Paging Through a Large File with less

Part I · Module 4 · Chapter 4.2 · Paging Through a Large File with less

1. A Different Shape of Program

$ less sim/run_042/sim.log

The screen fills with the first page of the file and stops. Nothing scrolls past. The shell prompt is gone, because less is now the program in control — Chapter 1.3's third component, running and waiting for your keystrokes.

Press q to leave and the prompt returns.

That pause is the entire difference from cat, and it is structural rather than cosmetic.

A program that reads the whole file must finish reading before it finishes running. A program that shows one screen and waits has no reason to read further until you ask — so opening is instant whether the file is ten lines or ten gigabytes. That is not an optimisation somebody added; it is what "pager" means.

2. Moving Around

The keys that earn their place:

Two of those change how you work.

G goes straight to the end. For a log, that is usually the first thing you want — how did the run finish? It is instant even on an enormous file.

g goes back to the beginning, where a log usually records what was run, which version of a tool, and with what settings.

So a reasonable first pass on an unfamiliar log is: open it, press G to see how it ended, press g to see how it started, and you have both ends of the story in about three seconds.

3. Searching Inside the File

This is what makes less worth learning properly rather than just scrolling.

Press /, type what you are looking for, press Enter:

/error

less jumps to the next line containing error and highlights it. Then:

A realistic sequence on a log that failed somewhere:

G           jump to the end — see how it finished
?error      search backwards for the last error
N           keep going back through earlier errors

Searching backwards from the end is often exactly right, because the last error is usually the consequence and the first one is usually the cause. Walking backwards takes you from the symptom toward the origin.

Two refinements worth knowing:

Case-insensitive search. Type -i and press Enter to toggle it. Logs are inconsistent about ERROR, Error and error, and this saves searching three times.

The search box takes patterns, not just words. The text you type is treated as a regular expression, so some punctuation means something other than itself. That is Module 14's subject. For now, searching for plain words works exactly as you expect, and if a search containing punctuation behaves oddly, that is why.

4. Knowing Where You Are

In a long file it is easy to lose your place. less will tell you:

Useful in a specific way: when you have found the interesting line, Ctrl-G gives you its line number, and a line number is something you can write down, send to a colleague, or use with the commands in Chapter 4.3.

Turning on line numbers permanently is also possible:

$ less -N sim.log

-N shows a line number against every line. It is worth it when you are working through a file methodically and want to refer to positions, and it costs a little horizontal space.

5. Following a Growing File from Inside less

One more key, because it connects to the next chapter but one:

Press F and less sits at the end of the file, showing new lines as they are written — exactly the behaviour Chapter 4.4 teaches with a separate command. The advantage here is that Ctrl-C returns you to full navigation: you can watch, notice something, stop, scroll back to study it, and resume. That combination is genuinely useful when watching something run.

6. Reading the Status Line

The bottom line of the screen is less talking to you, and it is worth being able to read:

sim.log (END)

You are at the end of the file.

sim.log 47%

You are 47% of the way through.

:

A plain colon is the normal prompt — less is waiting for a command. Typing a letter here is a command, not text being inserted anywhere.

Pattern not found  (press RETURN)

Your search matched nothing in the remainder of the file. Press Enter, then g to go to the top and search again if you want to be sure it is nowhere rather than merely not ahead.

7. Why It Is Called less

A small piece of history that makes the name stick.

An older program called more did the same job and could only move forwards — you could page down through a file and not back up. less was written to do everything more did and more besides, including backwards movement, and was named as a joke on the proverb: less is more.

The practical consequence: on a system that has both, use less. more still exists and still cannot go backwards.

8. When Not to Use It

less is for reading with your eyes. Two situations call for something else.

You know exactly what you are looking for. If the question is "does this log contain the word FATAL", you do not want to open the file at all — you want a command that answers yes or no. That is grep, in Module 14. Opening a file to search it by hand is right when you need the surrounding context; it is slow when you only need the answer.

You want a small, specific part. The first twenty lines, or the last fifty, are better served by the commands in the next chapter, which print them and return you to the prompt rather than putting you into a program you have to quit.

The division worth carrying:

9. Why This Matters in Engineering Work

Reading logs by hand is a large part of debugging, and this is the command for it.

A realistic pass over a failed run, using only what this chapter taught:

$ ls -lh sim/run_042/sim.log
-rw-r--r-- 1 engineer engineer 1.8G Mar 22 09:15 sim.log

$ less sim/run_042/sim.log

Then, inside:

G           how did it end?
?error      the last error
N           walk backwards toward the first one
Ctrl-G      note the line number of the interesting one
g           back to the top: what version, what settings, what was run
q           done

That is a complete first investigation of a 1.8 GB file, performed in under a minute, without copying anything, without waiting for a load, and without leaving the terminal. Part II builds automated log analysis on top of exactly this manual skill — and the automation is easier to write once you know what you would have looked for by hand.

10. Practice

Question 1. Explain why less opens a 10 GB file instantly while cat on the same file takes a long time. Refer to what each program does with the contents.

Question 2. You are given a 2 GB log from a run that failed. Give the exact sequence of keys for your first thirty seconds in the file, and say what each one is for.

Question 3. You searched for timeout with / and less reports Pattern not found. Does that prove the word is absent from the file? What would you do to be sure?

Question 4. Which key tells you the current line number, and why is a line number worth having?

Question 5. g and G do opposite things. Name both, and say what that implies about using less generally.

Question 6. You want to watch a log grow, but also be able to scroll back when something catches your eye. Which key starts following, and which stops it without quitting?

Question 7. For each, choose between cat, less, and a command from a later chapter: a 30-line config; a 4 GB log you need to explore; the last 20 lines of a log; a yes/no answer to whether a log contains FATAL.

Question 8. You press q in a man page and it closes. Explain the connection between that and this chapter.

11. Remember

• less shows one screenful and waits, so it opens a file of any size instantly. That is a different shape of program from cat, not a gentler version of it.
• q quits. The prompt disappearing means a program is in control — Chapter 1.3's third component.
• g to the top, G to the end, 50g to line 50. On a log, G then g gives you both ends of the story in seconds.
• /word searches forward, ?word backward, n and N repeat. Searching backwards from the end walks from symptom toward cause.
• -i toggles case-insensitive search, which logs make necessary.
• Ctrl-G reports the line number, which is the thing you can write down and act on.
• F follows a growing file; Ctrl-C stops following without quitting.
• The search box takes patterns, so punctuation may behave unexpectedly until Module 14.
• less cannot modify the file. Experiment freely.
• Know what you are looking for? Use grep instead. less is for reading with context.

The next chapter answers the narrower questions — the first lines and the last lines — with commands that print and return, rather than putting you inside a program.