F.E.
1、 示例1，if条件判断语句：
1> 单分支if语句1；
[root@KOU ~]#
[root@KOU ~]# awk -F: '{if($3>=1000)print $1,$3}' /etc/passwd
kou 1000
nfsnobody 65534
maha 1001
[root@KOU ~]#
2> 单分支if语句2；
[root@KOU ~]#
[root@KOU ~]# awk -F: '{if($NF=="/bin/bash")printf "%-18s:%-10s:%-s\n",$1,$3,$7}' /etc/passwd
root :0 :/bin/bash
kou :1000 :/bin/bash
maha :1001 :/bin/bash
[root@KOU ~]#
3> 单分支if语句3；
[root@KOU ~]# awk '{if(NF>5)print}' /etc/fstab
# Created by anaconda on Mon May 21 20:19:01 2018
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
UUID=cf39f560-952f-4328-9110-c0dc20265fae / xfs defaults 0 0
UUID=a9c73f6f-3e2f-40d8-8c20-d2421bb15e88 /boot xfs defaults 0 0
/dev/mapper/KOU-usr /usr xfs defaults 0 0
UUID=e68723d4-44ce-4fde-a3e9-816e5d6d4f0c /var xfs defaults 0 0
UUID=db46ba65-2bb9-49f8-8c89-c1ac8cb4c9be swap swap defaults 0 0
[root@KOU ~]#
4> 单分支if语句4；
[root@KOU ~]#
[root@KOU ~]# df -lh | awk -F% '{print $1}'
Filesystem Size Used Avail Use
/dev/sda7 15G 103M 15G 1
devtmpfs 471M 0 471M 0
tmpfs 488M 0 488M 0
tmpfs 488M 20M 468M 4
tmpfs 488M 0 488M 0
/dev/mapper/KOU-usr 5.0G 4.1G 1011M 81
/dev/sda3 6.0G 477M 5.6G 8
/dev/sda2 2.0G 164M 1.9G 9
tmpfs 98M 4.0K 98M 1
tmpfs 98M 48K 98M 1
/dev/sr0 8.8G 8.8G 0 100
[root@KOU ~]#
[root@KOU ~]# df -lh | awk -F% '{print $1}' | awk '{if($NF>80)print $1}'
Filesystem
/dev/mapper/KOU-usr
/dev/sr0
[root@KOU ~]#
[root@KOU ~]#
[root@KOU ~]# df -lh | awk -F% '/^\/dev/{print $1}' | awk '{if($NF>80)print $1}'
/dev/mapper/KOU-usr
/dev/sr0
[root@KOU ~]#
5> 双分支if语句；
[root@KOU ~]# awk -F: '{if($3>=1000){printf "common user : %-18s:%-s\n",$1,$3} else {printf "system user : %-18s:%-s\n",$1,$3}}' /etc/passwd
system user : root :0
system user : bin :1
system user : daemon :2
system user : adm :3
system user : lp :4
system user : sync :5
system user : shutdown :6
system user : halt :7
system user : mail :8
system user : operator :11
system user : games :12
system user : ftp :14
system user : nobody :99
system user : systemd-network :192
system user : dbus :81
system user : polkitd :999
system user : postfix :89
system user : sshd :74
common user : kou :1000
......
system user : sssd :992
system user : tcpdump :72
common user : maha :1001
system user : qemu :107
system user : usbmuxd :113
system user : saslauth :991
system user : radvd :75
system user : unbound :990
system user : avahi :70
system user : gnome-initial-setup:989
system user : apache :48
2、示例2，while循环语句：
1> 显示指定字段的字符个数；
[root@KOU ~]#
[root@KOU ~]# awk '/^[[:space:]]*linux16/{i=1;while(i<=NF) {printf "%-55s,%-s\n",$i,length($i);i++}}' /etc/grub2.cfg
linux16 ,7
/vmlinuz-3.10.0-862.2.3.el7.x86_64 ,34
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
ro ,2
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
rhgb ,4
quiet ,5
LANG=en_US.UTF-8 ,16
linux16 ,7
/vmlinuz-3.10.0-693.el7.x86_64 ,30
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
ro ,2
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
rhgb ,4
quiet ,5
LANG=en_US.UTF-8 ,16
linux16 ,7
/vmlinuz-0-rescue-ab4db88d98d84dfa8b33daec6dbd2e2d ,50
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
ro ,2
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
rhgb ,4
quiet ,5
[root@KOU ~]#
2> 先对符合模式匹配的行进行各个字段的字符数计算并显示，再根据指定的字符数量过滤显示；
[root@KOU ~]#
[root@KOU ~]# awk '/^[[:space:]]*linux16/{i=1;while(i<=NF) {printf "%-55s,%-s\n",$i,length($i);i++}}' /etc/grub2.cfg | awk -F, '{if($2>10)printf "%-55s,%-s\n",$1,$2}'
/vmlinuz-3.10.0-862.2.3.el7.x86_64 ,34
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-3.10.0-693.el7.x86_64 ,30
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-0-rescue-ab4db88d98d84dfa8b33daec6dbd2e2d ,50
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
[root@KOU ~]#
[root@KOU ~]#
[root@KOU ~]# awk '/^[[:space:]]*linux16/{i=1;while(i<=NF) {if(length($i)>10){printf "%-55s,%-s\n",$i,length($i)};i++}}' /etc/grub2.cfg
/vmlinuz-3.10.0-862.2.3.el7.x86_64 ,34
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-3.10.0-693.el7.x86_64 ,30
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-0-rescue-ab4db88d98d84dfa8b33daec6dbd2e2d ,50
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
[root@KOU ~]#
3、for循环举例：
先对符合模式匹配的行进行各个字段的字符数计算并显示，再根据指定的字符数量过滤显示；<承上例，此处用for循环书写>
[root@KOU ~]#
[root@KOU ~]# awk '/^[[:space:]]*linux16/{for(i=1;i<=NF;i++) {if(length($i)>10){printf "%-55s,%-s\n",$i,length($i)}}}' /etc/grub2.cfg
/vmlinuz-3.10.0-862.2.3.el7.x86_64 ,34
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-3.10.0-693.el7.x86_64 ,30
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
LANG=en_US.UTF-8 ,16
/vmlinuz-0-rescue-ab4db88d98d84dfa8b33daec6dbd2e2d ,50
root=UUID=cf39f560-952f-4328-9110-c0dc20265fae ,46
crashkernel=auto ,16
rd.lvm.lv=KOU/usr ,17
[root@KOU ~]#
4、next
[root@KOU ~]#
[root@KOU ~]# awk -F: '{if($3%2==0) printf "%-18s:%-s\n",$1,$3}' /etc/passwd
root :0
daemon :2
lp :4
shutdown :6
mail :8
games :12
ftp :14
systemd-network :192
sshd :74
kou :1000
geoclue :998
rpc :32
gluster :996
rtkit :172
ntp :38
setroubleshoot :994
gdm :42
nfsnobody :65534
sssd :992
tcpdump :72
unbound :990
avahi :70
apache :48
[root@KOU ~]#
--------------------------------------
[root@KOU ~]#
[root@KOU ~]# awk -F: '{if($3%2!=0) next; printf "%-18s:%-s\n",$1,$3}' /etc/passwd
root :0
daemon :2
lp :4
shutdown :6
mail :8
games :12
ftp :14
systemd-network :192
sshd :74
kou :1000
geoclue :998
rpc :32
gluster :996
rtkit :172
ntp :38
setroubleshoot :994
gdm :42
nfsnobody :65534
sssd :992
tcpdump :72
unbound :990
avahi :70
apache :48
5、awk的自定义变量、for循环遍历数组：
[root@KOU ~]#
[root@KOU ~]# awk 'BEGIN{weekdays["mon"]="monday";weekdays["tue"]="tuesday"; print weekdays["mon"]}'
monday
[root@KOU ~]#
[root@KOU ~]# awk 'BEGIN{weekdays["mon"]="monday";weekdays["tue"]="tuesday"; print weekdays["tue"]}'
tuesday
[root@KOU ~]#
[root@KOU ~]# awk 'BEGIN{weekdays["mon"]="monday";weekdays["tue"]="tuesday"; for(w in weekdays) print weekdays[w]}'
tuesday
monday
[root@KOU ~]#
6、for循环遍历数组特殊应用；
统计TCP协议类型应用的各种状态，并计数；
[root@KOU ~]# netstat -tan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 192.168.206.88:22 192.168.206.1:52456 ESTABLISHED
tcp 0 52 192.168.206.88:22 192.168.206.1:51901 ESTABLISHED
tcp 0 0 192.168.206.88:22 192.168.206.1:52463 ESTABLISHED
tcp6 0 0 :::111 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
[root@KOU ~]#
[root@KOU ~]#
[root@KOU ~]# netstat -tan | awk '/^tcp\>/{state[$NF]++}END{for(i in state) {print i,state[i]}}'
LISTEN 4
ESTABLISHED 3
[root@KOU ~]#
统计web日志文件中IP地址访问top数量，并计数排列；
[root@KOU access_2018_03]#
[root@KOU access_2018_03]# awk '{ipaddr[$1]++}END{for(count in ipaddr) {print ipaddr[count],count}}' access_2018-03-14.log | sort -nr | head -15
84833 180.173.31.69
2192 183.234.61.135
1440 47.104.162.74
545 61.140.180.103
129 101.226.65.107
110 14.24.210.76
52 112.96.128.79
26 112.97.250.79
22 171.13.14.146
21 140.205.205.34
21 140.205.205.28
20 220.181.132.200
20 220.181.132.195
20 171.13.14.150
20 116.21.181.63
[root@KOU access_2018_03]#
[root@KOU access_2018_03]# cat access_2018-03-14.log | cut -d' ' -f1 | sort | uniq -c | sort -rn | head -15
84833 180.173.31.69
2192 183.234.61.135
1440 47.104.162.74
545 61.140.180.103
129 101.226.65.107
110 14.24.210.76
52 112.96.128.79
26 112.97.250.79
22 171.13.14.146
21 140.205.205.34
21 140.205.205.28
20 220.181.132.200
20 220.181.132.195
20 171.13.14.150
20 116.21.181.63
[root@KOU access_2018_03]#
统计指定文件中每个单词出现的次数；
[root@KOU ~]#
[root@KOU ~]# awk '{for(i=1;i<=NF;i++){count[$i]++}}END{for(w in count){printf "%-5s,%-s\n",count[w],w}}' /etc/fstab
1 ,man
1 ,May
1 ,and/or
1 ,maintained
4 ,xfs
1 ,/var
1 ,Accessible
7 ,#
1 ,are
5 ,defaults
1 ,blkid(8)
1 ,/
....................
1 ,info
1 ,20:19:01
2 ,swap
1 ,filesystems,
1 ,reference,
1 ,for
1 ,UUID=a9c73f6f-3e2f-40d8-8c20-d2421bb15e88
1 ,under
[root@KOU ~]#
函数：split举例；
[root@KOU ~]#
[root@KOU ~]# netstat -tan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 192.168.206.88:22 192.168.206.1:52456 ESTABLISHED
tcp 0 0 192.168.206.88:22 192.168.206.1:51901 ESTABLISHED
tcp 0 0 192.168.206.88:22 192.168.206.1:52463 ESTABLISHED
tcp6 0 0 :::111 :::* LISTEN
tcp6 0 0 :::80 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
[root@KOU ~]#
[root@KOU ~]# netstat -tan | awk '/^tcp\>/{split($5,ip,":");count[ip[1]]++}END{for(i in count){print i,count[i]}}'
0.0.0.0 4
192.168.206.1 3
[root@KOU ~]#
[root@KOU ~]#
[root@KOU ~]# netstat -tan | awk '/^tcp\>/{split($5,ip,":");count[ip[1]]++}END{for(i in count){print count[i],i}}'
4 0.0.0.0
3 192.168.206.1
[root@KOU ~]#