1 of 4

Working with TextLesson 1 of 4

Reading and counting text

Look at files of any size, follow a growing log, and measure text before you change it.

  • cat
  • less
  • head
  • tail
  • wc
  • nl
  • tail -f

25 min5 exercises

After this lesson you can

  • Choose between cat, less, head and tail for a given file.
  • Follow a log as lines are added.
  • Count lines, words and bytes, and number lines.

The idea

Most administration is reading. You read a configuration file to learn what a service will do, a log to learn why it did not, and the output of another command to decide what to do next. Pick the tool by the size and shape of the file.

ToolUse it for
cat fileShort files, and joining files together
less fileAnything longer than a screen; search with /, quit with q
head -n N, tail -n NThe first or last N lines
tail -f fileWatch a log grow
wcCount lines (-l), words (-w) and bytes (-c)
nlPrint with line numbers

Never open a log in an editor just to read it: you risk changing it, and large files are slow to load.

Try it

head -n 3 /etc/passwd
tail -n 2 /etc/passwd
root:x:0:0:Super User:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
alex:x:1000:1000:alex:/home/alex:/bin/bash
bob:x:1001:1001::/home/bob:/bin/bash
wc -l /etc/passwd
wc -l < /etc/passwd
34 /etc/passwd
34
nl /etc/services | grep -w ssh
   102	ssh             22/tcp
   103	ssh             22/udp
   104	ssh             22/sctp

Following a log

tail -f keeps the file open and prints new lines as they arrive. For the system journal the equivalent is journalctl -f, which you will use in the logging lesson of Processes, Tuning and Logs.

touch ~/lab/app.log
tail -f ~/lab/app.log

From a second terminal, echo "login ok" >> ~/lab/app.log makes login ok appear in the first. Stop with Ctrl+C.

Going further

tail -n +5 file prints from line 5 to the end, head -n -2 file prints everything except the last two lines, and tac prints a file backwards. cat -A makes tabs (^I) and line ends ($) visible, which finds the invisible trailing space that broke a config file.

Practice

0 of 5 done

Do these on your own system. They get harder. Check each result, then tick it off.

  1. Warm-up

    Pick lines from either end

    Print the first 3 and the last 3 lines of /etc/passwd, then print only line 10 of it.

    Check your result

    The first two outputs are three lines each. The last one is the tenth line, found with head -10 | tail -1 or sed -n 10p.

    Hint

    head -n 3, tail -n 3. For one line in the middle, combine them.

    Solution
    head -n 3 /etc/passwd
tail -n 3 /etc/passwd
head -n 10 /etc/passwd | tail -n 1
  2. Warm-up

    Count lines, words and bytes

    Say how many accounts /etc/passwd defines, how many words /etc/hostname has and how many bytes /etc/os-release takes. Use wc each time.

    Check your result

    wc -l < /etc/passwd prints one number, wc -w < /etc/hostname prints 1 for a one-word name, wc -c < /etc/os-release prints a byte count.

    Hint

    -l lines, -w words, -c bytes. Feeding the file by < makes wc print only the number.

    Solution
    wc -l < /etc/passwd
wc -w < /etc/hostname
wc -c < /etc/os-release
  3. Practice

    Follow a file while it grows

    In one terminal start following ~/lab/app.log with tail -f (create the file first). From a second terminal append three lines. Confirm they appear, then stop the follow.

    Check your result

    The three new lines appear in the first terminal within a second. Ctrl+C stops the follow.

    Hint

    tail -f file waits for new lines. Append with echo text >> file from another shell.

    Solution
    # terminal 1
touch ~/lab/app.log
tail -f ~/lab/app.log
# terminal 2
for i in 1 2 3; do echo "line $i" >> ~/lab/app.log; done
  4. Practice

    Number lines and page through a big file

    Show /etc/services with line numbers, 20 lines at a time, and jump straight to the line that contains ssh. Then print only the numbered lines that contain ssh.

    Check your result

    In less, /ssh jumps to the first match and q quits. nl /etc/services | grep ssh prints numbered matches.

    Hint

    nl numbers lines. In less, -N shows line numbers and / searches.

    Solution
    less -N /etc/services
nl /etc/services | grep ssh
  5. Challenge

    Answer a question from the end of a log

    Print the last five lines of the journal for the sshd service that contain the word Accepted or Failed, newest last, without opening a pager.

    Check your result

    At most five lines, each from sshd and each containing Accepted or Failed. If your own logins are the only ones, you see Accepted lines.

    Hint

    journalctl -u sshd --no-pager writes to a pipe; filter with grep -E and trim with tail.

    Solution
    sudo journalctl -u sshd --no-pager | grep -E 'Accepted|Failed' | tail -n 5