LINUX · COMMAND LINE

How to read a file with cat, less, tail, and head

21 October 2026 · 6 minute read

You can list the files in a directory, but reading one is a different skill. The first time you run cat on a config file that's three hundred lines long, the whole thing floods your terminal and you're left scrolling. The first time you run tail on a log, you see the last ten lines and miss the error that happened an hour ago. The fix is not one command. It's four, and each one is for a different shape of problem. cat for the short file, less for the long one, tail for the end and the live log, and head for the start.

The short answer. To read a file on Linux, run cat to print it all, less to page through it, and tail and head to see the end or the start. Use tail -f to follow a log as it grows. Pick the one that matches the file's size and what you need.

cat prints the whole file

cat is the simplest of the three. It reads a file and prints every line to the terminal, top to bottom, with no paging. It's the right tool when the file is short enough to fit on your screen and you want to see all of it at once.

$ cat notes.txt
deploy the new image
check the disk on node-3
review the Cilium policy

That's it. The whole file, printed. For a short config or a quick note, cat is all you need. The name comes from concatenate, because its original job was joining files together, and printing one file is the simplest case of that.

The problem shows up the moment the file is long. Run cat on a three hundred line config and the output scrolls past faster than you can read, leaving only the last screenful visible. That's not a bug in cat. It's the wrong tool for a long file.

less pages through a long file

less is the answer to the long file. It opens the file one screen at a time, so you read at your own pace instead of watching it scroll past.

$ less /etc/nginx/nginx.conf

This opens the file in a pager. The first screenful shows, and you control what happens next.

Space bar pages down one screen.
b pages up one screen.
f pages forward one screen, the same as the space bar.
/ searches within the file, then n jumps to the next match and N to the previous one.
q quits and returns to your shell.

That's the whole workflow. Open, page, search, quit. Once you know these keys, less handles any file you'll ever throw at it, from a config to a multi-thousand line log.

One thing worth knowing. less is the modern replacement for more, the original pager. The name is a joke, less is more. On any modern Linux box, less is what you get, and it's the one to use.

tail shows the end

tail does the opposite of what you'd expect from the name. It doesn't show the tail of the file in the sense of the last bit. It shows the last ten lines by default, which is where the interesting stuff usually is. Logs write to the end, so the newest entries are always at the bottom.

$ tail /var/log/syslog
Oct 24 09:00:01 node-3 systemd[1]: Started Daily apt download.
Oct 24 09:00:01 node-3 systemd[1]: Started Daily apt upgrade.
Oct 24 09:00:02 node-3 kernel: [12345.678] eth0: link up

Ten lines, the end of the file. This is the command you reach for when you want to know what just happened without reading the whole log.

Control the count with -n.

$ tail -n 50 /var/log/syslog

That prints the last fifty lines. Any number works. When you're debugging and need more context than ten lines, this is the flag.

The real power is -f, for follow. It doesn't just print the end and stop. It keeps watching the file and prints new lines as they're written.

$ tail -f /var/log/syslog

This is the command for watching a log live. A deploy runs, a service restarts, an error fires, and each new line appears the moment it's written. Press Ctrl+C to stop. On the Kubernetes nodes I run, tail -f on the kubelet log is how I watch a node misbehave in real time instead of guessing from a snapshot.

The -f idea is the same one behind every tool that tails logs for you. kubectl logs -f is the Kubernetes version, watching a pod's logs the same way tail -f watches a file.

$ kubectl logs -f my-pod

And docker logs -f does it for a container.

$ docker logs -f my-container

When you switch to a tool like k9s and hit the log view on a pod, what it's doing under the hood is exactly this, following a log stream and printing new lines as they arrive. Learn tail -f once and the pattern shows up everywhere, from a single file on a box to every pod in a cluster.

head shows the start

head is the mirror of tail. Where tail shows the end, head shows the start, the first ten lines by default. It's the command you reach for when you want the top of a file, the config heading, the first error in a log, without reading the whole thing.

$ head /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
        worker_connections 768;

Ten lines, the start of the file. Same counter as tail, and the same -n flag controls it.

$ head -n 20 /etc/nginx/nginx.conf

That prints the first twenty lines. The practical pairing is head and tail together. Need the first error and the last one? head -n 50 for the top, tail -n 50 for the bottom, and you've bracketed the whole story of a file in two commands.

Which one to use, at a glance

Here is the whole decision in one table. Match the file's size and what you need to the command.

Command	What it does	Reach for it when
`cat file`	Prints the whole file	The file is short and you want it all at once
`less file`	Pages through one screen at a time	The file is long and you want to read it
`tail file`	Prints the last ten lines	You want the end of a log or file
`tail -n 50 file`	Prints the last fifty lines	You need more context than ten lines
`tail -f file`	Follows the file as it grows	You want to watch a log live
`head file`	Prints the first ten lines	You want the start of a file
`head -n 20 file`	Prints the first twenty lines	You need the top of a file

Verify it works

Run these and check the output against what you expect.

$ cat notes.txt
$ less /etc/hostname
$ head /etc/hostname
$ tail /var/log/syslog
$ tail -f /var/log/syslog

cat prints the whole file. less opens it in a pager, so press q to get back. head shows the first ten lines. tail shows the last ten. tail -f follows live, so press Ctrl+C to stop. If each one behaves as described, you've got it.

The honest caveat

There's one more way to read a file that matters. grep searches inside files and prints only the matching lines, which is the right move when you know what you're looking for instead of wanting to read the whole thing. And cat has flags like -n for line numbers. You don't need either to be productive. The four here, cat, less, tail, and head, cover the real work. The rest you'll pick up when a specific problem asks for it.

There are also tools you can install that aren't there by default. One popular example is bat, a cat clone with syntax highlighting, line numbers, and git integration built in. It's not on the base system, so you install it through your package manager or, on macOS, Homebrew. Nice to have, but none of that requires it.

One thing worth knowing. cat and tail are part of GNU coreutils, and less is its own program. All three behave the same on every Linux box you'll touch. Learn them once and they follow you.

The boring conclusion

Reading a file is four commands, not one, because files come in four shapes. Short ones you print with cat. Long ones you page through with less. Logs you watch from the end with tail, and tail -f when they're still being written, and head when you want the start. None of it is hard. It's just matching the tool to the shape of the problem.

What's the file you read every day that you still reach for the wrong command on?

Frequently asked questions

What is the difference between cat, less, and tail?

cat prints the whole file to the terminal at once. less opens the file one screen at a time so you can page through it. tail prints the last ten lines, and tail -f follows a file as it grows. head prints the first ten lines, the mirror of tail. Use cat for short files, less for long ones, and tail or head for the end or the start.

How do I read a file in Linux?

Run cat filename to print the whole file, less filename to page through it, or tail filename to see the last ten lines. For a file that grows, like a log, use tail -f filename to follow it live.

How do I exit less?

Press q to quit less. The space bar pages down, b pages up, and / searches within the file.

How do I follow a log file as it grows?

Run tail -f /var/log/syslog to follow a log file live, printing new lines as they are written. Press Ctrl+C to stop.

How do I see more than ten lines with tail?

Run tail -n 50 filename to print the last 50 lines instead of the default ten. The -n flag takes any number.

What does head do in Linux?

head prints the first ten lines of a file by default. It is the mirror of tail, which prints the last ten lines. Use head -n 20 to print the first twenty lines.

Resources

Two references cover everything in this article and the flags I left out. Both are the primary sources, so what you read here matches what the tools actually do.

GNU coreutils manual, cat invocation. The authoritative reference for cat and tail, straight from the project that ships them.
less(1) man page. The full key list and options for the pager, the same text you get from man less.

This builds on how to list files in a directory. Next up is checking the last 20 lines of a file, which uses tail and head together.