More is a *nix command line used to display the contents of a file in a console. The basic usage of more command is to run the command against a file as shown below:
Read Also: Learn Difference Between ‘cat’ and ‘tac’ Commands with Examples
Learn Linux ‘more’ Command
# more /var/log/auth.log
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root Apr 12 12:05:02 tecmint CRON[7435]: pam_unix(cron:session): session closed for user root Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root ....
Another way to use more command in conjunction (pipe) with other commands, such as cat command, as presented on below example:
# cat /var/log/auth.log | more
In order to navigate through the file line by line press Enter key or press Spacebar key to navigate one page at a time, the page being your current terminal screen size. To exit the command just press q key.
A useful option of more command is the -number switch which allows you to set the number of line a page should contain. As an example display the auth.log file as a page of 10 lines:
# more -10 /var/log/auth.log
Also, you can display a page starting from a specific line number using the +number option as illustrated below:
# more +14 /var/log/auth.log
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root Apr 12 12:16:01 tecmint mate-screensaver-dialog: gkr-pam: unlocked login keyring Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session closed for user root Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session closed for user root Apr 12 12:25:01 tecmint CRON[8107]: pam_unix(cron:session): session opened for user root by ( uid=0) Apr 12 12:25:01 tecmint CRON[8108]: pam_unix(cron:session): session opened for user root by (
Learn Linux ‘less’ Command
Similar to more, less command allows you to view the contents of a file and navigate through file. The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.
In can be used as a standalone command issued against a file or used with pipes with a multitude of Linux commands in order to narrow their screen output allowing you to scroll through results.
# less /var/log/auth.log # ls /etc | less
You can navigate through the file line by line pressing Enter key. Page navigation can be handled with spacebar key. The page size is represented by your current terminal screen size. To exit command type q key, same way as for more command.
A useful feature of less command is the use of /word-to-seach option. For instance you can search and match all sshd messages from a log file by interactively specifying the /sshd string.
In order to display a file staring at a specific line number use the following syntax:
# less +5 /var/log/auth.log
If you need to track down the number of every line with less command use the -N option.
# less -N /var/log/daemon.log
1 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
2 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
3 Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
4 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
5 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
6 Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
7 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
8 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
9 Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
10 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
11 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root
By default the only way to exit less command is to hit q key. To change this behavior and automatically exit file when reaching the end of file use the -e or -E option:
# less -e /var/log/auth.log # less -E /var/log/auth.log
To open a file at the first occurrence of a pattern use the following syntax:
# less +/sshd /var/log/auth.log
Apr 12 16:19:39 tecmint sshd[16666]: Accepted password for tecmint from 192.168.0.15 port 41634 ssh2 Apr 12 16:19:39 tecmint sshd[16666]: pam_unix(sshd:session): session opened for user tecmint by (uid=0) Apr 12 16:19:39 tecmint systemd-logind[954]: New session 1 of user tecmint. Apr 12 16:19:48 tecmint sshd[16728]: Received disconnect from 192.168.0.15: 11: disconnected by user Apr 12 16:19:48 tecmint sshd[16666]: pam_unix(sshd:session): session closed for user tecmint Apr 12 16:20:01 tecmint CRON[16799]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 16:20:02 tecmint CRON[16799]: pam_unix(cron:session): session closed for user root Apr 12 16:25:01 tecmint CRON[17026]: pam_unix(cron:session): session opened for user root by (uid=0) Apr 12 16:25:01 tecmint CRON[17025]: pam_unix(cron:session): session opened for user root by (uid=0)
The above command tells less to open auth.log file at the first match of sshd string.
In order to automatically append the content of a file opened in less command use the Shift+f keys combination or run less with the following syntax.
# less +F /var/log/syslog
This makes less to run in interactive mode (live) and display new content on-fly while waiting for new data to be written to file. This behavior is similar to tail -f command.
In combination with a pattern you can watch the log file interactively with Shift+f key stroke while matching a keyword. To exit live mode just press Ctrl+c keys.
# less +/CRON /var/log/syslog
Whether you decide to use more or less, which is a personal choice, remember that less is more with more features.
Read Also: Manage Files Effectively Using head, tail and cat Commands
Great high-level review of the ‘less‘ command. I have not used ‘less‘ in a while and – after reading this I am planning to use it much more. (pun intended).
Thanks for the comments afterward. It is nice to get a different perspective from other users!
And then there is “most”.
One of the things I like about
lesscommand is that you can jump to the bottom of a file by typing an uppercase"G"— and just as quickly jump to the beginning of the file by typing a lowercase"g". Combined with the-Noption, it gives you a quick, interactive means of inspecting the contents of a file and counting lines.There are about a million commands you can use in
less… typing a lowercase"h"in-program will display a lengthy help file.@Thomlandin,
Thanks for sharing the tips about Linux
lesscommand, hope users will find it useful and yes, me too likeslesscommand and as articles states, yes its quicker thanmorecommand..A little mistake at the beginning of 4th line under “Learn Linux ‘less’ Command”
It is not true that “The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.”
Not loading the entire file is the primary reason more was created, so that a file could be quickly viewed with more instead of waiting for it to load in an editor. There may be ancient versions of more around which don’t support navigating back up the file, but POSIX standard versions of more do support it.
While it’s true that “less is more with more features”, most of the extra features you describe for less in this article are actually also present in (modern versions of) more.