5.4 Viewing Files and Following Logs
| Command | Use |
|---|---|
cat file |
Print entire file |
less file |
Scroll page by page (Space next, b back, /word search, q quit) |
more file |
Older, simpler pager |
head -n 20 file |
First 20 lines |
tail -n 20 file |
Last 20 lines |
tail -f /var/log/nginx/access.log |
Follow a log live (Ctrl+C to stop) |
wc -l file |
Count lines (-w words, -c bytes) |
diff a b |
Show differences between two files |
cat /etc/os-release # which Linux distribution and version?
head -5 /etc/passwd
sudo tail -f /var/log/messages # Amazon Linux / CentOS system log
sudo tail -f /var/log/syslog # Ubuntu system log
Why this matters for security
tail -f on an auth or web log is the simplest real-time monitoring there is. While you practise brute force in Part 10, keep sudo tail -f /var/log/auth.log (Ubuntu) or sudo journalctl -u sshd -f (Amazon Linux 2023) open on the target – you will see the attack exactly as a SOC analyst sees it.
Ravindra Bagale's Tip
Motha log file cat kela ki screen bharun jaate aani khup students ghabartat. Motha file nehmi less kiwa tail -n 50 ne ughda. cat fakt chhotya files sathi.
Practice task
Show the first 5 and last 5 lines of /etc/passwd, count its lines with wc -l, and follow the system log live for one minute.