Using awk Built‑in Variables and Netstat for System Information on Linux

Awk provides several built‑in variables that simplify text processing; OFS defines the output field separator, NR holds the current record (line) number, and NF contains the number of fields in the current record.

Examples include setting OFS="#" and printing selected fields when a condition is met, e.g., awk -F ':' '{OFS="#"} $3>"5" {print $1,$2,$3,$4}' to reformat a colon‑separated file.

To display the first five lines of a file with line numbers, use head -5 1.txt | awk -F ':' '{print NR":"$0}'. To show lines after the 20th line with numbers, run awk -F ':' 'NR>20 {print NR":"$0}' 1.txt.

Awk’s if statement can filter records based on field values, for instance

awk -F':' '{OFS="#"} {if($3>1000){print NR":"$0}}' /etc/passwd

prints entries whose third field exceeds 1000, and

awk -F':' '{OFS="#"} {if($3>1000){print NR":"$1,$2,$3}}' /etc/passwd

outputs selected columns.

Aggregating numeric fields is straightforward: awk -F ':' '{x+= $3} END {print x}' /etc/passwd sums the third column of the file, yielding a total such as 21761.

For network monitoring, the netstat command (or ss) reveals open ports and connection states. Common options include netstat -lnp (listening ports), netstat -an (all connections), and netstat -lntp (listening TCP sockets only). The ss -an command provides similar information.

Combining netstat with awk enables counting connections by state, e.g.,

netstat -an | awk '/^tcp/ {++sta[$NF]} END {for(key in sta) print key,"\t",sta[key]}'

, which reports the number of LISTEN, ESTABLISHED, TIME_WAIT, etc., sockets.