03
View & Inspect Files
- Read logs without opening a full editor
- Confirm file type before editing
- Watch a log grow (tail -f)
Must-know cold
less FILE·head -n 20·tail -n 50·tail -f LOGcat FILE(small files only) ·wc -l FILEfile PATH·stat PATH·ls -l PATH
Commands
cat
Definition: Concatenate and print file contents to stdout (best for small files).
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | FILE... | Concatenate/print file(s) to stdout | cat f.txt |
-n | FILE | Number all lines | cat -n f.txt |
-b | FILE | Number non-blank lines | cat -b f.txt |
-A | FILE | Show non-printing (^I tab, $ end) | cat -A f.txt |
-s | FILE | Squeeze repeated blank lines | cat -s f.txt |
-v | FILE | Show non-printing (except tab/NL) | cat -v f.txt |
Flag combos
| Combo | Meaning | Example |
|---|---|---|
cat -n file | head | Numbered preview | cat -n app.log | head |
cat a b > c | Concatenate into new file | cat part1 part2 > all |
less
Definition: Page through a file interactively (scroll, search, follow).
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | FILE | Interactive pager (scroll/search) | less /var/log/syslog |
-N | FILE | Show line numbers | less -N file |
-S | FILE | Chop long lines (no wrap) | less -S wide.log |
-i | FILE | Search ignore case | less -i file then /error |
-F | FILE | Quit if one screen | less -F short |
-R | FILE | Raw ANSI colors | less -R colored.log |
+F | FILE | Start in follow mode (like tail -f) | less +F app.log |
+/PAT | FILE | Open at first match | less +/ERROR app.log |
Inside less (keys):
qquit ·/patsearch ·nnext ·gtop ·Gend ·Ffollow · Ctrl-C stop follow
Flag combos
| Combo | Meaning | Example |
|---|---|---|
less -NS file | Numbers + chop | less -NS access.log |
head
Definition: Show the first lines (or bytes) of a file.
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | FILE | First 10 lines (default) | head file |
-n | N FILE | First N lines | head -n 20 file |
-n | -N FILE | All but last N lines (GNU) | head -n -5 file |
-c | N FILE | First N bytes | head -c 100 file |
-q | FILE... | Never print filename headers | head -q *.log |
-v | FILE | Always print headers | head -v a b |
Flag combos
| Combo | Meaning | Example |
|---|---|---|
head -n 5 | Quick sample | head -n 5 /etc/passwd |
tail
Definition: Show the last lines of a file; with
-f, follow live appends.
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | FILE | Last 10 lines | tail file |
-n | N FILE | Last N lines | tail -n 50 app.log |
-n | +N FILE | From line N to end | tail -n +100 file |
-c | N FILE | Last N bytes | tail -c 200 file |
-f | FILE | Follow append (live log) | tail -f app.log |
-F | FILE | Follow by name; retry if rotated | tail -F /var/log/app.log |
--pid | PID | With -f: stop when PID dies | tail -f log --pid=1234 |
-q | FILE... | No headers | tail -q *.log |
Flag combos
| Combo | Meaning | Example |
|---|---|---|
tail -n 100 -f log | Last 100 then follow | tail -n100 -f app.log |
tail -F log | Survive logrotate | Production agents |
wc
Definition: Count lines, words, and/or bytes in input.
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | FILE | Lines, words, bytes | wc file |
-l | FILE | Line count only | wc -l app.log |
-w | FILE | Word count | wc -w file |
-c | FILE | Byte count | wc -c file |
-m | FILE | Character count | wc -m file |
-L | FILE | Length of longest line (GNU) | wc -L file |
Flag combos
| Combo | Meaning | Example |
|---|---|---|
grep ERR log | wc -l | Count matches | grep -c also works |
file
Definition: Guess a file’s type from content (magic), not just the name.
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | PATH | Guess type from content/magic | file /bin/ls |
-b | PATH | Brief; no filename prefix | file -b x |
-i | PATH | MIME type | file -i doc |
-L | PATH | Follow symlinks | file -L link |
-s | PATH | Read special files (block/char) | file -s /dev/sda |
-z | PATH | Look inside compressed | file -z a.gz |
Flag combos
| Combo | Meaning | Example |
|---|---|---|
file * | Type all in dir | Quick triage |
stat
Definition: Show detailed inode metadata: size, mode, owner, timestamps.
| Option | Argument | Meaning | Example |
|---|---|---|---|
| (none) | PATH | Size, mode, uid/gid, timestamps, inode | stat file |
-c | FORMAT PATH | Custom format (GNU) | stat -c '%n %s %a' f |
-f | PATH | Filesystem status (like df) | stat -f / |
-L | PATH | Follow symlink | stat -L link |
-t | PATH | Terse one line | stat -t file |
Useful -c formats:
%nname ·%ssize ·%aoctal mode ·%Ahuman mode ·%U/%Gowner ·%ymtime
Flag combos
| Combo | Meaning | Example |
|---|---|---|
stat -c '%a %n' f | Octal mode + name | Permission checks |
stat -c '%y %n' f | Mtime |
Common recipes
| Goal | Command |
|---|---|
| Sample start of log | head -n 20 app.log |
| Sample end of log | tail -n 50 app.log |
| Live follow | tail -f app.log |
| Page a large file | less app.log |
| Line count | wc -l app.log |
| Is it binary? | file ./artifact |
| Mode + owner + size | stat file or ls -l file |
Pitfalls
cathuge logs floods the terminal — preferless/tail.tail -ffollows the inode; after rotate usetail -F.fileis a guess — not security proof.- Binary files:
lessmay warn; don’tcatbinaries into an SSH session.
For more details, try man <command> in your terminal.