9.1 正則介紹_grep上 

9.2 grep中

9.3 grep下

擴展
把一個目錄下，過濾所有*.php文檔中含有eval的行
grep -r --include="*.php" ‘eval‘ /data/





# 9.1 正則介紹 grep 上

![mark](http://oqxf7c508.bkt.clouddn.com/blog/20170822/222929890.png?imageslim)
```
[[email protected] ~]# ls
111  1_heard.txt  1.txt   1.txt.bak  2.txt      3.txt  aminglinux         bb.txt    test
123  1_sorft.txt  1.txt~  234        2.txt.bak  4.txt  anaconda-ks.cfg.1  biji.txt
[[email protected] ~]# mkdir grep
[[email protected] ~]# cd grep/
[[email protected] grep]# cp /etc/passwd  .
[[email protected] grep]# ls
passwd
[[email protected] grep]# pwd
/root/grep
[[email protected] grep]# ls
passwd

[[email protected] grep]# grep ‘nologin‘ passwd
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
user4:x:1006:1005::/home/aming111:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# which grep
alias grep=‘grep --color=auto‘
	/usr/bin/grep
[[email protected] grep]# 
```
- grep -c 查看行數
```
[[email protected] grep]# grep -c ‘nologin‘ passwd
19
[[email protected] grep]# 
```
- grep -n 查看行號  在最左側顯示
```
[[email protected] grep]# grep -n ‘nologin‘ passwd
2:bin:x:1:1:bin:/bin:/sbin/nologin
3:daemon:x:2:2:daemon:/sbin:/sbin/nologin
4:adm:x:3:4:adm:/var/adm:/sbin/nologin
5:lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
9:mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10:operator:x:11:0:operator:/root:/sbin/nologin
11:games:x:12:100:games:/usr/games:/sbin/nologin
12:ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
13:nobody:x:99:99:Nobody:/:/sbin/nologin
14:systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
15:systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
16:dbus:x:81:81:System message bus:/:/sbin/nologin
17:polkitd:x:998:996:User for polkitd:/:/sbin/nologin
18:tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
19:postfix:x:89:89::/var/spool/postfix:/sbin/nologin
20:sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
21:chrony:x:997:995::/var/lib/chrony:/sbin/nologin
26:user4:x:1006:1005::/home/aming111:/sbin/nologin
29:saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```
- grep -i 不區分大小寫,先vim passwd 打開把第一行nologin 改成大寫 NOLOGIN
```
[[email protected] grep]# vim passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
-- 插入 --      

[[email protected] grep]# vim passwd
```
- grep -ni 和 grep -n的區別,   會把第三行忽略，grep -ni 就不會區分大小寫
```
[[email protected] grep]# grep -n ‘nologin‘ passwd
2:bin:x:1:1:bin:/bin:/sbin/nologin
4:adm:x:3:4:adm:/var/adm:/sbin/nologin



[[email protected] grep]# grep -ni ‘nologin‘ passwd
2:bin:x:1:1:bin:/bin:/sbin/nologin
3:daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
4:adm:x:3:4:adm:/var/adm:/sbin/nologin
```
- grep -v 取反 ,所有不帶nologin的行  grep -vni 看下
```
[[email protected] grep]# grep -vni ‘nologin‘ passwd
1:root:x:0:0:root:/root:/bin/bash
6:sync:x:5:0:sync:/sbin:/bin/sync
7:shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8:halt:x:7:0:halt:/sbin:/sbin/halt
22:aming:x:1000:1005::/home/aming:/bin/bash
23:user1:x:1001:1001::/home/user1:/bin/bash
24:user2:x:1002:1002::/home/user2:/bin/bash
25:user3:x:1004:1005::/home/user3:/bin/bash
27:user5:x:1007:1007::/home/user5:/bin/bash
28:user6:x:1008:1010::/home/user6:/bin/bash
[[email protected] grep]# 
```
-  -r 遍歷所有的字目錄
```
[[email protected] grep]# grep -r ‘root‘ /etc/
/etc/pki/ca-trust/ca-legacy.conf:# The upstream Mozilla.org project tests all changes to the root CA
/etc/pki/ca-trust/ca-legacy.conf:# to temporarily keep certain (legacy) root CA certificates trusted,
/etc/pki/ca-trust/ca-legacy.conf:#   It may keep root CA certificate as trusted, which the upstream 
/etc/pki/ca-trust/extracted/README:root CA certificates.
/etc/pki/ca-trust/extracted/java/README:root CA certificates.
...
```
-如果不加r ，先把etc目錄下的root 過濾出來放到 tmp目錄下的 grep.log 下， 再去grep.log 下找帶passwd的
```
[[email protected] grep]# grep ‘root‘ /etc/
grep: /etc/: 是一個目錄
[[email protected] grep]# grep ‘root‘ /etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]#

[[email protected] grep]# grep -r ‘root‘ /etc/ > /tmp/grep.log
[[email protected] grep]# grep passwd /tmp/grep.log
/etc/passwd:root:x:0:0:root:/root:/bin/bash
/etc/passwd:operator:x:11:0:operator:/root:/sbin/nologin
/etc/passwd-:root:x:0:0:root:/root:/bin/bash
/etc/passwd-:operator:x:11:0:operator:/root:/sbin/nologin
/etc/postfix/main.cf:# the system passwd file in the chroot jail is just not practical.
[[email protected] grep]# 
```
-  -A後面跟數字，表示 過濾出符合要求的行以及下面n行

-  下面過濾出passwd文件裏的 帶有root的行，以及下面的2行
```
[[email protected] grep]# grep -nA2 ‘root‘ passwd
1:root:x:0:0:root:/root:/bin/bash
2-bin:x:1:1:bin:/bin:/sbin/nologin
3-daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
--
10:operator:x:11:0:operator:/root:/sbin/nologin
11-games:x:12:100:games:/usr/games:/sbin/nologin
12-ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
[[email protected] grep]# 

```

-   -B後面跟數字，表示 過濾出符合要求的行以及上面n行
-   下面過濾出paswd文件裏的 帶有root的行 ，以及上面的 3行
```
[[email protected] grep]# grep -nB3 ‘root‘ passwd
1:root:x:0:0:root:/root:/bin/bash
--
7-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8-halt:x:7:0:halt:/sbin:/sbin/halt
9-mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10:operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]# 

```

-  -C後面跟數字，表示 過濾出符合要求的行 以及上下n行
-  下面過濾出passwd 文件裏的 帶有root的行 ，以及上下2行
```
[[email protected] grep]# grep -nC2 ‘root‘ passwd
1:root:x:0:0:root:/root:/bin/bash
2-bin:x:1:1:bin:/bin:/sbin/nologin
3-daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
--
8-halt:x:7:0:halt:/sbin:/sbin/halt
9-mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10:operator:x:11:0:operator:/root:/sbin/nologin
11-games:x:12:100:games:/usr/games:/sbin/nologin
12-ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
[[email protected] grep]# 

```



# 9.2 grep 中

![mark](http://oqxf7c508.bkt.clouddn.com/blog/20170822/230138784.png?imageslim)
- grep ‘[0-9]‘ passwd   過濾出帶有數字0-9的

```
[[email protected] grep]# grep ‘[0-9]‘ passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
aming:x:1000:1005::/home/aming:/bin/bash
user1:x:1001:1001::/home/user1:/bin/bash
user2:x:1002:1002::/home/user2:/bin/bash
user3:x:1004:1005::/home/user3:/bin/bash
user4:x:1006:1005::/home/aming111:/sbin/nologin
user5:x:1007:1007::/home/user5:/bin/bash
user6:x:1008:1010::/home/user6:/bin/bash
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```
- grep -vn ‘[0-9]‘ /etc/inittba  只要帶數字的行都不要
```
[[email protected] grep]# grep -vn ‘[0-9]‘ /etc/inittab
1:# inittab is no longer used when using systemd.
2:#
3:# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
4:#
5:# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
6:#
7:# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
8:#
11:#
12:# To view current default target, run:
13:# systemctl get-default
14:#
15:# To set a default target, run:
16:# systemctl set-default TARGET.target
17:#
[[email protected] grep]# 

```
- [ ]vim  看下是 9行有個3 ，   10行有個5
```
  1 # inittab is no longer used when using systemd.
  2 #
  3 # ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
  4 #
  5 # Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
  6 #
  7 # systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
  8 #
  9 # multi-user.target: analogous to runlevel 3
 10 # graphical.target: analogous to runlevel 5
 11 #
 12 # To view current default target, run:
 13 # systemctl get-default
 14 #
 15 # To set a default target, run:
 16 # systemctl set-default TARGET.target
 17 #
~                                                                                                    
~                                                                                                    
~                                                                                                    
:set nu            
```
- grep -n ‘^#‘ inittab  過濾以#開頭的行
```
[[email protected] grep]# grep -n ‘^#‘ /etc/inittab
1:# inittab is no longer used when using systemd.
2:#
3:# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
4:#
5:# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
6:#
7:# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
8:#
9:# multi-user.target: analogous to runlevel 3
10:# graphical.target: analogous to runlevel 5
11:#
12:# To view current default target, run:
13:# systemctl get-default
14:#
15:# To set a default target, run:
16:# systemctl set-default TARGET.target
17:#

```
- 先拷貝一下這個/etc/inittab 文件到當前目錄下來，不能直接修改文件/etc/inittab 系統配置文件，改錯了，會會容易導致系統啟動不了，出問題

```
[[email protected] grep]# cp /etc/inittab  ./
[[email protected] grep]# vim inittab

  1 # inittab is no longer used when using systemd.
  2 #
  3 # ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
  4 #
  5 # Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
  6 #
  7 # systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
  8 #
  9 # multi-user.target: analogous to runlevel 3
 10 # graphical.target: analogous to runlevel 5
 11 ldldldldl
 12 #
 13 # To view current default target, run:
 14 # systemctl get-default
 15 #
 16 # To set a default target, run:
 17 # systemctl set-default TARGET.target
 18 #
~                                                                                                    
:set nu  
```
- 在11行 隨便加了點東西,再來grep -n ‘^#‘ inittab, 找出以#開頭的行找出來，發現第11行 沒有了 
```
[[email protected] grep]# grep -n ‘^#‘ inittab
1:# inittab is no longer used when using systemd.
2:#
3:# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
4:#
5:# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
6:#
7:# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
8:#
9:# multi-user.target: analogous to runlevel 3
10:# graphical.target: analogous to runlevel 5
12:#
13:# To view current default target, run:
14:# systemctl get-default
15:#
16:# To set a default target, run:
17:# systemctl set-default TARGET.target
18:#
[[email protected] grep]# 
```
- grep -nv ‘^#‘ inittab 把不以#開頭的 行找出來
```
[[email protected] grep]# grep -nv ‘^#‘ inittab
11:ldldldldl
[[email protected] grep]# 
```
- 再進入vim inittab 裏面修改下文件
```
[[email protected] grep]# vim inittab

# inittab is no longer used when using systemd.
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
#
# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
&*&*&*&*
# multi-user.target: analogous to runlevel 3
aaaaaaaaaaaaa
# graphical.target: analogous to runlevel 5
ldldldldl
#
# To view current default target, run:
# systemctl get-default
11111111111
# To set a default target, run:
# systemctl set-default TARGET.target
#
:wq  

[[email protected] grep]# vim inittab
[[email protected] grep]# pwd
/root/grep
[[email protected] grep]# 

```
-再過濾下
```
[[email protected] grep]# grep -v ‘^#‘ inittab
&*&*&*&*
aaaaaaaaaaaaa
ldldldldl
11111111111
[[email protected] grep]# 
```
- grep ‘[^0-9]‘ inittab 表示 過濾出 非數字的帶有一個字符的 地方，在[^0-9]表示 選 非0-9
```
[[email protected] grep]# grep ‘[^0-9]‘ inittab
# inittab is no longer used when using systemd.
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
#
# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
&*&*&*&*
# multi-user.target: analogous to runlevel 3
aaaaaaaaaaaaa
# graphical.target: analogous to runlevel 5
ldldldldl
#
# To view current default target, run:
# systemctl get-default
# To set a default target, run:
# systemctl set-default TARGET.target
#
[[email protected] grep]# 
``` 
-再編輯下 inittab文件
```
[[email protected] grep]# vim inittab

# inittab is no longer used when using systemd.
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
111111111aaa23333333
#
# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
&*&*&*&*
# multi-user.target: analogous to runlevel 3
aaaaaaaaaaaaa
# graphical.target: analogous to runlevel 5
ldldldldl
#
# To view current default target, run:
# systemctl get-default
11111111111
# To set a default target, run:
# systemctl set-default TARGET.target
```
- 以 非數字的一個字符 grep ‘[^0-9]‘ inittab
```
[[email protected] grep]# grep ‘[^0-9]‘ inittab
# inittab is no longer used when using systemd.
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
111111111aaa23333333
#
# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
&*&*&*&*
# multi-user.target: analogous to runlevel 3
aaaaaaaaaaaaa
# graphical.target: analogous to runlevel 5
ldldldldl
#
# To view current default target, run:
# systemctl get-default
# To set a default target, run:
# systemctl set-default TARGET.target
#
[[email protected] grep]# 
```
- 符合非數字的行開頭的行 grep ‘^[^0-9]‘ inittab
```
[[email protected] grep]# grep ‘^[^0-9]‘ inittab
# inittab is no longer used when using systemd.
# ADDING CONFIGURATION HERE WILL HAVE NO EFFECT ON YOUR SYSTEM.
#
# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
#
# systemd uses ‘targets‘ instead of runlevels. By default, there are two main targets:
&*&*&*&*
# multi-user.target: analogous to runlevel 3
aaaaaaaaaaaaa
# graphical.target: analogous to runlevel 5
ldldldldl
#
# To view current default target, run:
# systemctl get-default
# To set a default target, run:
# systemctl set-default TARGET.target
#
```
-符合數字開頭的  grep -vn ‘^[^0-9]‘ inittab
```
[[email protected] grep]# grep -vn ‘^[^0-9]‘ inittab
3:111111111aaa23333333
16:11111111111
[[email protected] grep]# 
```



# 9.3 grep 下

- grep ‘r.o‘ passwd    .代表任意一個字符
```
[[email protected] grep]# grep ‘r.o‘ passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]# 
```
1. 隨便在passwd文件裏 編輯一些
```
[[email protected] grep]# vim passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
dskdklldkdddkdkrao:222
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
222222:r>o:ldkdkdkd
```
2. 再看下
```
[[email protected] grep]# grep ‘r.o‘ passwd
root:x:0:0:root:/root:/bin/bash
dskdklldkdddkdkrao:222
222222:r>o:ldkdkdkd
operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]# 
```
4.  .也可以匹配到
```
[[email protected] grep]# vim passwd
222222:r.o:ldkdkdkd

[[email protected] grep]# grep ‘r.o‘ passwd
root:x:0:0:root:/root:/bin/bash
dskdklldkdddkdkrao:222
222222:r.o:ldkdkdkd
operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]# 
```

- grep ‘o*o‘ passwd     *表示 *左邊的字符重復0-n次  n表示隨意的數字
```
[[email protected] grep]# grep ‘o*o‘ passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
dskdklldkdddkdkrao:222
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
222222:r.o:ldkdkdkd
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
aming:x:1000:1005::/home/aming:/bin/bash
user1:x:1001:1001::/home/user1:/bin/bash
user2:x:1002:1002::/home/user2:/bin/bash
user3:x:1004:1005::/home/user3:/bin/bash
user4:x:1006:1005::/home/aming111:/sbin/nologin
user5:x:1007:1007::/home/user5:/bin/bash
user6:x:1008:1010::/home/user6:/bin/bash
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```
- 改下文件passwd  增加3個o, 4個o
```
[[email protected] grep]# vim passwd

user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash

[[email protected] grep]# grep ‘o*o‘ passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
dskdklldkdddkdkrao:222
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
222222:r.o:ldkdkdkd
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
aming:x:1000:1005::/home/aming:/bin/bash
user1:x:1001:1001::/home/user1:/bin/bash
user2:x:1002:1002::/home/user2:/bin/bash
user3:x:1004:1005::/home/user3:/bin/bash
user4:x:1006:1005::/home/aming111:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```

- .* 表示任意個任意字符 所有的都匹配
```
[[email protected] grep]# grep ‘.*‘ passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
dskdklldkdddkdkrao:222
daemon:x:2:2:daemon:/sbin:/sbin/NOLOGIN
222222:r.o:ldkdkdkd
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
aming:x:1000:1005::/home/aming:/bin/bash
user1:x:1001:1001::/home/user1:/bin/bash
user2:x:1002:1002::/home/user2:/bin/bash
user3:x:1004:1005::/home/user3:/bin/bash
user4:x:1006:1005::/home/aming111:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin


[[email protected] grep]# grep ‘aming.*bash‘ passwd
aming:x:1000:1005::/home/aming:/bin/bash
[[email protected] grep]# 
```
-  grep ‘o\{2\}‘ passwd    表示匹配o出現倆次的字符  o{2}表示前面字符o的重復範圍位 o重復2次
```
[[email protected] grep]# grep ‘o{2}‘ passwd
[[email protected] grep]# grep ‘o\{2\}‘ passwd
root:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash
[[email protected] grep]# 
```
- 如果覺得過 o\{2\} 太麻煩 可以使用 grep -E 或者 egrep     
```
[[email protected] grep]# grep -E  ‘o{2}‘ passwd
root:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash


[[email protected] grep]# egrep ‘o{2}‘ passwd
root:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash
[[email protected] grep]# 
```
- grep -E  ‘(oo){2}‘ passwd  表示一個組合 出現2次 oo的 
```
[[email protected] grep]# grep -E  ‘(oo){2}‘ passwd
user5:x:1007:1007::/hoooome/user5:/bin/bash
[[email protected] grep]#
```
- egrep 不需要加 脫義  或者 grep -E
- egrep ‘o+o‘ passwd  +表示1次或者一次以上出現前面的字符 ，即+號前面出現一次o或者多次o
```
[[email protected] grep]# egrep ‘o+o‘ passwd
root:x:0:0:root:/root:/bin/bash
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
user5:x:1007:1007::/hoooome/user5:/bin/bash
user6:x:1008:1010::/hooome/user6:/bin/bash
[[email protected] grep]# 
```
- egrep ‘o+b‘ passwd 表示+前面可以出現o一次以上   egrep ‘o+t‘ passwd
```
[[email protected] grep]# egrep ‘o+b‘ passwd
nobody:x:99:99:Nobody:/:/sbin/nologin
[[email protected] grep]# 

[[email protected] grep]# egrep ‘o+t‘ passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[[email protected] grep]# 

```
- egrep ‘o?t‘ passwd  ?表示0次或者1次出現 前面的字符  這裏是0次或者1次出現o
```
[[email protected] grep]# egrep ‘o?t‘ passwd
root:x:0:0:root:/root:/bin/bash
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
operator:x:11:0:operator:/root:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```
- egrep ‘o?1o‘ passwd  這個表示   ?前面出現0次或者1次o
- 先編輯下文件vim passwd
```
[[email protected] grep]# vim passwd
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:1o1:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/no1ologin
[[email protected] grep]# vim passwd

[[email protected] grep]# egrep ‘o?1o‘ passwd
operator:x:1o1:0:operator:/root:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/no1ologin
[[email protected] grep]# egrep ‘o?1o‘ passwd
```


- grep -E ‘root|nologin‘ passwd   | 在這裏表示或者的意思
```
[[email protected] grep]# grep -E ‘root|nologin‘ passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:1o1:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
user4:x:1006:1005::/home/aming111:/sbin/nologin
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
[[email protected] grep]# 
```
- grep -Ei ‘root|bus|997‘ passwd   -E 因為後面有符號|  -i 是不區分大小寫
```
[[email protected] grep]# grep -Ei ‘root|bus|997‘ passwd
root:x:0:0:root:/root:/bin/bash
operator:x:1o1:0:operator:/root:/sbin/nologin
systemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
[[email protected] grep]# 
```

9.1 正則介紹_grep上 9.2 grep中 9.3 grep下