Linux Commands & Shell Skills
sed: Editing Streams Without Opening an Editor
sed edits sideways: whole streams of text pass through it, come out transformed, and no editor opens. Its reputation comes from -i, which turns a one-line substitution into a batch operation across thousands of files, and from the disaster stories of admins who ran it without a backup suffix. The safe workflow never changes: run the substitution visible, confirm the output, then add -i with a suffix and keep the exit code.
Key points
- Preview before you commit: sed -n '10,20p' file shows a line range, and the same -n plus p combination prints only lines that match a regex or address.
- Substitute with flags that do what you mean: s/old/new/g for all matches, a number like 2g for just the second, and -E for extended regex without a page of backslash escapes.
- In-place edits get a suffix, no exceptions: sed -i.bak 's/http:/https:/g' app keeps a same-name backup next to every change; that suffix has rescued more deploys than any editor's undo history.
- Delimiters are free: s|/var/www|/srv/app|g (or s#...#g) avoids slash-escaping fights when your pattern is full of paths.
- -i is not atomic: a crash or a bad regex mid-batch once left half-rewritten files behind, so bulk jobs run against copies or git-tracked trees, never the only copy.
- GNU and BSD sed disagree on -i: BSD requires the suffix before the script (sed -i '' works on macOS, isn't a Linux syntax), which is one more reason portability scripts avoid -i entirely.
- Delete and isolate are honest verbs: 'd' removes matching lines (sed '/^#/d' strips comments), and -n with a range isolates a section; both read better than clever substitutions.
- Anything past single-line edits, literal multi-line blocks, or stateful joins belongs in awk or a real script; forcing sed to do programmer work is how unreadable one-liners are born.
Field note
My first sed -i without a .bak suffix hit a production nginx config right before the afternoon traffic peak. Since then every in-place edit carries a backup suffix, and I read the dry-run output before the -i even goes near the command.
Frequently asked questions
How do I edit only lines that match something else?
Address them: sed '/cache/s/true/false/' flips true to false only on cache lines, and ranges like '/<VirtualHost>/,/<\/VirtualHost>/s/Old/New/g' scope edits to blocks; the address goes first, the command second.
Why will sed not match the ends of lines in a Windows-edited file?
Those lines end with carriage-return characters that the '$' anchors do not expect; strip them with tr first or normalize on the way in, and multiline content still belongs in awk or Perl with -0777.
Is sed faster than awk for simple replacements?
Marginally and irrelevantly; both finish in milliseconds on config-sized files. Choose by readability, because a colleague has to unmangle your one-liner in six months.
Can I insert whole configuration blocks with sed?
Yes: 'a' appends after, 'i' inserts before, and 'c' replaces the line, but keep the inserted text simple and one-purpose; real blocks belong in a template file or a proper provisioning step.
How Kinetikatech helps with linux commands & shell skills
You shouldn't have to become an expert in linux commands & shell skills: The commands and scripting habits that decide whether an administrator operates a server or fights it: search, transform, transfer, and supervise text and processes with the tools that live in every base install. That's exactly what Linux Server Security and Server Management is for, setup, hardening, monitoring, and a human on call day and night.