Linux cat, less, head, tail, wc and tee Commands with Examples (View and Follow Files)

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: reading a long WhatsApp chat

Why do we need this?

Sunita exports her society WhatsApp group chat to a text file. It has 40,000 lines. She does not read it all. She looks at the first few messages to see when the group started, jumps to the last messages to see today's news, scrolls slowly through the middle, counts how many messages there are, and keeps watching for new ones. She also forwards the news to her husband while reading it herself.

What is it?

First messages = head. Last messages = tail. Slow scrolling = less. Counting = wc. Watching for new ones = tail -f. Reading and forwarding at the same time = tee. Printing the whole chat = cat.

How to do it (step by step)

2. cat: print, join and create files

Why do we need this?

You often need to see a short file fully, or join parts into one file.

What is it?

cat (concatenate) prints files one after another. cat a b > c joins files, >> appends. Options: -n number all lines, -b number non-empty lines, -A show tabs (^I), line ends ($) and Windows CR (^M), -s squeeze repeated empty lines. cat > file <<'END' writes a quick file. Use cat only for short files; for long ones use less.

How to do it (step by step)

1. Print a small file.

cat /etc/hostname

Output:

web-pune-01

What it means: The machine's name is in this file.

2. Number the lines.

cat -n shopping.txt

Output:

     1	milk
     2	bread
     3	
     4	eggs

What it means: Line 3 is empty but still numbered.

3. Show hidden characters.

cat -A config.yml

Output:

name: shop$
port:^I8080$
mode: prod ^M$

What it means: ^I is a tab, ^M is a Windows line end. Both often break YAML and scripts.

4. Join parts into one file.

cat part1.csv part2.csv > all.csv && wc -l all.csv

Output:

2000 all.csv

What it means: > creates or overwrites all.csv. Use >> to add to the end.

5. Write a quick file with a here-doc.

cat > note.txt <<'END'
Server: web-01
Owner: Aditi
END
cat note.txt

Output:

Server: web-01
Owner: Aditi

What it means: Everything until END goes into the file.

cat > guests.txt
Rohan
Meera
(press Ctrl+D)

cat >> guests.txt
Kabir
(press Ctrl+D)
cat guests.txt

Rohan
Meera
Kabir

cat > guests.txt
Zoya
(press Ctrl+D)
cat guests.txt

Zoya

set -o noclobber
cat menu.txt > guests.txt

bash: guests.txt: cannot overwrite existing file

3. tac: print lines in reverse

Why do we need this?

Logs keep the newest lines at the bottom. Sometimes you want the newest first.

What is it?

tac prints the last line first and the first line last. It is cat spelled backwards. Do not confuse it with rev, which reverses the characters inside each line.

How to do it (step by step)

1. Newest lines first with tac.

tac app.log | head -3

Output:

10:05 order 1003 paid
10:04 order 1002 paid
10:03 order 1001 created

What it means: tac = cat backwards.

2. Compare with rev.

echo 'Pune' | rev

Output:

enuP

What it means: rev flips characters, tac flips lines.

4. nl: number lines

Why do we need this?

In reviews and tickets you say 'see line 14'. Numbers make that easy.

What is it?

nl numbers non-empty lines by default (like cat -b). -ba numbers all lines, -w3 sets the width, -s': ' sets the separator.

How to do it (step by step)

1. nl skips empty lines.

nl shopping.txt

Output:

     1	milk
     2	bread

     3	eggs

What it means: Good for code reviews.

2. Number every line with a custom separator.

nl -ba -w2 -s': ' shopping.txt

Output:

 1: milk
 2: bread
 3: 
 4: eggs

What it means: -ba includes the empty line 3.

5. less: read big files without fear

Why do we need this?

A 2 GB log printed with cat floods your screen and can freeze a slow SSH session. You need to scroll, search and jump.

What is it?

less opens a file one screen at a time and does not load it all into memory. Keys: Space or f next page, b back, g top, G bottom, /word search forward, ?word search back, n next match, N previous, q quit, F follow like tail -f (Ctrl+C to stop). Options: -N line numbers, -S no wrap for wide lines, +G open at the end, -R keep colours. more is the older, simpler pager.

How to do it (step by step)

1. Open a big log.

less /var/log/syslog

Output:

Oct 25 09:00:01 web-01 CRON[1201]: (root) CMD (backup.sh)
:

What it means: The : at the bottom means less waits for a key.

2. Open at the end with line numbers.

less -N +G /var/log/nginx/access.log

Output:

  48211 10.0.0.7 - - [25/Oct/2026:10:15:02] "GET /cart HTTP/1.1" 200

What it means: You land on the last line, number 48211.

3. Search for an error inside less.

/ERROR

Output:

10:12:44 ERROR payment timeout order=8812

What it means: Press n to jump to the next ERROR.

4. Read command output page by page.

ps aux | less -S

Output:

USER  PID %CPU %MEM COMMAND
root    1  0.0  0.1 /sbin/init

What it means: -S stops long lines from wrapping. Use arrow keys left and right.

5. Read a compressed log without unzipping.

zless /var/log/syslog.2.gz

Output:

Oct 23 00:00:01 web-01 systemd[1]: Started Daily apt upgrade

What it means: zless, zcat and zgrep work on .gz files directly.

6. more: the simple pager

Why do we need this?

On tiny systems (rescue mode, BusyBox) less may not exist, but more always does.

What is it?

more shows one screen at a time. Space next page, Enter next line, /text search, q quit. It cannot scroll back well. Prefer less when it is there.

How to do it (step by step)

1. Page through a file.

more /etc/services

Output:

# /etc/services
tcpmux 1/tcp
--More--(2%)

What it means: --More-- shows how far you are.

2. Page command output.

dmesg | more

Output:

[    0.000000] Linux version 6.1.0
--More--

What it means: Works in a pipe too.

7. head and tail: the start and the end

Why do we need this?

Usually you only need the header of a CSV or the last few lines of a log.

What is it?

head shows the first 10 lines, tail the last 10. -n N picks N lines. head -c N gives N bytes. head -n -5 gives all but the last 5. tail -n +2 starts at line 2 (skip a header). Combine them to cut a middle range: head -n 30 | tail -n 11 gives lines 20 to 30.

How to do it (step by step)

1. First 3 lines of a CSV.

head -n 3 sales.csv

Output:

date,city,amount
2026-10-01,Pune,4500
2026-10-01,Nashik,3200

What it means: Line 1 is the header.

2. Last 5 lines of a log.

tail -n 5 /var/log/auth.log

Output:

Oct 25 10:20:11 web-01 sshd[2231]: Accepted publickey for ravi from 10.0.0.5

What it means: The newest events are at the end.

3. Skip the header.

tail -n +2 sales.csv | head -n 2

Output:

2026-10-01,Pune,4500
2026-10-01,Nashik,3200

What it means: +2 means start from line 2.

4. Lines 20 to 30.

head -n 30 app.log | tail -n 11

Output:

(11 lines: 20..30)

What it means: Or use sed -n '20,30p' app.log (next chapters).

5. Several files at once.

head -n 1 *.csv

Output:

==> jan.csv <==
date,city,amount

==> feb.csv <==
date,city,amount

What it means: head prints a ==> name <== banner per file. -q hides it.

6. Top 5 biggest folders.

du -sh /var/* 2>/dev/null | sort -rh | head -5

Output:

2.1G /var/log
800M /var/lib
120M /var/cache

What it means: head is the last step of many 'top N' pipelines.

8. tail -f and tail -F: watch logs live

Why do we need this?

When you deploy or debug, you want to see new log lines the moment they are written.

What is it?

tail -f keeps the file open and prints new lines. If the log is rotated (renamed and a new file made), -f keeps watching the old file and goes silent. tail -F (same as --follow=name --retry) re-opens the new file by name, so use -F on servers. Stop with Ctrl+C. --pid=PID stops when a process ends. For systemd services use journalctl -u name -f.

How to do it (step by step)

1. Follow a web log.

tail -f /var/log/nginx/access.log

Output:

10.0.0.9 - - [25/Oct/2026:10:30:01] "GET / HTTP/1.1" 200 612
(waits for new lines...)

What it means: The cursor stays. New requests appear live.

2. Follow safely across log rotation.

tail -F /var/log/app/app.log

Output:

tail: '/var/log/app/app.log' has been replaced;  following new file
10:31:00 INFO started

What it means: -F noticed the new file and kept going.

3. Follow two logs together.

tail -F app.log worker.log

Output:

==> app.log <==
10:32 GET /api/orders

==> worker.log <==
10:32 job 77 done

What it means: Banners show which file each line came from.

4. Follow and filter only errors.

tail -F app.log | grep --line-buffered ERROR

Output:

10:33:12 ERROR db timeout

What it means: --line-buffered makes grep print at once in a pipe.

5. Follow a systemd service.

journalctl -u nginx -f

Output:

Oct 25 10:34:01 web-01 nginx[880]: reload done

What it means: journalctl is the tail -f for services that log to the journal.

9. wc: count lines, words and bytes

Why do we need this?

How many users? How many errors today? Is this file empty? Counting answers many ops questions fast.

What is it?

wc prints lines, words and bytes. -l lines, -w words, -c bytes, -m characters (Unicode safe), -L longest line. With a pipe it prints only the number (no file name), which is great in scripts. Note: wc -l counts newline characters, so a last line without a newline is not counted.

How to do it (step by step)

1. Count everything.

wc notes.txt

Output:

  12  85 512 notes.txt

What it means: 12 lines, 85 words, 512 bytes.

2. Count only lines.

wc -l /etc/passwd

Output:

38 /etc/passwd

What it means: 38 user accounts.

3. Only the number, for scripts.

wc -l < /etc/passwd

Output:

38

What it means: Redirect < hides the file name.

4. Count errors in a log.

grep ERROR app.log | wc -l

Output:

27

What it means: Same as grep -c ERROR app.log.

5. Bytes vs characters in Marathi text.

echo -n 'पुणे' | wc -c; echo -n 'पुणे' | wc -m

Output:

12
4

What it means: Each Devanagari character takes 3 bytes in UTF-8.

6. Count files in a folder.

ls /etc/nginx/conf.d | wc -l

Output:

4

What it means: Quick count. For odd names use find (chapter 12).

10. tee: save output and see it too

Why do we need this?

During an upgrade you want to watch the output and also keep a log file for later. Or you need to write into a root-owned file from a normal shell.

What is it?

tee reads input and writes it to the screen and to one or more files, like a T-shaped pipe joint. -a appends instead of overwriting. sudo tee file is the right way to write into protected files, because in sudo echo x > file the > runs as you, not as root. Add > /dev/null to hide the screen copy.

How to do it (step by step)

1. Watch and save an upgrade.

sudo dnf -y upgrade 2>&1 | tee upgrade-$(date +%F).log

Output:

Upgrading: openssl 3.0.7 ...
Complete!

What it means: 2>&1 also captures errors. The log is named by date.

2. Append to a log.

echo "$(date +%T) deploy v42 by Neha" | tee -a deploy.log

Output:

10:40:02 deploy v42 by Neha

What it means: -a keeps old lines.

3. Write a root file the right way.

echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swap.conf

Output:

vm.swappiness=10

What it means: Works. sudo echo ... > file would fail with Permission denied.

4. Save to two files.

df -h | tee disk-now.txt disk-$(hostname).txt > /dev/null && ls disk-*

Output:

disk-now.txt  disk-web-01.txt

What it means: > /dev/null hides the screen copy.

5. Save the middle of a pipe.

cat access.log | tee raw.txt | grep ' 500 ' | wc -l

Output:

14

What it means: raw.txt has all lines, the count is only for 500 errors.

11. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

12. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

13. Troubleshooting step by step

Why do we need this?

When a log looks wrong or empty, check the file, its size, permissions and whether it is still being written.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Does the file exist and how big is it?

ls -lh /var/log/app/app.log

2. Is it text or binary?

file /var/log/app/app.log

3. Can you read it?

head -n 2 /var/log/app/app.log || sudo head -n 2 /var/log/app/app.log

4. Is anything writing to it right now?

sudo lsof /var/log/app/app.log

5. Was it rotated? Look for .1 or .gz files.

ls -lt /var/log/app/ | head

6. Is the app logging to the journal instead?

journalctl -u app --since '10 min ago'

7. Check for Windows line ends or tabs.

cat -A /var/log/app/app.log | head -3

14. Lab 1: Inspect and follow a web server log

Why do we need this?

Make a fake access log, read it with head, tail and less, follow it live and count errors.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create a folder and a sample log.

mkdir -p ~/lab7 && cd ~/lab7 && for i in $(seq 1 200); do echo "10.0.0.$((i%9)) GET /p$i $([ $((i%10)) -eq 0 ] && echo 500 || echo 200)"; done > access.log

Output:

(no output)

2. Count lines.

wc -l access.log

Output:

200 access.log

3. Look at the start and the end.

head -n 3 access.log; tail -n 2 access.log

Output:

10.0.0.1 GET /p1 200
10.0.0.2 GET /p2 200
10.0.0.3 GET /p3 200
10.0.0.1 GET /p199 200
10.0.0.2 GET /p200 500

4. Count 500 errors.

grep -c ' 500$' access.log

Output:

20

5. Follow live in one terminal.

tail -F access.log

Output:

(waits)

6. In a second terminal, add a line.

echo '10.0.0.7 GET /new 200' >> ~/lab7/access.log

Output:

(first terminal shows the new line)

7. Stop with Ctrl+C and open in less at the end.

less -N +G access.log

Output:

   201 10.0.0.7 GET /new 200

15. Lab 2: Save a patch run with tee

Why do we need this?

Run a command, watch it and keep a dated log. Write a root-owned file safely.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Run and log at the same time.

uname -a 2>&1 | tee -a ~/lab7/run-$(date +%F).log

Output:

Linux web-01 6.1.0 x86_64 GNU/Linux

2. Run again and check the log grew.

uptime | tee -a ~/lab7/run-$(date +%F).log >/dev/null; wc -l ~/lab7/run-*.log

Output:

2 /home/ravi/lab7/run-2026-10-25.log

3. Try the wrong way to write a root file.

sudo echo 'hello' > /etc/lab7.conf

Output:

bash: /etc/lab7.conf: Permission denied

4. Do it the right way.

echo 'hello' | sudo tee /etc/lab7.conf

Output:

hello

5. Clean up.

sudo rm /etc/lab7.conf

Output:

(no output)

16. Frequently asked questions

17. Interview questions and answers

Beginner level

Mid level level

Senior level

18. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.