Linux · text processing

wc

count lines and words

wc — word count — prints three numbers: lines, words and bytes. It is used most with -l at the end of a pipe, to answer "how many?" about anything that prints one item per line.

Anything that lists one per line can be counted: command | wc -l.

Counts

Lines, words, bytes

in that order

Lines only

-l

the one used most

In a pipe

Counts output

no file name needed

Characters

-m

differs from bytes in UTF-8

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ wc app.log

1 312 2840 21744 app.log

2$ wc -l app.log

312 app.log

$ grep -c "" /etc/passwd; cat /etc/passwd | wc -l

334

4$ ls /usr/bin | wc -l

1487

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Three numbers and a name

312 lines, 2840 words, 21744 bytes.

-l prints only the line count

The file name follows. Read from a pipe instead, and the name is left off.

One line per account

/etc/passwd has a line for each user, so its line count is the number of accounts on the machine.

Counting another command’s output

ls prints one name per line when piped, so wc -l gives the number of commands installed.

Switches

A switch changes how the command behaves. These are the ones used day to day; man wc lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-l: Count lines only.
-w: Count words only.
-c: Count bytes only.
-m: Count characters, which differs from bytes for non-ASCII text.
-L: Print the length of the longest line.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

wc -l *.py

Counts lines in each file and prints a total.

grep -r "TODO" src/ | wc -l

Counts how many lines match across a tree.

wc -c < file.bin

Prints only the size in bytes, with no file name.

ps -e --no-headers | wc -l

Counts the processes running.

In cybersecurity

A count is the cheapest way to notice that something has changed.

Baselines

The number of accounts, listening ports or scheduled jobs should not change by itself. Counting them regularly makes an addition stand out.

Measuring an attack

Counting failed-login lines in the auth log turns "there seem to be a lot" into a number that can be compared day to day.

A count hides the detail

Thirty-four accounts yesterday and thirty-four today does not mean the same thirty-four. Compare the lists with diff when it matters.

Filed under

Text processing

Read alongside

grepSearches files for lines that match a pattern, and prints the lines it finds.sortSorts lines of text — alphabetically, numerically, or by a chosen column.