Efficient troubleshooting on Linux servers requires proficiency with built-in text processing utilities. Downloading large log files to a local machine for analysis is often impractical due to file size and bandwidth constraints. Instead, administrators should utilize standard command-line tools to inspect, filter, and monitor logs directly on the server.

Real-time Monitoring with Tail

The tail command is indispensable for viewing the end of a file. By default, it displays the last 10 lines of the specified file.

tail /var/log/syslog

To actively monitor system activity, the -f (follow) flag outputs appended data as the file grows, providing a real-time stream of log entries.

tail -f /var/log/syslog

Administrators can customize the output volume. For instance, to view the final 200 lines or to start reading from a specific line number:

tail -n 200 /var/log/syslog
tail -n +50 /var/log/syslog

Inspecting File Headers with Head

Conversely, the head command reads the beginning of a file. This is useful for verifying log headers or configuration parameters generated at service startup. The default output is the first 10 lines.

head /var/log/boot.log

To retrieve a specific number of lines or bytes from the start of the file:

head -n 20 /var/log/boot.log
head -c 500 /var/log/boot.log

Concatenation and Piping with Cat

The cat command dumps the entire file content to the standard output. While unsuitable for reading massive files directly, it serves as a powerful tool when combined with pipes (|) for filtering.

cat /var/log/debug.log | tail -n 20

Adding the -n parameter numbers all output lines, which assists in referencing specific log entries during analysis.

cat -n /var/log/debug.log | head -n 10

Navigating Large Files with Less and More

For log files spanning gigabytes, less is often preferred over cat because it loads content incrementally without reading the entire file into memory. It supports bidirectional scrolling using arrow keys.

less /var/log/large_app.log

The more command is an older pager that primarily allows forward navigation through a file.

more /var/log/large_app.log

Both tools support navigation flags. For example, you can instruct less to start displaying content from a specific line or search pattern immediately upon opening.

less +100 /var/log/large_app.log
less +/ERROR /var/log/large_app.log

Pattern Searching within Files

When analyzing logs inside a viewer like less or the vi editor, specific keywords can be located rapidly. Inside the viewer, typing a forward slash / followed by a keyword (e.g., /Exception) initiates a forward search. The n key navigates to the next match, while N returns to the previous one. This approach allows for rapid diagnostics without transferring files off the server.