Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · reading files

less

read a long file

less is a pager: it shows one screen of a file and waits. You can scroll both ways, jump to the end, and search, and it opens huge files instantly because it reads only the part being shown.

cat prints and leaves; less lets you move around. Press q to quit.

Scroll
Arrows, Space, b
line, page down, page up
Search
/word
n for next, N for previous
Jump
g and G
start and end of the file
Quit
q
nothing is changed

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashless
$ less /var/log/syslog
1Sep 30 09:00:01 netflow systemd[1]: Started Daily apt download activities.
Sep 30 09:00:04 netflow CRON[2101]: (root) CMD (run-parts /etc/cron.hourly)
Sep 30 09:17:42 netflow sshd[2231]: Accepted publickey for user from 192.168.1.20
2/sshd
3:
4$ dmesg | less
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
The first screen of the file

less fills the terminal and stops. Nothing more is read until you scroll.

2
Typing / starts a search

The pattern appears on the bottom line. Enter jumps to the first match and highlights every one; n moves to the next.

3
The colon is the prompt

It means less is waiting for a key: q to quit, G for the end, g for the start, h for help.

4
Any output can be paged

Piping a long command into less gives the same scrolling and searching for output that would otherwise fly past.

Switches

A switch changes how the command behaves. These are the ones used day to day; man less lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-N
Show line numbers.
-S
Do not wrap long lines; scroll sideways instead.
-i
Ignore case when searching, unless the pattern has capitals.
-R
Show colours from commands that produce them.
+G
Start at the end of the file.
+F
Follow the file as it grows, like tail -f.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

less +G app.log

Opens the file at its end, where the newest log lines are.

less -N script.sh

Shows line numbers down the left.

less -S wide.csv

Does not wrap long lines; scroll sideways with the arrow keys.

less +F app.log

Follows the file as it grows, like tail -f. Ctrl+C returns to normal scrolling.

In cybersecurity

A pager is a small program with more abilities than it appears to have.

A pager can start a shell

Typing !command inside less runs it. If sudo allows a user to run less as root, that user has a root shell.

Safer than cat for unknown files

less shows control characters as visible symbols instead of sending them to the terminal, so a hostile file cannot rewrite your screen.

Reading leaves no trace

Opening a log in less changes nothing and is not recorded, which is right for an investigation — and worth remembering about anyone else with read access.

Filed under

Reading files

Read alongside