lessBrowse files and output: scroll, search, filter, follow
less is the pager you should use for anything longer than a screen: it opens multi-gigabyte logs instantly, scrolls both ways, searches forwards and backwards, filters to matching lines, and can follow a growing file like tail -f. It's also what man, git log and systemctl use to show their output.
less [OPTIONS] [+COMMAND] FILE... COMMAND | lessYou need to read through a big log at your own pace, jumping to the end and back.
lessOpen the file in the pager. Only the part on screen is read, so huge files open instantly.
less reads its input lazily: it seeks to the part of the file it needs to display and keeps a small index of where lines start, so opening a 20 GB log is instant and memory use stays small. Jumping to the end (G) only reads the end, though line numbers (-N, =) may force it to count newlines through the file. For piped input it buffers what it has read so you can still scroll back, which more can't do. It talks to the terminal through terminfo and the alternate screen, which is why the file disappears from your screen when you quit (-X keeps it). Searching (/ forwards, ? backwards) uses regular expressions and highlights matches; & hides non-matching lines. F (or +F) turns less into tail -f: it waits at the end for new data until you press Ctrl+C. The environment variable LESS sets default options, and LESSOPEN lets a preprocessor (Ubuntu's lesspipe) show .gz files, archives and PDFs as text.
Space / bForward / back one screen (also PgDn / PgUp)g / GGo to the first / last line (50g = line 50)/pattern ?patternSearch forwards / backwards (regex)n / NNext / previous match&patternShow only lines matching pattern (& alone clears)FFollow the end of the file like tail -f (Ctrl+C stops)-NShow line numbers-SChop long lines instead of wrapping-iCase-insensitive search unless the pattern has capitals-RShow ANSI colours (for colourised output)-X -FDon't clear the screen; quit if it fits on one screenqQuitvim or nano on a 5 GB log just to read itEditors load (and may copy) the whole file into memory, which is slow and can exhaust RAM on a busy server.
less file (reads only what's on screen)cat huge.log | lessWorks, but less can no longer seek in the file, so G has to read everything through the pipe and the percentage is unknown.
less huge.logEditing in less and expecting it to saveless is read-only. v opens the file in $VISUAL/$EDITOR at the current line.
Press v, or open the file in an editorLeaving less +F running in a session you then forgetIt keeps the file open (and a deleted log's space can't be freed while it's open).
Ctrl+C then q when done; check lsof +L1 if disk space doesn't come backTry these on a Linux machine of your own. Each task has a hint and a solution.
Open ~/logs/app.log in less, jump to the end, then search backwards for the most recent ERROR.
In ~/logs/access.log, show only lines containing ' 500 ' while inside less.
Read the compressed ~/logs/app.log.2.gz without decompressing it to disk.
Open ~/logs/access.log with line numbers and long lines chopped, starting at line 100.
lessBrowse files and output: scroll, search, filter, follow
less is the pager you should use for anything longer than a screen: it opens multi-gigabyte logs instantly, scrolls both ways, searches forwards and backwards, filters to matching lines, and can follow a growing file like tail -f. It's also what man, git log and systemctl use to show their output.
less [OPTIONS] [+COMMAND] FILE... COMMAND | lessYou need to read through a big log at your own pace, jumping to the end and back.
lessOpen the file in the pager. Only the part on screen is read, so huge files open instantly.
less reads its input lazily: it seeks to the part of the file it needs to display and keeps a small index of where lines start, so opening a 20 GB log is instant and memory use stays small. Jumping to the end (G) only reads the end, though line numbers (-N, =) may force it to count newlines through the file. For piped input it buffers what it has read so you can still scroll back, which more can't do. It talks to the terminal through terminfo and the alternate screen, which is why the file disappears from your screen when you quit (-X keeps it). Searching (/ forwards, ? backwards) uses regular expressions and highlights matches; & hides non-matching lines. F (or +F) turns less into tail -f: it waits at the end for new data until you press Ctrl+C. The environment variable LESS sets default options, and LESSOPEN lets a preprocessor (Ubuntu's lesspipe) show .gz files, archives and PDFs as text.
Space / bForward / back one screen (also PgDn / PgUp)g / GGo to the first / last line (50g = line 50)/pattern ?patternSearch forwards / backwards (regex)n / NNext / previous match&patternShow only lines matching pattern (& alone clears)FFollow the end of the file like tail -f (Ctrl+C stops)-NShow line numbers-SChop long lines instead of wrapping-iCase-insensitive search unless the pattern has capitals-RShow ANSI colours (for colourised output)-X -FDon't clear the screen; quit if it fits on one screenqQuitvim or nano on a 5 GB log just to read itEditors load (and may copy) the whole file into memory, which is slow and can exhaust RAM on a busy server.
less file (reads only what's on screen)cat huge.log | lessWorks, but less can no longer seek in the file, so G has to read everything through the pipe and the percentage is unknown.
less huge.logEditing in less and expecting it to saveless is read-only. v opens the file in $VISUAL/$EDITOR at the current line.
Press v, or open the file in an editorLeaving less +F running in a session you then forgetIt keeps the file open (and a deleted log's space can't be freed while it's open).
Ctrl+C then q when done; check lsof +L1 if disk space doesn't come backTry these on a Linux machine of your own. Each task has a hint and a solution.
Open ~/logs/app.log in less, jump to the end, then search backwards for the most recent ERROR.
In ~/logs/access.log, show only lines containing ' 500 ' while inside less.
Read the compressed ~/logs/app.log.2.gz without decompressing it to disk.
Open ~/logs/access.log with line numbers and long lines chopped, starting at line 100.