Page Through Massive Log Files with less

A multi-gigabyte log file will choke a text editor, but less opens it instantly and lets you search it clean. It also lets you follow it as it grows and quit without touching a byte of the original. The examples below use less 590, the version installed on this machine, from the less package. Budget ten minutes for the core workflow, or twenty if you want to check the environment variables too.

You need a shell and a file you are allowed to read. Nothing in the main workflow needs elevated privileges. Use sudo only when the file itself demands it, and be careful: giving a pager access to a protected file also hands its interactive shell and editor commands the same access.

1. Open a file and leave cleanly

Start with something you are allowed to read:

$ less /path/to/your/file.log

• It starts instantly. less does not read the whole file first, so even huge input opens fast.
• SPACE moves forward a window, b moves back.
• g jumps to the start, G jumps to the end.
• q quits and returns you to the shell.

2. Make less behave like a one-shot command

For scripts and quick checks, -F makes less exit automatically when the whole file fits on one screen. -X stops it initialising and clearing the terminal, handy when you want the current screen to stay put:

$ less -F -X /path/to/your/short-file.txt

Neither option edits the file. If the file is longer than one screen, less stays interactive regardless. The related -E option exits at the first end of file, while the default is to sit there until you press q.

• Use -F when you want the decision to depend on the file fitting on screen.
• Use -E when simply reaching the end is enough to close.

You can also view command output without creating a temporary file:

$ journalctl -b --no-pager | less -F -X

That pipe is ordinary shell input, not a request to change the journal. On commands that produce a lot of output, pipe buffering can grow the longer you browse. -B caps it at 64 KiB by default, but older output can then be silently discarded while you are still looking at it. Do not add -B unless that trade-off is one you have already accepted.

3. Search without losing your place

Press /, type a pattern, then ENTER to search forwards. Press ? to search backwards. less treats what you type as a regular expression, so punctuation such as ., *, [ and ] carries meaning. n repeats the search forward, N repeats it backward:

$ less /var/log/my-service.log
/ERROR
n
N

You can also start already positioned at the first match, which is a command-line instruction rather than something typed at the less prompt:

$ less +/ERROR /var/log/my-service.log

• -i makes the search case-insensitive unless the pattern contains an uppercase letter.
• -I ignores case no matter what you type.

$ less -I +/timeout /var/log/my-service.log

4. Make long lines and line numbers explicit

Source files and structured logs often run wider than your terminal, and the default is to wrap them. Use -S to chop long lines instead, then the left and right arrow keys to inspect the hidden part:

$ less -S /path/to/your/application.log

Chopping makes one screen row match one input line, but it can hide fields until you scroll sideways. Skip -S if you would rather keep the default wrapping.

Use -N when line numbers matter for reporting a location:

$ less -N /path/to/your/configuration.conf

Numbering adds work on very large input. If speed matters more than the numbers, -n switches them off. The = command shows file information, including current line and byte position where available.

5. Follow a log while it grows

Open the file at its end, then press F to keep reading as new lines land:

$ less +F /var/log/my-service.log

This behaves like tail -f. Press CTRL-C to stop waiting and get the less prompt back, then search, move around, or press F again. If the file gets replaced during rotation, plain F keeps reading the original file, not the new one. In less 590, add --follow-name when you specifically want it to reopen a replacement with the same name:

$ less --follow-name +F /var/log/my-service.log

6. Check the environment before trusting the display

less reads options from the LESS environment variable before command-line options. The command line always wins, and any option can be reset with its -+ form. Check the variable whenever a familiar invocation behaves oddly:

$ printf 'LESS=%s\n' "${LESS-}"
$ less --version
less 590 (GNU regular expressions)

Two other variables are worth knowing. LESSOPEN can run an input preprocessor before a named file is shown, and LESSCLOSE can run a postprocessor when it closes. That is handy for compressed files, but it means opening a file can execute configured commands. Use -L or --no-lessopen to ignore LESSOPEN for files opened from then on:

$ less --no-lessopen /path/to/your/file.log

Common traps

• Commands that change state. less can invoke an editor with v, run a shell command with !, pipe displayed input with |, and save piped input with s. Treat all four as deliberate, separate actions, not part of viewing.
• No undo. Anything you run through ! or an editor cannot be undone from inside less.
• -f is blunt. It forces less to open non-regular files such as devices and suppresses the binary-file warning, so do not reach for it casually.
• Untrusted text stays untrusted. Never paste log content into a shell command just because less displayed it.

If you only need to look at content, stick to navigation, search and display options. If a protected file must be read, prefer a controlled copy with the right permissions, and remove that copy through your normal data-handling process once you are done with it.