Introduction
In this tutorial, you will learn how to use the less command in Linux to efficiently navigate and analyze large log files. The less command is a powerful tool for viewing text files in the terminal, allowing users to scroll through content, search for specific information, and view file contents page by page.
Imagine you are a system administrator tasked with investigating a series of server errors. You have access to a large log file containing information about system events, but the file is too big to open in a regular text editor. This is where the less command becomes invaluable.
Accessing the Log File
First, let's navigate to the directory containing our log file and view its contents.
Open your terminal. You should be in the
/home/labex/projectdirectory by default.List the contents of the directory:
ls
You should see a file named server_log.txt.
- To view the contents of this file using the
lesscommand, type:
less server_log.txt
This command opens the server_log.txt file using less. You can now view the contents of the file.
Note: The content you see may differ from the example below, as the log file is dynamically generated.
2023-11-05 08:00:01 INFO: Server startup complete
2023-11-05 08:15:23 WARNING: High CPU usage detected
2023-11-05 08:30:45 ERROR: Database connection failed
2023-11-05 08:31:02 INFO: Retrying database connection
2023-11-05 08:31:05 INFO: Database connection established
...
To exit the less view, press the q key.
Navigating Through the File
Now that we have opened the file, let's learn how to navigate through it.
- Open the log file again using
less:
less server_log.txt
- Use the following keys to navigate:
- Press
SpaceorPage Downto move forward one page - Press
borPage Upto move backward one page - Use the
UpandDownarrow keys to move line by line - Press
G(Shift + g) to go to the end of the file - Press
gto go to the beginning of the file
- Press
Try these navigation commands to familiarize yourself with moving through the file.
- When you're done exploring, press
qto exitless.
Searching for Specific Content
As a system administrator, you often need to find specific information quickly. The less command provides powerful search capabilities.
- Open the log file again:
less server_log.txt
- To search for the word "ERROR", type
/ERRORand press Enter. This will highlight all occurrences of "ERROR" in the file. - Press
nto move to the next occurrence of "ERROR", orNto move to the previous occurrence. - Now, let's search for a specific date. First, navigate to the beginning of the file by pressing
g, then look at the dates in the log entries. Choose a date that appears in the file (for example, if you see "2025-01-15" in the file, search for that date). Type/followed by the date you want to search for (e.g.,/2025-01-15) and press Enter. - Use
nandNto navigate between occurrences of this date. - When you're done searching, press
qto exitless.
Displaying Line Numbers
When analyzing logs, it can be helpful to see line numbers for reference.
- Open the log file with line numbers displayed:
less -N server_log.txt
The -N option tells less to display line numbers.
- You should now see line numbers at the left side of each line:
1 2023-11-05 08:00:01 INFO: Server startup complete
2 2023-11-05 08:15:23 WARNING: High CPU usage detected
3 2023-11-05 08:30:45 ERROR: Database connection failed
4 2023-11-05 08:31:02 INFO: Retrying database connection
5 2023-11-05 08:31:05 INFO: Database connection established
...
Navigate through the file as before. Notice how the line numbers help you keep track of your position in the file.
When you're done, press
qto exitless.
Starting from a Specific Pattern
Sometimes, you may want to start viewing the file from a specific point. The less command allows you to do this easily.
- Let's say you want to start viewing the file from the first occurrence of a database error. Use this command:
less +/ERROR:.Database server_log.txt
This command tells less to open the file and immediately jump to the first line containing "ERROR:" followed by any character and then "Database".
- You should now see the file opened at the first database error:
2023-11-05 08:30:45 ERROR: Database connection failed
2023-11-05 08:31:02 INFO: Retrying database connection
2023-11-05 08:31:05 INFO: Database connection established
...
You can continue to navigate through the file from this point as before.
When you're done, press
qto exitless.
Summary
In this tutorial, you learned how to use the less command to efficiently navigate and analyze large log files. You practiced opening files, scrolling through content, searching for specific information, displaying line numbers, and starting from a specific pattern in the file.
These skills are crucial for system administrators and developers who often need to quickly analyze large log files to troubleshoot issues or monitor system performance.
Other useful less parameters not covered in this tutorial include:
-i: Ignore case in searches-F: Quit if the entire file can be displayed on one screen-S: Chop long lines instead of wrapping them+F: Keep reading the file, displaying new contents as they appear (similar totail -f)



