less is a pager. It shows a file one screen at a time and lets you scroll, search and jump around without loading the whole file into memory. That makes it the right tool for large logs and SQL dumps, where cat would flood the terminal and an editor might choke.

less /var/log/syslog
journalctl -u nginx | less

Many commands already use less as their pager: man, git log, journalctl and systemctl status.

Moving around

Key Action
Space / f Next page
b Previous page
↓ / j / Enter Down one line
↑ / k Up one line
d / u Down / up half a page
g / < Start of file
G / > End of file
50g Go to line 50
50p Go to 50% of the file
q Quit
h Help with every key

Searching

Key Action
/pattern Search forward (regular expressions allowed)
?pattern Search backward
n / N Next / previous match
&pattern Show only lines matching the pattern (filter)
& then Enter Clear the filter
ESC u Toggle search highlighting

The & filter is very handy in logs. Type &error to see just error lines, with the rest of the file still there when you clear it. Prefix the pattern with ! to exclude lines: &!healthcheck.

Searches are case-sensitive unless you start less with -i (smart case: case-insensitive unless the pattern contains capitals) or type -i inside less to toggle it.

Follow a growing file

Press F to follow the end of the file, like tail -f. Press Ctrl+C to stop following and you’re back in normal mode, free to scroll and search the history. Press F again to resume.

Start in follow mode directly:

less +F /var/log/nginx/access.log

Compared with tail -f, you can stop at any moment to look back. See head and tail.

Useful start-up options

less -N file          # show line numbers
less -S file          # chop long lines instead of wrapping (scroll sideways with ← →)
less -R file          # show coloured output correctly
less -X file          # leave the content on screen after quitting
less -F file          # quit immediately if the content fits on one screen
less +/pattern file   # open at the first match
less +G file          # open at the end

-S is great for wide logs and CSV files. -R is needed for coloured output, as in grep --color=always error log | less -R.

Set defaults in an environment variable, for example in ~/.bashrc:

export LESS='-iRS'

Several files

less /var/log/nginx/access.log /var/log/nginx/error.log

Type :n for the next file and :p for the previous one.

Compressed files

On most distributions, less opens .gz files directly through lesspipe. If yours doesn’t:

zless /var/log/syslog.2.gz
xzless file.xz

Mark and return

Type ma to set a mark called a at the current position. Later, type 'a to jump back to it. This is useful when you’re comparing two parts of a long file.

Open the file in an editor

Press v to open the current file in $EDITOR (vim, nano…) at the current line. Close the editor to return to less.

less vs more vs most

more is older and more limited. In some versions it can’t scroll backwards well. less does everything more does and more (“less is more”). Unless a system lacks less, there’s no reason to use more.

Quick reference

Task Keys / command
Search /text, then n / N
Show matching lines only &text
Follow F (Ctrl+C to stop)
Start / end g / G
Line numbers less -N or -N inside less
Don’t wrap less -S
Colours less -R
Quit q

Related: cat and grep.

  • Linux
  • Command Line
  • Logs