Chapter 5: Package Management & Text Processing

1. Introduction

This chapter covers two skills you use constantly as an admin: installing software through package managers, and filtering logs or config files with text tools. Most of the chapter focuses on packages; the final section covers the grep/sed/awk/cut patterns you will reuse in later chapters.

2. What Is a Linux Package?

A package is a managed software unit distributed as a single file. It bundles four things: the payload (the application's executables, libraries, configuration files, and documentation), metadata (name, version, architecture, and license), a declared list of dependencies (other packages it needs to run), and scripts that the package manager runs before or after installation to complete setup. Because all of this is tracked, the system knows exactly what was installed and can update or remove it cleanly.

Package ──► Payload (executables, libraries, config, docs) + Metadata + Dependencies + Install Scripts
              

Examples include vim, git, curl, nginx and OpenSSH.

3. Why Package Managers Exist

• Install software consistently.
• Resolve dependency packages automatically.
• Apply updates and security fixes.
• Verify package integrity.
• Remove software cleanly.

4. Common Package Formats

5. Package Managers by Distribution

6. Understanding Repositories

A repository is a trusted software source containing packages and metadata. These can include official channels, third-party extensions, localized offline networks, or enterprise baseline mirror servers.

7. Useful Information Commands

cat /etc/os-release # Display distribution information
hostnamectl # Show system details
uname -r # Display kernel version
command -v dnf # Check whether dnf is present (empty output means it is not)
command -v apt # Check whether apt is present

Use command -v to test for a single command rather than which with several arguments: it is a shell built-in, works consistently across distributions, and returns a clear exit status you can use in scripts.

8. Hands-on Practice (Package Query)

1. Identify your Linux distribution and kernel version.
2. Determine whether your system uses RPM or APT binaries.
3. Confirm which package manager is present using command -v dnf and command -v apt.

9. Installing & Querying RPM Packages Directly

rpm -ivh package.rpm # Install a local RPM package
rpm -qa # List all installed packages...
rpm -qi openssh # Display complete package information
rpm -ql openssh # List all files installed by this package
rpm -qf /usr/bin/ssh # Identify which package owns a specific file path
rpm -V openssh # Verify installed files against the metadata stored in the local RPM database

rpm -V compares each installed file (size, permissions, checksum, ownership, and timestamps) with the values recorded in the local RPM database when the package was installed. It does not contact any repository. Non-empty output means at least one file differs from the recorded metadata (changed, missing, or other verify flags).

10. Automated Dependency Management (dnf, apt)

While low-level tools like rpm and dpkg track single packages, higher-level tools like dnf and apt read full repositories to resolve dependency chains and download everything a package needs automatically.

sudo dnf install nginx # RHEL / Rocky package setup
sudo apt update && sudo apt install nginx # Debian / Ubuntu workflow
sudo dnf clean all # Flush package metadata cache for troubleshooting

11. Text Processing Toolkit

Filtering logs and reshaping config files is daily admin work. Each tool below reads from a file or from standard input and writes to standard output, so they connect with pipes (|) into short, powerful pipelines. The examples use ordinary log and config files you already have on any system.

grep — filter lines by pattern

grep error /var/log/syslog          # print lines containing "error" (Debian/Ubuntu path)
grep -i error /var/log/syslog       # case-insensitive match
grep -n denied /var/log/secure      # show matching line numbers
grep -c 404 access.log              # count matching lines, don't print them
grep -v healthcheck access.log      # invert: hide health-check noise
grep -r TODO /etc/nginx/            # search recursively through a directory
grep -E "warn|error|fatal" app.log  # extended regex with alternation
# RHEL/Rocky/AlmaLinux often use /var/log/messages instead of /var/log/syslog

sed — edit a stream non-interactively

sed 's/error/ERROR/' app.log        # replace the first match on each line
sed 's/error/ERROR/g' app.log       # replace every match on each line
sed -n '10,20p' app.log             # print only lines 10 through 20
sed '/^#/d' /etc/ssh/sshd_config    # delete comment lines from the output
sed -i.bak 's/8080/9090/g' app.conf # edit the file in place, keeping app.conf.bak

awk — process fields and build reports

awk -F: '{print $1,$3}' /etc/passwd        # username and UID (fields split on ":")
awk -F: '$3 >= 1000 {print $1}' /etc/passwd # UIDs at/above typical UID_MIN (not a perfect humans-only filter; may include nobody/nfsnobody)
awk '{print $1}' access.log                 # first whitespace-separated field
awk '{sum += $5} END {print sum}' access.log # total the 5th column (e.g., bytes sent)

By default awk splits each line on whitespace and numbers the fields $1, $2, and so on; $0 is the whole line. Use -F to choose a different delimiter, such as -F: for /etc/passwd.

cut — extract fixed columns

cut -d: -f1 /etc/passwd    # first colon-delimited field (usernames)
cut -d: -f1,7 /etc/passwd  # fields 1 and 7 (username and login shell)
cut -c1-8 /var/log/syslog  # the first 8 characters of each line

cut is simpler than awk when you only need to slice fixed fields or character ranges.

sort, uniq, and wc — order, deduplicate, and count

sort names.txt        # sort lines alphabetically
sort -u names.txt     # sort and remove duplicate lines
sort -rn sizes.txt    # reverse numeric sort (largest first)
uniq -c file.txt      # collapse adjacent duplicate lines and count them
wc -l access.log      # count lines
wc -w report.txt      # count words

tr — translate or delete characters

tr 'a-z' 'A-Z' < file.txt        # convert lowercase to uppercase
tr -d '\r' < dos.txt > unix.txt  # strip Windows carriage returns
tr -s ' ' < spaced.txt          # squeeze repeated spaces into one

tr only reads from standard input, so feed it with < or a pipe rather than a filename argument.

xargs — turn output into command arguments

grep -rl deprecated src/ | xargs wc -l          # count lines in every matching file
find . -name '*.tmp' -print0 | xargs -0 -r rm  # safer for spaces; GNU -r skips if empty
# Or: find . -name '*.tmp' -delete
find . -name '*.tmp' | xargs -r rm             # GNU xargs only; breaks on spaces in names — prefer -print0/-0 above
find . -name '*.log' -print0 | xargs -0 rm     # -print0 with -0 handles spaces safely

Use -print0 with xargs -0 whenever file names might contain spaces, and -r so xargs does nothing when its input is empty.

Building pipelines

The real power comes from chaining these tools together. Each stage transforms the previous stage's output:

# Top 10 client IP addresses in a web access log
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -n 10

# Count how many accounts use each login shell
cut -d: -f7 /etc/passwd | sort | uniq -c

Mini Lab: Log Triage

Practice combining the tools on a real log. Adjust the path to a log you can read (for example /var/log/syslog on Debian/Ubuntu or /var/log/messages on RHEL family):

1. Count how many lines contain the word error, case-insensitive: grep -ic error /var/log/syslog
2. List the 10 most frequent error messages, ignoring the timestamp at the start of each line: grep -i error /var/log/syslog | cut -d' ' -f5- | sort | uniq -c | sort -rn | head -n 10
3. Extract just the process names writing to the log and count them: awk '{print $5}' /var/log/syslog | sort | uniq -c | sort -rn
4. Save a cleaned copy with health-check noise removed: grep -v healthcheck /var/log/syslog > /tmp/triage.log
5. Confirm how much you filtered out by comparing line counts with wc -l on both files.

Commands Covered in This Chapter

• dnf / apt / rpm — install, query, and update packages
• grep — search text by pattern
• sed — edit text streams
• awk — process fields and reports
• cut — extract fields from delimited text
• sort / uniq — sort lines and drop duplicates
• wc — count lines, words, and bytes
• tr — translate or delete characters
• xargs — build commands from stdin