#awk

20 one-liners with this tag.

Analyze server errors (5xx) in the access log

#awk '$9 ~ /^5[0-9][0-9]$/ {print $9, $7}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Calculate the average, minimum and maximum of a column

$awk -v c=2 'NR == 1 {min = max = $c} {s += $c; if ($c < min) min = $c; if ($c > max) max = $c} END {if (NR) printf "n=%d avg=%.2f min=%s max=%s\n", NR, s/NR, min, max}' measurements.txt

harmlessText processing

Calculate the total size of all files of one type

$find /var/www/vhosts/example.com/httpdocs/wp-content/uploads -type f -iname '*.mp4' -printf '%s\n' | awk '{s+=$1; n++} END {printf "%d Dateien, %.1f MB\n", n, s/1048576}'

harmlessFilesystem

Count HTTP status codes in the access log

#awk '{print $9}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn

Count requests per minute in the access log

#awk '{print substr($4, 2, 17)}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Delete all mail from one sender in the Postfix queue

#postqueue -p | awk -v s="info@example.com" '/^[0-9A-Za-z]/ && $7 == s {print $1}' | tr -d '*!' | postsuper -d -

destructiveMail

Filter CSV rows by the value in a column

$awk -F';' -v c=3 -v w='active' 'NR == 1 || $c == w' export.csv

harmlessText processing

Filter the access log by time range

#awk -v von="09/Oct/2026:14:00" -v bis="09/Oct/2026:15:00" 'substr($4, 2) >= von && substr($4, 2) < bis' /var/www/vhosts/system/example.com/logs/access_ssl_log

Find accounts with UID 0 and root privileges

$awk -F: '$3 == 0 {print $1}' /etc/passwd

harmlessSecurity

Find the most common user agents and bots in the access log

#awk -F'"' '{print $6}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Find the most frequent 404 errors in the access log

#awk '$9 == 404 {print $7}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Find the most requested URLs in the access log

#awk '{print $7}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Find the top IP addresses in the access log

#awk '{print $1}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20

Find the top senders in the Postfix queue

$postqueue -p | awk '/^[0-9A-Za-z]/ {print $7}' | sort | uniq -c | sort -rn | head -20

List user accounts with a login shell

$awk -F: '$7 !~ /(nologin|false)$/ {print $1, $3, $6, $7}' /etc/passwd

harmlessSecurity

Print lines where a column value exceeds a threshold

$awk -v c=10 -v min=5000000 '$c + 0 > min + 0' /var/www/vhosts/system/example.com/logs/access_ssl_log

harmlessText processing

Remove duplicate lines without changing the order

$awk '!seen[$0]++' list.txt

harmlessText processing

Show all requests from one IP address in the access log

#awk -v ip="203.0.113.10" '$1 == ip' /var/www/vhosts/system/example.com/logs/access_ssl_log | tail -50

Sum the numbers in a column with awk

$awk -v c=10 '{s += $c} END {print s}' /var/www/vhosts/system/example.com/logs/access_ssl_log

harmlessText processing

Sum up RAM usage per program

$ps -eo rss=,comm= | awk '{a[$2]+=$1} END {for (p in a) printf "%8.1f MB %s\n", a[p]/1024, p}' | sort -rn | head -15

harmlessProcesses