View file contents in Linux: cat, less, head and tail

Reading files is half of running a server: you check a config before changing it, or read a log to see why something failed. Linux has several small tools for this, each suited to a different job. This guide shows when to use cat, less, head and tail, and how to watch a log update live.

Before you start

• SSH access to your Linux VPS. See Connect to your Linux VPS with SSH.
• Many system logs can only be read by root. Put sudo in front of the command when you see Permission denied.

None of these commands change the file, so they are always safe to run.

Print a short file with cat

cat prints the whole file to the screen in one go:

cat /etc/hostname
cat /etc/os-release

It is ideal for short files. For long ones, the text scrolls past faster than you can read. Use less instead.

Useful options:

• cat -n file: number every line, handy when an error message mentions a line number.
• cat -A file: show hidden characters, such as tabs (^I) and Windows line endings (^M), which can break scripts and configs.

Page through long files with less

less opens a file one screen at a time and lets you move around and search:

less /var/log/syslog

On AlmaLinux and Rocky, the main system log is /var/log/messages instead.

The keys you need:

• Space or Page Down: next screen. b or Page Up: previous screen.
• Arrow keys: one line at a time.
• g: jump to the start. G: jump to the end.
• /word then Enter: search forward for word. n finds the next match, N the previous one.
• ?word: search backward.
• -N (typed inside less): toggle line numbers.
• q: quit.

less reads only the part of the file it shows, so it opens huge files quickly. That makes it the safest choice when you do not know how big a file is.

See the start with head

head shows the first 10 lines. Use -n for a different number:

head /etc/passwd
head -n 3 /etc/passwd

It is a quick way to check what kind of file something is, or to see the header row of a CSV.

See the end with tail

Logs add new lines at the bottom, so the most recent events are at the end. tail shows the last 10 lines:

sudo tail /var/log/nginx/error.log
sudo tail -n 50 /var/log/nginx/error.log

Follow a log live with tail -f

tail -f keeps the file open and prints new lines as they are written. Run it in one window, then reproduce the problem (reload the website, retry the login) and watch the error appear:

sudo tail -f /var/log/nginx/error.log

Press Ctrl + C to stop.

Use -F (capital) for logs that get rotated. It notices when the file is replaced and reopens the new one:

sudo tail -F /var/log/auth.log

On AlmaLinux and Rocky, the login log is /var/log/secure.

You can follow several files at once; tail labels each block with the file name:

sudo tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Filter while you read

Combine these tools with grep to show only the lines you care about:

sudo grep -i "error" /var/log/syslog | tail -n 20
sudo tail -f /var/log/nginx/access.log | grep " 404 "

Many services log to the systemd journal rather than a file. Read those with journalctl, for example sudo journalctl -u nginx -n 50 or sudo journalctl -u nginx -f.

View large files safely

A multi-gigabyte log is easy to open by mistake. Some habits help:

• Check the size first with ls -lh file or du -h file.
• Avoid cat on big files. It floods your terminal and can make the SSH session lag.
• Use less, head, tail or grep, which handle large files well.
• For compressed rotated logs (.gz), use zcat, zless or zgrep instead of unpacking them:

zless /var/log/syslog.2.gz

Check it works

Try each tool once:

head -n 5 /etc/passwd
tail -n 5 /etc/passwd
less /etc/services

In less, type /ssh, press Enter, then q to quit. You should land on the line that mentions SSH.

Troubleshooting

• Permission denied: the file is readable only by root or a group. Use sudo.
• The screen fills with symbols and the terminal acts strangely: you printed a binary file with cat. Type reset and press Enter to restore the terminal.
• tail -f shows nothing new: the service may log somewhere else, or to the journal. Check its config or use journalctl -u <service> -f.
• No such file or directory for a log from a guide: log names differ between distributions. See Linux log file locations.

Next steps

• Make changes once you have read a file: Edit files with nano.
• Learn the systemd log viewer: journalctl guide.
• Combine commands with | and >: Pipes and redirection in Linux.