Viewing files: cat, less, head, tail

The last lesson left you able to copy, move, and delete files without ever seeing what was in them — and pointed out that some of those files are far too big to open in an editor. This lesson is how you look inside anything, from a four-line config to a two-gigabyte log, without loading the whole thing. The trick is picking the right tool, and there is exactly one question that decides it.

Choosing the right tool

The single question that drives the choice: how big is the file, and is it still being written?

cat — dump a file to the screen

cat (short for concatenate) reads one or more files and writes their contents to stdout — the terminal’s standard output stream.

cat notes.txt

Meeting notes — 2026-06-05
Attendees: Priya, Arjun, Leela
Action items:
  1. Deploy hotfix by Friday
  2. Update the runbook

You can concatenate two files into a third:

cat part1.txt part2.txt > combined.txt

Line numbers with cat -n

cat -n config.ini

     1	[database]
     2	host = localhost
     3	port = 5432
     4	name = appdb

less — the pager

A pager is a program that shows one screenful of text at a time and waits for your keypress. less is the standard pager on Linux and macOS. It never loads the whole file into memory, so it opens a 2 GB log instantly.

less /var/log/app/production.log

Key controls inside less:

Show line numbers inside less:

less -N /var/log/app/production.log

      1 2026-06-05 00:01:14 INFO  Server started on :8080
      2 2026-06-05 00:01:15 INFO  Database connected
      3 2026-06-05 00:03:44 ERROR Timeout on /api/orders (upstream=payments)

head — the first N lines

head prints the first 10 lines by default. Use -n to change that.

head server.log

2026-06-04 23:58:01 INFO  Server started on :8080
2026-06-04 23:58:02 INFO  Database connected
2026-06-04 23:58:02 INFO  Cache warmed (12 048 keys)
2026-06-04 23:58:10 INFO  First request received
...

head -n 3 server.log

2026-06-04 23:58:01 INFO  Server started on :8080
2026-06-04 23:58:02 INFO  Database connected
2026-06-04 23:58:02 INFO  Cache warmed (12 048 keys)

tail — the last N lines

tail prints the last 10 lines by default. Same -n flag.

tail -n 5 server.log

2026-06-05 02:14:09 ERROR Timeout on /api/orders (upstream=payments)
2026-06-05 02:14:10 ERROR Timeout on /api/orders (upstream=payments)
2026-06-05 02:14:11 WARN  Circuit breaker opened for payments service
2026-06-05 02:14:12 INFO  Returning cached response for /api/orders
2026-06-05 02:14:15 INFO  Circuit breaker half-open, probing payments

tail -f — follow a live log

The -f flag (follow) keeps tail running and prints new lines as they are appended to the file. This is the killer feature for watching a server while you reproduce a bug.

tail -f /var/log/app/production.log

2026-06-05 02:20:01 INFO  GET /healthz 200 (2ms)
2026-06-05 02:20:05 INFO  POST /api/checkout 200 (84ms)
2026-06-05 02:20:07 ERROR POST /api/checkout 500 — NullPointerException in CartService

Lines stream in as they arrive. Press Ctrl+C to stop.

Combine -f with -n to also show the last N lines on startup:

tail -n 20 -f /var/log/app/production.log

wc -l — count lines

Before deciding which tool to use, a quick line count is useful context.

wc -l server.log

 4 238 492 server.log

Four million lines — definitely reach for less or tail, not cat.

Quick-reference diagram

In one breath

Pick the tool by one question — how big is the file, and is it still being written? cat dumps a small file to the screen (cat -n numbers the lines); never cat a giant or binary file. less is the pager — it shows one screen at a time and opens even a 2 GB log instantly because it never loads the whole thing (Space/b to page, g/G for top/bottom, /pattern to search, q to quit). head -n N takes the first N lines, tail -n N the last (both default 10), and tail -f follows a live log, streaming new lines as they land — the on-call debugging staple. When unsure, wc -l counts the lines first so you know which tool to reach for.

Practice

Before the quiz, choose tools for three on-call moments: (a) you need only the column headers of a 3 GB CSV — which command, and which flag? (b) a service just deployed and you want to watch errors appear the instant they happen — which command? (c) the log from (b) goes completely silent for thirty seconds — what does that silence most likely mean, given exactly what tail -f does?

A question to carry forward

You can now open any file and move through it — but notice that everything here is still fundamentally sequential. less lets you scroll and search one match at a time; head and tail only ever give you the ends. That is fine for a few hundred lines. But picture the real 2 AM scenario: four million lines, and the forty ERROR entries you actually care about are scattered somewhere in the middle. Scrolling will never find them, and you are certainly not reading them one screen at a time. What you want is to ask the file a question — show me only the lines that match ERROR — and have every one pulled out at once, even across a whole directory of logs. That tool is grep, and it opens the next chapter.