CoursesAdvanced Linux internals & toolingAdvanced tooling & observability

Power editing & text processing

vim/vi mastery, and advanced sed & awk.

Advanced16 min · lesson 17 of 17

The essentials course taught you to survive vim and to run grep/sed/awk. Mastering them is a genuine force-multiplier: on a server you edit config in vim (or vi, its ubiquitous ancestor) and reshape data with sed and awk hundreds of times, and the fluent user is several times faster than the one who fights the tools. This lesson is the power-user layer — the vim vocabulary and the sed/awk idioms that turn tedious edits into a keystroke or a one-liner.

vim: think in verbs and motions

vim’s power is that commands compose as verb + motion — you do not memorize thousands of commands, you combine a handful of operators (d delete, c change, y yank/copy) with motions (w a word, $ end of line, } a paragraph) and text objects (iw "inner word", i" "inside quotes", ip "a paragraph"). So dw deletes a word, ci" changes the text inside quotes, dap deletes a paragraph. Learn the grammar and you construct the exact edit you need instead of recalling a specific command. A count multiplies it: 3dd deletes three lines.

vim
# operator + motion/text-object = a precise edit
# dw delete to next word ciw change the whole word under cursor
# d$ delete to end of line ci" change text INSIDE the quotes
# dap delete a paragraph yi( yank text inside the parentheses
# 3dd delete 3 lines >ip indent this paragraph
# . repeat the last change u / Ctrl-R undo / redo

vim: move and edit at speed

Fast navigation is the other half. Jump by word (w/b), to a character on the line (f<char>), to a line number (:42 or 42G), to matching brackets (%), and search with / then n/N. Editing accelerators: A appends at end of line, o opens a new line below, ci( changes inside parentheses, and the dot command . repeats your last change — combined with a search, it is how you make the same edit at many places quickly. Visual mode (v, V for lines, Ctrl-V for a block/column) selects then operates, which is how you edit a column across many lines at once.

vim
# navigation # global edits
# /error<Enter> n N :%s/old/new/g replace everywhere
# :42 go to line 42 :%s/old/new/gc ...with confirm each
# % matching ()/{} :g/DEBUG/d delete every line matching DEBUG
# Ctrl-V block/column :10,20s/^/# / comment out lines 10–20
# selection, then I to insert on every selected line, Esc to apply

sed: beyond simple substitution

sed does far more than s/old/new/. Address ranges limit an edit to specific lines or a pattern range; d deletes matching lines; p with -n prints only selected lines; and you can chain commands with -e or a script. Backreferences (\1) capture and reuse parts of a match, which is how you reorder or reformat fields. These idioms turn sed into a precise, scriptable stream transformer for logs and configs.

terminal
$ sed -n '/START/,/END/p' app.log # print only the block between START and END
$ sed '/^#/d; /^$/d' config.conf # delete comment lines AND blank lines
$ sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/' dates.txt # reorder Y-M-D to D/M/Y
$ sed 's/error/ERROR/gI' app.log # case-insensitive global replace (GNU sed)

awk: a real language for columns

awk is a small programming language built for column-structured text: it runs your program against every line, with fields as $1, $2, ... and variables you can accumulate. Beyond printing fields, it filters with conditions, computes sums and averages, groups with associative arrays, and has BEGIN/END blocks for setup and final output. A single awk invocation often replaces a whole script — summing a column, counting occurrences per key, or reformatting a report.

terminal
# sum the bytes (field 10) sent per IP (field 1) — a report in one line
$ awk '{bytes[$1] += $10} END {for (ip in bytes) print bytes[ip], ip}' access.log | sort -rn | head
45329281 10.0.2.1
812004 10.0.1.9
# average response time (field 6), and count of 500s
$ awk '{sum+=$6; n++} $9=="500"{errs++} END {printf "avg=%.1f 500s=%d\n", sum/n, errs}' access.log
avg=42.7 500s=37
$ awk -F: '$3>=1000 {print $1}' /etc/passwd # -F sets the field separator (: here)
Learn vimtutor and keep sed/awk one-liners scriptable
The fastest way to internalize vim is the built-in vimtutor — 30 minutes that pays back for a career; run it once and practice the verb+motion grammar rather than memorizing commands. For sed and awk, keep two habits: test a transformation by printing to screen before using sed -i on a real file (no undo), and when a one-liner grows past a couple of operations, move it into a small script file where it can be read, reviewed, and reused. These tools are powerful precisely because they act exactly as told — so verify the pattern before you commit it to a file or a pipeline that matters.