Command line CLI · 02 · 03

Reading files

cat dumps the entire file to stdout — useful for small files and piping. less is a pager for large files: scroll with arrow keys, search with /, quit with q. head and tail print the first or last N lines; tail -f follows a live log in real time.

CLI Foundations ◷ 18 min

Level

FoundationsJuniorMiddleSenior

Every config file, log, script, and data file on the server is a text file. Knowing how to read them quickly — whether to check a config value, inspect a 200 MB log, or watch errors scroll in real time — is a skill you will use every day. Four commands cover the full range: cat for small files and piping, less for large ones, head and tail for edges and live streams.

By the end of this lesson you will know which tool to reach for in each situation and why dumping a 200 MB log with cat is not the right answer.

Goal

After this lesson you can use cat to print file contents and concatenate files, less to interactively browse a large file without loading it all into memory, head -n N to see the first N lines, and tail -n N and tail -f to see the last N lines or follow a live log file.

cat prints the entire file to standard output. The name stands for concatenate — its original purpose is to join multiple files together. When given a single file it just prints it:

cat /etc/hostname

myserver

With multiple files, cat prints them one after another in order:

cat header.txt body.txt footer.txt

cat is the right tool for small files (a few hundred lines) and for feeding file contents into a pipeline (cat file.txt | grep error). For large files it dumps everything at once, overwhelming the terminal and possibly your memory.

less is a pager — it lets you scroll through a large file interactively. Unlike cat, less does not load the whole file; it reads just enough to fill your screen, making it safe for files of any size:

less /var/log/syslog

Essential less keyboard controls:

Arrow keys / j / k — scroll one line down or up
Space / b — scroll one page down or up
/pattern — search forward for a pattern (press n for next match)
?pattern — search backward
g — jump to the beginning of the file
G — jump to the end
q — quit

less is the right tool whenever a file might be too long to fit on screen. When in doubt, use less over cat.

head prints the first N lines of a file. The default is 10 lines; use -n to change it:

head /etc/passwd          # first 10 lines
head -n 20 /etc/passwd    # first 20 lines
head -n 1 /etc/hostname   # just the first line — useful for single-value files

head is useful for confirming a file’s format before processing it, or quickly reading a config file where the important settings are at the top.

tail prints the last N lines of a file. Default is 10 lines; same -n flag applies:

tail /var/log/auth.log         # last 10 lines
tail -n 50 /var/log/syslog     # last 50 lines

The -f flag (follow) is how engineers watch live logs. It keeps the file open and prints new lines as they are appended — the terminal updates in real time:

tail -f /var/log/nginx/access.log

Press Ctrl-C to stop following. tail -f is the standard way to watch a running service’s logs without an external log viewer.

Four reading tools, four different views of the same file. cat dumps all of it. less pages through it. head shows the top. tail shows the bottom — and with -f, keeps watching.

Worked example

Inspecting a server log at different scales.

A new application has been deployed. Something looks wrong. You need to investigate /var/log/app/app.log.

# Step 1: Check how big the file is before dumping it
wc -l /var/log/app/app.log

84321 /var/log/app/app.log

84,000 lines — do not cat this. Use less:

less /var/log/app/app.log

Inside less, search for errors:

/ERROR

Found some. Now pull the last 100 lines to see what is happening right now:

tail -n 100 /var/log/app/app.log

The problem is still occurring. Watch it live:

tail -f /var/log/app/app.log

New lines stream in as the application writes them. When you see the error repeat, press Ctrl-C to stop following and analyse the output.

▸Why this works

On macOS, cat, head, and tail work identically. less is available on macOS but some older systems ship with more (an older, simpler pager). In macOS terminal emulators you will often use less and it behaves the same. For tail -f, macOS also supports tail -F (capital F) which handles log rotation by following the filename rather than the file descriptor — useful when logs roll over at midnight.

▸Common mistake

Running cat on a large binary or log file does not just waste time — it can lock your terminal. Binary files often contain control characters that rearrange the display or even reset terminal state. If you accidentally cat a binary, run reset to restore the terminal:

reset

Better still, check the file type first:

file /some/unknown/file

/some/unknown/file: ELF 64-bit LSB executable, x86-64, ...

file identifies the format; if it says ELF, gzip, image, or anything non-text — reach for a hex viewer or the appropriate tool, not cat.

Check yourself

Quiz

A log file has 500,000 lines and is actively being written by a running service. You want to see only the most recent entries as they arrive. Which command is correct?

Recap

cat prints the entire file to stdout — ideal for small files and pipelines, dangerous for large ones. less is a pager that lets you scroll, search (/), and navigate a file of any size without memory risk; quit with q. head -n N prints the first N lines; tail -n N prints the last N lines. tail -f follows a file and streams new lines as they arrive — the standard tool for watching live logs. Match the tool to the file size: cat for small, less for unknown or large, head/tail for bounded slices.

Practice

Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.

recallapplystretch0 of 5 done

Something unclear?

Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.