LFCS Phase 1 Part 29: Viewing File Contents - cat, less, more, head, tail

You can create, find, and manage files. Now it's time to look inside them. Viewing file contents is one of the most fundamental skills in Linux system administration. Whether you're checking configuration files, analyzing logs, or debugging issues, you'll use these commands constantly.

The LFCS exam expects you to be fluent with multiple viewing commands. Each has its strengths: cat for quick views, less for interactive browsing, head and tail for examining file ends, and tail -f for live log monitoring.

💡

🎯 What You'll Learn:

Understanding when to use each viewing command
cat for displaying entire files
less for interactive paging and searching
more for simple paging
head for viewing first N lines
tail for viewing last N lines
tail -f for live log monitoring
Combining commands with pipes
Real-world file viewing scenarios

Series: LFCS Certification - Phase 1 (Post 29 of 52)

Understanding File Viewing Commands

Linux offers multiple commands for viewing files, each optimized for different scenarios:

| Command | Best For | Interactive? | Memory Usage | |---------|----------|--------------|--------------| | cat | Small files, quick views | No | Loads entire file | | less | Large files, searching | Yes | Loads on demand | | more | Simple paging | Limited | Loads page by page | | head | First N lines | No | Minimal | | tail | Last N lines, logs | No (unless -f) | Minimal |

Quick Decision Guide:

Quick peek at config file → cat
Large log file → less
First 10 lines → head
Last 10 lines → tail
Monitor live logs → tail -f

The cat Command

The cat (concatenate) command displays entire file contents to your terminal.

Basic Usage

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin

What happened: The entire file scrolled to your terminal.

cat with Line Numbers (-n)

$ cat -n /etc/hosts
     1	127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
     2	::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Use case: Quickly see line numbers when troubleshooting errors that reference specific lines.

cat Showing Special Characters (-A)

$ cat -A /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4$
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6$

What the symbols mean:

$ = End of line
^I = Tab character
^M = Carriage return (Windows files)

Real Example with Tabs

$ cat myfile
hello		world

$ cat -A myfile
hello^I^Iworld^I^I$

Why this matters: Reveals hidden whitespace that can cause parsing errors in scripts or configuration files.

cat with Numbered Non-Blank Lines (-b)

$ cat -b /etc/hosts
     1	127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
     2	::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Difference from -n: Only numbers lines with content, skipping blank lines.

Common cat Options

| Option | Description | Example Use | |--------|-------------|-------------| | -n | Number all lines | Debugging code | | -b | Number non-blank lines | Analyzing structured files | | -A | Show all special characters | Finding hidden whitespace | | -s | Squeeze multiple blank lines into one | Cleaning up output | | -E | Show $ at end of lines | Checking line endings | | -T | Show tabs as ^I | Finding tab vs space issues |

The tac Command (Bonus)

tac is cat spelled backwards – it displays files in reverse (last line first).

$ cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

$ tac /etc/hosts
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

Use case: Viewing log files with newest entries first.

less is a pager – it displays one screen at a time and lets you navigate interactively.

Why less?

# This floods your terminal
$ cat /var/log/messages

# This lets you browse comfortably
$ less /var/log/messages

| Key | Action | |-----|--------| | Space or f | Forward one screen | | b | Backward one screen | | d | Forward half screen | | u | Backward half screen | | j or ↓ | Down one line | | k or ↑ | Up one line | | g | Go to beginning | | G | Go to end | | q | Quit |

Searching in less

$ less /var/log/messages
# Press / then type search term
/error
# Press n for next match
# Press N for previous match

Search features:

/pattern = Search forward
?pattern = Search backward
n = Next match
N = Previous match
/ then Enter = Repeat last search

less with Line Numbers

$ less -N /etc/passwd

Result: Shows line numbers in the left margin while browsing.

Following a File with less (+F)

$ less +F /var/log/messages
# Like tail -f, but you can stop with Ctrl+C and browse
# Press F to resume following

✅

💡 Pro Tip: less is almost always better than more for interactive viewing. It allows backward scrolling, searching, and uses less memory for large files.

more is an older, simpler pager. It's still useful but less powerful than less.

Basic Usage

$ more /var/log/messages
# Space to advance one screen
# Enter to advance one line
# q to quit

Limitations of more

❌ Cannot scroll backward (once you pass content, you can't go back) ❌ Cannot search backward ❌ Limited navigation options

✅ Advantage: Available on nearly every Unix system, even minimal installations

When to use more: On very old systems or minimal containers where less isn't available. Otherwise, prefer less.

The head Command

head displays the first N lines of a file (default: 10 lines).

Default Behavior

$ head /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin

Result: First 10 lines displayed.

Specifying Number of Lines

# First 3 lines
$ head -3 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin

# First 20 lines
$ head -20 /etc/passwd

# Alternative syntax (older)
$ head -n 3 /etc/passwd

head with Bytes

# First 100 bytes
$ head -c 100 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin:

Multiple Files

$ head -3 file1.txt file2.txt
==> file1.txt <==
Line 1 of file1
Line 2 of file1
Line 3 of file1

==> file2.txt <==
Line 1 of file2
Line 2 of file2
Line 3 of file2

Notice: Automatically adds headers showing which file each output is from.

The tail Command

tail displays the last N lines of a file (default: 10 lines).

Default Behavior

$ tail /etc/passwd
sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/usr/sbin/nologin
chrony:x:984:983:chrony system user:/var/lib/chrony:/sbin/nologin
dnsmasq:x:983:982:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/usr/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
centos9:x:1000:1000:centos9:/home/centos9:/bin/bash
stapunpriv:x:159:159:systemtap unprivileged user:/var/lib/stapunpriv:/sbin/nologin
pesign:x:982:981:Group for the pesign signing daemon:/run/pesign:/sbin/nologin
vboxadd:x:981:1::/var/run/vboxadd:/bin/false
labuser:x:1001:1001::/home/labuser:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin

Result: Last 10 lines displayed.

Specifying Number of Lines

# Last 5 lines
$ tail -5 /var/log/messages

# Last 100 lines
$ tail -100 /var/log/messages

# Alternative syntax
$ tail -n 5 /var/log/messages

Starting from Line N (+N)

# Everything from line 20 onwards
$ tail -n +20 /etc/passwd

# Everything from line 5 onwards
$ tail -n +5 file.txt

tail -f: Live Log Monitoring

The most important use of tail for system administrators: following logs in real-time.

Basic Following

$ sudo tail -f /var/log/messages
Nov  2 16:01:58 vm1 systemd[1]: Starting dnf makecache...
Nov  2 16:01:59 vm1 dnf[19557]: Metadata timer caching disabled when running on a battery.
Nov  2 16:01:59 vm1 systemd[1]: dnf-makecache.service: Deactivated successfully.
Nov  2 16:01:59 vm1 systemd[1]: Finished dnf makecache.
Nov  2 16:02:31 vm1 dockerd[1573]: time="2025-11-02T16:02:31.830619604+05:00" level=info msg="NetworkDB stats..."
# Waits here and shows new lines as they're added
# Press Ctrl+C to stop

What -f does:

Displays last 10 lines
Keeps file open
Shows new lines as they appear
Perfect for monitoring logs during troubleshooting

Following Multiple Files

$ tail -f /var/log/messages /var/log/secure
==> /var/log/messages <==
Nov  2 16:12:32 vm1 dockerd[1573]: NetworkDB stats...

==> /var/log/secure <==
Nov  2 16:13:01 vm1 sshd[12345]: Accepted publickey for centos9...
# Shows new lines from both files as they appear

Following with More Lines

# Show last 50 lines, then follow
$ tail -50f /var/log/messages

# Alternative syntax
$ tail -n 50 -f /var/log/messages

tail -F: Follow Even if File Recreated

$ tail -F /var/log/messages
# Continues following even if file is rotated/recreated

Difference between -f and -F:

-f = Follows the file descriptor (stops if file is rotated)
-F = Follows the filename (continues even after log rotation)

✅

💡 Pro Tip for LFCS: During the exam, if you make a configuration change and need to test it, open a second terminal with tail -f on the relevant log file. This lets you see issues immediately as they happen.

Combining Commands with Pipes

One of Linux's most powerful features: chaining commands together.

head + tail = Extract Middle Lines

# Get line 3 from a file
$ head -3 /etc/passwd | tail -1
daemon:x:2:2:daemon:/sbin:/sbin/nologin

How it works:

head -3 gets first 3 lines
tail -1 takes the last line of those 3 (which is line 3 overall)

Get Lines 10-20

$ head -20 /etc/passwd | tail -10
# Shows lines 11-20

cat + grep = Search Within File

$ cat /etc/passwd | grep centos
centos9:x:1000:1000:centos9:/home/centos9:/bin/bash

Note: While this works, grep centos /etc/passwd is more efficient (grep can read files directly).

tail + grep = Search Recent Logs

$ tail -100 /var/log/messages | grep error
Nov  2 15:23:45 vm1 systemd[1]: error mounting /data
Nov  2 15:24:12 vm1 kernel: error in filesystem driver

Real-World Use Cases

1. Check Configuration File Syntax

# Quick view to check format
$ cat /etc/ssh/sshd_config

# Check for hidden characters causing issues
$ cat -A /etc/ssh/sshd_config | grep "^PermitRoot"

2. View Large Log Files

# Don't do this (floods terminal)
$ cat /var/log/messages

# Do this instead
$ less /var/log/messages
# Or
$ tail -100 /var/log/messages

3. Monitor Application Logs

# Watch application logs in real-time
$ tail -f /var/log/httpd/error_log

# In another terminal, test your application
$ curl http://localhost/test

4. Extract Specific Log Time Range

# Get last 1000 lines, search for errors from 15:00 hour
$ tail -1000 /var/log/messages | grep "Nov  2 15:"

5. Compare First and Last Lines

# Check if log rotation happened
$ echo "First entry:"
$ head -1 /var/log/messages

$ echo "Last entry:"
$ tail -1 /var/log/messages

6. Check File for Windows Line Endings

$ cat -A textfile.txt | grep "\^M"
# If you see ^M, file has Windows line endings

Fix it:

$ dos2unix textfile.txt

7. View Compressed Logs

# View .gz log files
$ zcat /var/log/messages.1.gz | less
$ zcat /var/log/messages.1.gz | tail -50

8. Count Lines in File

# Using wc (word count)
$ wc -l /etc/passwd
43 /etc/passwd

# Or combine with cat
$ cat /etc/passwd | wc -l
43

Best Practices

✅ DO	❌ DON'T
Use `less` for large files	Use `cat` on multi-gigabyte logs
Use `tail -f` for live monitoring	Repeatedly run `tail` manually
Use `head`/`tail` for quick peeks	Load entire file when you only need a few lines
Use `cat -A` to debug whitespace issues	Assume spaces and tabs look the same
Use `grep` directly on files when possible	Always pipe `cat` to `grep`
Use `tail -F` for rotated logs	Use `tail -f` and lose tracking after rotation
Combine `head` and `tail` for line ranges	Manually count lines to find specific ranges
Check file size before using `cat`	Blindly `cat` unknown files

Common Pitfalls

1. Using cat on Binary Files

# DON'T
$ cat /bin/ls
# Terminal fills with garbage characters

# DO
$ file /bin/ls
/bin/ls: ELF 64-bit LSB executable...

Fix garbled terminal: Type reset and press Enter.

2. Following the Wrong Log File

# This stops following after log rotation
$ tail -f /var/log/messages

# This continues following even after rotation
$ tail -F /var/log/messages

3. Not Using Pipes Efficiently

# Inefficient (spawns unnecessary cat process)
$ cat /etc/passwd | grep root

# Better (grep reads file directly)
$ grep root /etc/passwd

4. Forgetting to Quit less

Symptom: You press Ctrl+C but you're still in less Solution: Press q to quit (not Ctrl+C)

5. Missing Recent Log Entries

# Only shows last 10 lines (might miss context)
$ tail /var/log/messages

# Better: Show more context
$ tail -50 /var/log/messages

🧪 Practice Labs

Lab 1: Basic cat Usage (Beginner)

Task: Display the contents of /etc/hostname.

Show Solution

$ cat /etc/hostname
vm1.example.com

Key concept: cat displays entire file contents.

Lab 2: cat with Line Numbers (Beginner)

Task: Display /etc/hosts with line numbers.

Show Solution

$ cat -n /etc/hosts
     1	127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
     2	::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Key concept: -n adds line numbers to output.

Lab 3: View Special Characters (Beginner)

Task: View /etc/hosts showing all special characters (tabs, line endings).

Show Solution

$ cat -A /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4$
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6$

Key concept: -A reveals hidden characters ($ = line end, ^I = tab).

Lab 4: Basic head Usage (Beginner)

Task: Display the first 5 lines of /etc/passwd.

Show Solution

$ head -5 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

Key concept: head -N shows first N lines.

Lab 5: Basic tail Usage (Beginner)

Task: Display the last 3 lines of /etc/passwd.

Show Solution

$ tail -3 /etc/passwd
vboxadd:x:981:1::/var/run/vboxadd:/bin/false
labuser:x:1001:1001::/home/labuser:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin

Key concept: tail -N shows last N lines.

Lab 6: Extract Specific Line (Intermediate)

Task: Extract exactly line 3 from /etc/passwd.

Show Solution

$ head -3 /etc/passwd | tail -1
daemon:x:2:2:daemon:/sbin:/sbin/nologin

Key concept: Pipe head -3 (first 3 lines) to tail -1 (last of those 3).

Lab 7: Extract Line Range (Intermediate)

Task: Extract lines 5-10 from /etc/passwd.

Show Solution

$ head -10 /etc/passwd | tail -6
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin

Explanation:

head -10 gets lines 1-10
tail -6 gets last 6 of those (lines 5-10)

Key concept: Combine head and tail to extract line ranges.

Lab 8: Monitor System Log (Intermediate)

Task: Monitor /var/log/messages in real-time (requires sudo).

Show Solution

$ sudo tail -f /var/log/messages
Nov  2 16:01:58 vm1 systemd[1]: Starting dnf makecache...
Nov  2 16:01:59 vm1 dnf[19557]: Metadata timer caching disabled...
# Waits and shows new lines as they appear
# Press Ctrl+C to stop

Key concept: -f follows file and displays new lines in real-time.

Lab 9: View with less (Intermediate)

Task: Open /etc/services in less, search for "http", and find all HTTP-related services.

Show Solution

$ less /etc/services
# Once inside less:
# Press / then type: http
# Press n to find next match
# Press N to find previous match
# Press q to quit

What you'll find:

http            80/tcp          www
https           443/tcp
http-alt        8080/tcp

Key concept: less allows interactive searching with / command.

Lab 10: Search in File Head (Intermediate)

Task: Find if "root" appears in the first 10 lines of /etc/passwd.

Show Solution

$ head /etc/passwd | grep root
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin

Alternative (more efficient):

$ grep root /etc/passwd | head

Key concept: Pipe head output to grep for searching within first N lines.

Lab 11: Reverse File View (Intermediate)

Task: Display /etc/hosts in reverse order (last line first).

Show Solution

$ tac /etc/hosts
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

Key concept: tac is cat backwards – displays files in reverse.

Lab 12: Check for Windows Line Endings (Advanced)

Task: Create a file with Windows line endings and detect them.

Show Solution

# Create test file with Windows line endings
$ printf "line1\r\nline2\r\nline3\r\n" > windows.txt

# Detect Windows line endings
$ cat -A windows.txt
line1^M$
line2^M$
line3^M$

What you see:

^M = Carriage return (Windows)
$ = Line feed (Unix)
Windows files have both (\r\n)
Unix files have only $ (\n)

Key concept: cat -A reveals hidden carriage returns that can break scripts.

Lab 13: Follow Log with Context (Advanced)

Task: Monitor the last 20 lines of /var/log/messages and continue following.

Show Solution

$ sudo tail -20f /var/log/messages
# Shows last 20 lines, then continues following
# Press Ctrl+C to stop

Alternative syntax:

$ sudo tail -n 20 -f /var/log/messages

Key concept: Combine line count with -f to show more context before following.

Lab 14: View Multiple Files (Advanced)

Task: View the first 3 lines of both /etc/hosts and /etc/hostname in one command.

Show Solution

$ head -3 /etc/hosts /etc/hostname
==> /etc/hosts <==
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

==> /etc/hostname <==
vm1.example.com

Key concept: Pass multiple files to head/tail/cat – they're processed in order with headers.

Lab 15: Extract from Line N Onward (Advanced)

Task: Display /etc/passwd starting from line 20 to the end.

Show Solution

$ tail -n +20 /etc/passwd
# Shows everything from line 20 onwards

Key concept: tail -n +N starts from line N instead of showing last N lines.

Lab 16: Combine cat with Pipeline (Advanced)

Task: Count how many users have /bin/bash as their shell in /etc/passwd.

Show Solution

$ cat /etc/passwd | grep "/bin/bash" | wc -l
3

More efficient version (grep can read files directly):

$ grep -c "/bin/bash" /etc/passwd
3

Key concept: Pipe commands together to process data in stages.

Lab 17: Monitor Multiple Logs (Advanced)

Task: Follow both /var/log/messages and /var/log/secure simultaneously.

Show Solution

$ sudo tail -f /var/log/messages /var/log/secure
==> /var/log/messages <==
Nov  2 16:12:32 vm1 dockerd[1573]: NetworkDB stats...

==> /var/log/secure <==
Nov  2 16:13:01 vm1 sshd[12345]: Accepted publickey...
# Shows new lines from both files with headers

Key concept: tail -f can follow multiple files, showing which file each line comes from.

Lab 18: Safe Binary File Check (Advanced)

Task: Before viewing a file, check if it's text or binary.

Show Solution

# Check file type first
$ file /bin/ls
/bin/ls: ELF 64-bit LSB executable

$ file /etc/passwd
/etc/passwd: ASCII text

# Only cat text files
$ cat /etc/passwd

Why this matters: Running cat on binary files can garble your terminal.

If terminal gets garbled:

$ reset

Key concept: Always check file type before using cat on unknown files.

Lab 19: View Compressed Logs (Advanced)

Task: View the contents of a gzipped log file without decompressing it permanently.

Show Solution

# View compressed log
$ zcat /var/log/messages-20241201.gz | less

# Or search in compressed log
$ zcat /var/log/messages-20241201.gz | grep error

# Or get last 50 lines
$ zcat /var/log/messages-20241201.gz | tail -50

Related commands:

zcat = cat for .gz files
bzcat = cat for .bz2 files
xzcat = cat for .xz files

Key concept: zcat decompresses on-the-fly without creating uncompressed files.

Lab 20: Create Custom Log Monitor (Advanced)

Task: Monitor /var/log/messages but only show lines containing "error" or "failed".

Show Solution

$ sudo tail -f /var/log/messages | grep -i -E "error|failed"
# Shows only lines with "error" or "failed" (case-insensitive)
# Updates in real-time

Explanation:

tail -f follows the log
grep -i = case-insensitive
grep -E = extended regex
"error|failed" = match either word

Practical use: Filter live logs to only see important events.

Key concept: Pipe tail -f to grep for filtered live monitoring.

📝 Command Cheat Sheet

# cat - Display entire file
cat filename                    # View file
cat -n filename                 # With line numbers
cat -b filename                 # Number non-blank lines only
cat -A filename                 # Show all special characters
cat file1 file2                 # Concatenate multiple files
tac filename                    # View file in reverse

# less - Interactive paging
less filename                   # Browse file interactively
less -N filename                # With line numbers
less +F filename                # Follow mode (like tail -f)
# Inside less:
#   Space/f = forward one screen
#   b = backward one screen
#   /pattern = search forward
#   n = next match, N = previous match
#   q = quit

# more - Simple paging
more filename                   # Basic paging
# Inside more:
#   Space = next screen
#   Enter = next line
#   q = quit

# head - First N lines
head filename                   # First 10 lines
head -5 filename               # First 5 lines
head -n 20 filename            # First 20 lines
head -c 100 filename           # First 100 bytes
head file1 file2               # Multiple files

# tail - Last N lines
tail filename                   # Last 10 lines
tail -5 filename               # Last 5 lines
tail -n 20 filename            # Last 20 lines
tail -n +20 filename           # From line 20 to end
tail -f filename               # Follow file (live monitoring)
tail -F filename               # Follow even after rotation
tail -20f filename             # Last 20 lines, then follow

# Combining commands
head -3 file | tail -1         # Extract line 3
head -20 file | tail -10       # Extract lines 11-20
tail -f log | grep error       # Follow log, filter errors
zcat file.gz | less            # View compressed file

🎯 Key Takeaways

✅

Master These Concepts:

cat displays entire files (good for small files only)
cat -A reveals hidden characters (tabs, line endings)
less is the best pager (backward scrolling, searching)
more is a simple pager (forward-only, limited features)
head -N shows first N lines (default 10)
tail -N shows last N lines (default 10)
tail -f follows files in real-time (essential for logs)
tail -F follows even after log rotation
Pipe commands to extract specific line ranges
Always check file type before using cat on unknown files

Quick Decision Guide:

Small config file → cat
Large log file → less
First few lines → head
Recent log entries → tail
Live monitoring → tail -f
Search while browsing → less then /pattern

🚀 What's Next?

Coming Up Next:

Post 30: Introduction to Text Editors (vi/vim basics)
Post 31: Advanced vim Techniques

✅

🎉 Congratulations! You've mastered file viewing commands! You can now:

View files with cat and understand special characters
Browse large files interactively with less
Extract specific lines with head and tail
Monitor logs in real-time with tail -f
Combine commands with pipes for complex tasks

These commands are fundamental to system administration. You'll use them every day – especially tail -f for troubleshooting and less for reading documentation. Practice these labs until file viewing becomes second nature! 🚀

Understanding File Viewing Commands

The cat Command

Basic Usage

cat with Line Numbers (-n)

cat Showing Special Characters (-A)

Real Example with Tabs

cat with Numbered Non-Blank Lines (-b)

Common cat Options

The tac Command (Bonus)

The less Command (Pager)

Why less?

Navigation in less

Searching in less

less with Line Numbers

Following a File with less (+F)

The more Command (Simple Pager)

Basic Usage

Limitations of more

The head Command

Default Behavior

Specifying Number of Lines

head with Bytes

Multiple Files

The tail Command

Default Behavior

Specifying Number of Lines

Starting from Line N (+N)

tail -f: Live Log Monitoring

Basic Following

Following Multiple Files

Following with More Lines

tail -F: Follow Even if File Recreated

Combining Commands with Pipes

head + tail = Extract Middle Lines

Get Lines 10-20

cat + grep = Search Within File

tail + grep = Search Recent Logs

Real-World Use Cases

1. Check Configuration File Syntax

2. View Large Log Files

3. Monitor Application Logs

4. Extract Specific Log Time Range

5. Compare First and Last Lines

6. Check File for Windows Line Endings

7. View Compressed Logs

8. Count Lines in File

Best Practices

Common Pitfalls

1. Using cat on Binary Files

2. Following the Wrong Log File

3. Not Using Pipes Efficiently

4. Forgetting to Quit less

5. Missing Recent Log Entries

🧪 Practice Labs

Lab 1: Basic cat Usage (Beginner)

Lab 2: cat with Line Numbers (Beginner)

Lab 3: View Special Characters (Beginner)

Lab 4: Basic head Usage (Beginner)

Lab 5: Basic tail Usage (Beginner)

Lab 6: Extract Specific Line (Intermediate)

Lab 7: Extract Line Range (Intermediate)

Lab 8: Monitor System Log (Intermediate)

Lab 9: View with less (Intermediate)

Lab 10: Search in File Head (Intermediate)

Lab 11: Reverse File View (Intermediate)

Lab 12: Check for Windows Line Endings (Advanced)

Lab 13: Follow Log with Context (Advanced)

Lab 14: View Multiple Files (Advanced)

Lab 15: Extract from Line N Onward (Advanced)

Lab 16: Combine cat with Pipeline (Advanced)

Lab 17: Monitor Multiple Logs (Advanced)

Lab 18: Safe Binary File Check (Advanced)

Lab 19: View Compressed Logs (Advanced)

Lab 20: Create Custom Log Monitor (Advanced)

📝 Command Cheat Sheet

🎯 Key Takeaways

🚀 What's Next?

Written by Owais

Get Job-Ready in Emerging Tech

Related Articles