studry:~/backup/config# grep "bash$" passwd
root:x:0:0:Super User:/root:/bin/bash
wmn:x:1000:1000:wmn:/home/wmn:/bin/bash
user01:x:1001:1001::/home/user01:/bin/bash
ruoyi-admin:x:1002:1002::/home/ruoyi-admin:/bin/bash
ruoyi-dba:x:1003:1003::/home/ruoyi-dba:/bin/bash
ruoyi-dev:x:1004:1004::/home/ruoyi-dev:/bin/bash
tianyun:x:1005:1010::/home/tianyun:/bin/bash
jinghui:x:1006:1011::/home/jinghui:/bin/bash
ruoyi:x:1007:1012::/home/ruoyi:/bin/bash
tianyun:x:1000:1000:tianyun:/home/tianyun:/bin/bash
ROOT:x:1001:1001:ROOT:/home/ROOT:/bin/bash

匹配字符集合:

root@studry:~/backup/config# grep 'ro[oO]t' passwd   #匹配root ro0t
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin

3.2.2 量词

量词	含义	扩展正则写法
*	前导字符出现0次或多次	*
\+	前导字符出现1次或多次	+
？	前导字符出现0次或1次	？
	前导字符出现n次
	前导字符至少出现n次
	前导字符出现n到m次

例子:

*前导字符出现至少0次:

root@studry:~/backup/config# grep "ro*t" passwd
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
rtkit:x:172:172:RealtimeKit:/:/sbin/nologin

+前导字符出现至少1次：

1)方式一：
root@studry:~/backup/config# grep "ro\+t" passwd
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
2)方式二：
root@studry:~/backup/config# grep -E "ro+t" passwd    #ro出现一次 roo出现两次
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin

{}：精确匹配次数:

root@studry:~/backup/config# egrep "ro{1,3}" passwd
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
setroubleshoot:x:988:987:SELinux troubleshoot server:/var/lib/setroubleshoot:/usr/sbin/nologin
chrony:x:985:984:chrony system user:/var/lib/chrony:/sbin/nologin

3.2.3 扩展正则特有

元字符	含义	示例
\|	或	wmn\|faz
()	分组，把多个字符当成一体	(ab)+
\b	单词边界	\broot\b

例子:

或：

root@studry:~/backup/config# grep -E "root|wmn" passwd
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
wmn:x:1000:1000:wmn:/home/wmn:/bin/bash

()分组：

root@studry:~/backup/config# grep -E "r(oo)+t" passwd
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
#说明:
把oo当做一个整体，oo出现一次或多次

\b单词边界，精确匹配

root@studry:~/backup/config# grep -E "\broot\b" passwd 
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin

root@studry:~/backup/config# grep -E "\broot" passwd 
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
root123:x:1001:1001:root123:/home/root123:/bin/bash

root@studry:~/backup/config# grep -E "\bro" passwd 
root:x:0:0:Super User:/root:/bin/bash
operator:x:11:0:operator:/root:/usr/sbin/nologin
root123:x:1001:1001:root123:/home/root123:/bin/bash

3.2.4正则表达式实战

查看nginx有效配置(排除#开头的注释行和空行):

root@studry:~/backup/config# grep -E -v  "^#|^$" /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
    worker_connections 1024;
}
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    keepalive_timeout   65;
    types_hash_max_size 4096;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;
    server {
        listen       80;
        listen       [::]:80;
        server_name  _;
        root         /usr/share/nginx/html;
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;
    }
}

查看nginx有效配置，排除注释行及空行：

root@studry:~/backup/config# grep -E -v  "^#|^$|^ *#" /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
    worker_connections 1024;
}
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    keepalive_timeout   65;
    types_hash_max_size 4096;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    include /etc/nginx/conf.d/*.conf;
    server {
        listen       80;
        listen       [::]:80;
        server_name  _;
        root         /usr/share/nginx/html;
        include /etc/nginx/default.d/*.conf;
    }
}

查看ssh有效的配置：

root@studry:~/backup/config# grep -Ev "^$|^#" /etc/ssh/sshd_config
Include /etc/ssh/sshd_config.d/*.conf
AuthorizedKeysFile      .ssh/authorized_keys
Subsystem       sftp    /usr/libexec/openssh/sftp-server

匹配nginx日志的IP地址:

root@studry:~/backup/config# grep -E "\b([0-9]{1,3}\.{1,3}){3}[0-9]{1,3}\b" /var/log/nginx/access.log

查看本机的IP:

root@studry:~/backup/config# ip a |grep -E "\b([0-9]{1,3}\.{1,3}){1,3}[0-9]{1,3}\b"
    inet 127.0.0.1/8 scope host lo
    inet 10.0.0.140/24 brd 10.0.0.255 scope global dynamic noprefixroute ens160

查看日志中的状态码：

1)查看500的状态码:
root@studry:~/backup/config# grep "500" /var/log/nginx/access.log 
2)统计各种状态码出现的次数:
root@studry:~/backup/config# grep -Eo " [0-9]{3} " /var/log/nginx/access.log |sort |uniq -c
      3  200 
      4  304 
      1  404

posted on 2026-09-12 17:18 wangmengnan 阅读(17) 评论(0) 收藏举报

刷新页面返回顶部