What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.




Commands using awk from sorted by
Terminal - Commands using awk - 1,150 results
df -H | grep -vE '^Filesystem|tmpfs|cdrom|none' | awk '{ print $5 " " $1 }'
find . -name '*.jpg' | awk 'BEGIN{ a=0 }{ printf "mv %s name%01d.jpg\n", $0, a++ }' | bash
2013-02-07 06:12:37
User: doublescythe
Functions: awk find printf

This command will take the files in a directory, rename them, and then number them from 1...N.

Black belt stuff.

Hell of a time saver.

sudo dd if=/dev/sdc bs=4096 | pv -s `sudo mount /dev/sdc /media/sdc && du -sb /media/sdc/ |awk '{print $1}' && sudo umount /media/sdc`| sudo dd bs=4096 of=~/USB_BLACK_BACKUP.IMG
load=`uptime|awk -F',' '{print $3}'|awk '{print $3}'`; if [[ $(echo "if ($load > 1.0) 1 else 0" | bc) -eq 1 ]]; then notify-send "Load $load";fi
2013-02-06 08:30:24
User: adimania
Functions: awk echo

I run this via crontab every one minute on my machine occasionally to see if a process is eating up my system's resources.

for x in `ps -u 500 u | grep java | awk '{ print $2 }'`;do ls /proc/$x/fd|wc -l;done
dpkg-query -Wf '${Package}\n' | xargs dpkg --status | sed '/^Conffiles:/,/^Description:/!d;//d' | awk '{print $2 " " $1}' | md5sum -c 2>/dev/null | grep FAILED$ | cut -f1 -d':'
2013-01-31 16:52:38
User: hallmarc
Functions: awk cut grep md5sum sed xargs

This functionality seems to be missing from commands like dpkg. Ideally, I want to duplicate the behavior of rpm --verify, but it seems difficult to do this in one relatively short command pipeline.

xprop | awk '/PID/ {print $3}'
for i in `pfiles pid|grep S_IFREG|awk '{print $5}'|awk -F":" '{print $2}'`; do find / -inum $i |xargs ls -lah; done
2013-01-24 13:57:19
User: giorger
Functions: awk find grep ls xargs

Executing pfiles will return a list of all descriptors utilized by the process

We are interested in the S_IFREG entries since they are pointing usually to files

In the line, there is the inode number of the file which we use in order to find the filename.

The only bad thing is that in order not to search from / you have to suspect where could possibly be the file.

Improvements more than welcome.

lsof was not available in my case

find $folder -name "[1-9]*" -type f -print|while read file; do echo $file $(sed -e '/^$/Q;:a;$!N;s/\n //;ta;s/ /_/g;P;D' $file|awk '/^Received:/&&!r{r=$0}/^From:/&&!f{f=$0}r&&f{printf "%s%s",r,f;exit(0)}');done|sort -k 2|uniq -d -f 1
2013-01-21 22:50:51
User: lpb612
Functions: awk echo find read sed sort uniq

# find assumes email files start with a number 1-9

# sed joins the lines starting with " " to the previous line

# gawk print the received and from lines

# sort according to the second field (received+from)

# uniq print the duplicated filename

# a message is viewed as duplicate if it is received at the same time as another message, and from the same person.

The command was intended to be run under cron. If run in a terminal, mutt can be used:

mutt -e "push otD~=xq" -f $folder

expandurl() { curl -s "http://api.longurl.org/v2/expand?url=${1}&format=php" | awk -F '"' '{print $4}' }
2013-01-19 10:40:46
User: atoponce
Functions: awk
Tags: curl longurl

This relies on a public API from http://longurl.org. So, this has the weakness that if the service disappears, the function will break. However, it has the advantage that the shortened URL service will not be tracking your IP address and other metrics, but instead will track longurl.org. Thus, you can remain anonymous from the shortened URL services (although not anonymous from longurl.org). It does no sanity checking that you have provided an argument. If you do not provide one, "message" is displayed to STDOUT.

tshark -r *.eth -S -R "ajp13" -d tcp.port==9009,ajp13 -s 0 -l -V | awk '/Apache JServ/ {p=1} /^ *$/ {p=0;printf "\n"} (p){printf "%s\n", $0} /^(Frame|Internet Pro|Transmission Control)/ {print $0}'
2013-01-10 21:12:51
User: tsureshkumar
Functions: awk printf
Tags: tshark

if you have a capture file *.eth, and ajp protocol is in use on port 9009, you can paste the above command. You can change the fiile and port name

awk '{s+=$1}END{print s}' <file>
curl http://en.wikipedia.org/wiki/List_of_programming_languages | grep "<li>" | awk -F"title=" '{ print $2 }' | awk -F\" '{ print $2 }'
2013-01-09 21:40:11
User: sxiii
Functions: awk grep

Requirements: curl, grep, awk, internet connection with access to wikipedia

Loaded page: http://en.wikipedia.org/wiki/List_of_programming_languages

If you can make shorter version of this listgetter, you are welcome to paste it here :)

find . -name "*.pdf" -exec pdftk {} dump_data output \; | grep NumberOfPages | awk '{s+=$2} END {print s}'
aptitude purge $(dpkg -l|grep ^rc|awk '{ print $2 }')
ps -xaw -o state,ppid | grep Z | grep -v PID | awk '{ print $2 }' | xargs kill -9
2013-01-09 04:21:54
User: terrywang
Functions: awk grep kill ps xargs

Did some research and found the previous command wrong, we don't kill a zombie but its parent. Just made some modifcation to khashmeshab's command.

cat *mscache* | awk -F '"' '{print $4":"$2}'
2013-01-06 06:54:57
User: mubix
Functions: awk cat

Convert Metasploit?s MSCACHE output to Hashcat version (performed in ~/.msf4/loot/):

finger `whoami` | awk -F: '{ print $3 }' | head -n1 | sed 's/^ //'
history | awk '{if ($2 == "sudo") a[$3]++; else a[$2]++}END{for(i in a){print a[i] " " i}}' | sort -rn | head
2012-12-31 13:45:03
User: JamieKitson
Functions: awk sort

List of commands you use most often suppressing sudo

history | awk '{if ($2 == "sudo") a[$3]++; else a[$2]++}END{for(i in a){print a[i] " " i}}' | sort -rn | head
cp -p `ls -l | awk '/Apr 14/ {print $NF}'` /usr/users/backup_dir
curl http://en.m.wikipedia.org/wiki/List_of_Internet_top-level_domains | grep "<tr valign=\"top\">" | awk -F">" '{ print $5 }' | awk -F"<" '{ print $1 }'
2012-12-24 21:00:36
User: sxiii
Functions: awk grep

Oneliner to get domain names list of all existing domain names (from wikipedia)

while sleep 1; do (mpc status;mpc currentsong)|awk 'BEGIN{FS=": "}/^Artist:/{r=r""$2};/^Title:/{r=r" - "$2};/^time:/{r=$2" "r};/^state: play/{f=1}END{if(f==1){print r}}'|echo -ne "\e[s\e[0;0H\e[K\e[0;44m\e[1;33m$(cat -)\e[0m\e[u";done &
2012-12-24 18:03:29
User: ichbins
Functions: awk echo sleep
Tags: bash mpd,

Actually this is a shorter version that fits the 255 chars limit of this resource. The full version shows status in the right top corner:

alias mpdd='while sleep 1; do _r=$(awk '\''BEGIN{FS=": "}/^Artist:/{r=r""$2};/^Title:/{r=r" - "$2};/^time:/{r=$2" "r};/^state: play/{f=1}END{if(f==1){print r}}'\'' <(mpc status;mpc currentsong));_l=${#_r};[ $_l -eq 0 ] && continue;[ -z "$_p" ] && _p=$_l;echo -ne "\e[s\e[0;${_p}H\e[K\e[u";_p=$((COLUMNS - _l));echo -ne "\e[s\e[0;${_p}H\e[K\e[0;44m\e[1;33m${_r}\e[0m\e[u";done &'

mpc is defined like this:

function mpc() {

echo "$*" | nc 6600


/sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'
while true; do date; ps auxf | awk '{if($8=="D") print $0;}'; sleep 1; done