Use AWK to Prepare Configuration Changes Without Dropping Lines

AWK can generate a proposed configuration change, but it does not understand every application’s configuration grammar. The safest starting point is a copy, a narrowly defined rule, and a comparison that proves unrelated lines were preserved. Do not run a generic text substitution directly over production SSH, web-server, or database configuration.

Correction: Earlier examples on this page printed only matching lines and then replaced the original file. That could discard the rest of the configuration. Those instructions have been replaced with the checked example below.

Why a matching pattern can lose data

In AWK, /pattern/ { print } prints only matching records. It is a filter, not an edit that automatically passes all other records through. For an edit, a separate unconditional { print } can preserve the other lines. See the GNU AWK pattern documentation.

Also, never redirect output to the same file being read. The shell can truncate the output file before AWK opens the input. Generating a temporary file is only the first step; a failed command, an incorrect match, or an unchecked rename can still destroy data.

A deliberately narrow example

For practice, use this synthetic example.conf in a new test directory. It is a simple line-based format, not an Apache, SSH, PHP, or MySQL configuration:

# local demonstration
port = 8080
timeout = 30
support_url = https://support.example:8080/
memory = 512M

Put the following program in update-port.awk. It requires exactly one active lowercase port assignment with the expected old value. Missing keys, duplicate active keys, or an unexpected value produce a nonzero exit status.

/^[[:space:]]*port[[:space:]]*=/ {
    matches++
    if ($0 !~ /^[[:space:]]*port[[:space:]]*=[[:space:]]*8080[[:space:]]*(#.*)?$/) {
        unexpected = 1
    } else {
        sub(/8080/, "9090")
        changed++
    }
}
{ print }
END {
    if (matches != 1 || changed != 1 || unexpected) {
        exit 2
    }
}

Generate and inspect a candidate, leaving the original untouched:

if awk -f update-port.awk example.conf > candidate.conf; then
    diff -u example.conf candidate.conf
else
    printf '%s\n' 'No valid single replacement. Do not apply candidate.conf.' >&2
fi

For this input, the only intended difference is port = 8080 becoming port = 9090. The timeout, memory setting, comment, and URL containing 8080 must remain unchanged. Note that diff returns 1 when differences exist; that is not by itself a failed AWK transformation.

A failed run may leave a partial candidate file. Do not install it. The example deliberately contains no automatic replacement or service-restart command. A second run against a file already using 9090 is rejected because the expected starting value is no longer present.

Before changing a real service

1. Find the effective configuration file and its grammar. Includes, sections, duplicate directives, quoted strings, and conditional blocks may require a format-aware parser or the application’s own configuration tool.
2. Preserve a dated backup, permissions, owner, access-control entries, and security labels as applicable. Check whether the path is a symlink. Replacing a file may change these properties even when its text looks correct.
3. Generate a candidate separately and compare it with the original. Stop if the number of replacements or any unrelated difference is unexpected.
4. Run the service’s documented configuration validator against the intended configuration, accounting for include paths. A generic help command is not a universal configuration test.
5. Apply through a controlled maintenance procedure with a known rollback. For SSH changes, retain an existing session and console access, and test a second connection before closing the first.

Do not assume mv candidate.conf original.conf is automatically safe: validation can fail, the destination can change during review, and ownership or context may differ. Configuration management with reviewable changes is preferable for repeated production edits.

Verification scope

The replacement program was executed with BusyBox AWK in a disposable Alpine Linux container against six synthetic cases: the normal change, an indented assignment with a comment, a missing key, duplicate active keys, an unexpected old value, and an already-updated file. Both successful cases preserved unrelated lines exactly; all four invalid cases returned exit status 2. No production configuration was changed. This test does not make the program a parser for arbitrary application configuration formats.