This document provides 10 examples for viewing huge log files in Unix systems. The examples demonstrate how to use commands like sed, head, tail, and grep to view specific lines, ranges of lines, growing logs in real-time, and search for patterns within logs. Commands like head and tail can display the first or last few lines, while sed, head, and tail together can view a range of lines. Grep can search for patterns and show matching lines plus surrounding context.

1. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
Home
About
Free
eBook
Archives
Best
of
the
Blog
Contact
10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix
by
Ramesh
Natarajan
on
August
12,
2009
10 Like 7 Tweet 25
Viewing
huge
log
files
for
trouble
shooEng
is
a
mundane
rouEne
tasks
for
sysadmins
and
programmers.
In
this
arEcle,
let
us
review
how
to
effecEvely
view
and
manipulate
huge
log
files
using
10
awesome
examples.
Example
1:
Display
specific
lines
(based
on
line
number)
of
a
file
using
sed
command
View
only
the
specific
lines
menEoned
by
line
numbers.
Syntax: $ sed -n -e Xp -e Yp FILENAME
sed
:
sed
command,
which
will
print
all
the
lines
by
default.
-­‐n
:
Suppresses
output.
-­‐e
CMD
:
Command
to
be
executed
Xp:
Print
line
number
X
Yp:
Print
line
number
Y
FILENAME
:
name
of
the
file
to
be
processed.
1
of
10 18
Apr
12
7:30
pm

2. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
The
example
menEoned
below
will
print
the
lines
120,
145,
1050
from
the
syslog.
$ sed -n -e 120p -e 145p -e 1050p /var/log/syslog
In
the
following
example,
you
can
view
the
content
of
var/log/cron
from
line
number
101
to
110.
M
–
StarEng
line
number
N
–
Ending
line
number
Syntax: sed -n M,Np FILENAME
$ sed -n 101,110p /var/log/cron
Example
2:
Display
first
N
lines
of
a
file
using
head
command
This
example
displays
only
first
15
lines
of
/var/log/maillog
file.
Change
15
to
10
to
display
the
first
10
lines
of
a
log
file.
Syntax: head -n N FILENAME
$ head -n 15 /var/log/maillog
Example
3:
Ignore
last
N
lines
of
a
file
using
head
command
This
example
shows
how
to
ignore
the
last
N
lines,
and
show
only
the
remaining
lines
from
the
top
of
file.
The
following
example
will
display
all
the
lines
of
the
/var/log/secure
except
the
last
250
lines.
Syntax: head -n -N FILENAME
$ head -n -250 /var/log/secure
Example
4:
Display
last
N
lines
of
the
file
using
tail
command
This
example
displays
only
last
50
lines
of
/var/log/messages
file.
Change
50
to
100
to
display
the
last
100
lines
of
the
log
file.
Syntax: tail -n N FILENAME
$ tail -n 50 /var/log/messages
Example
5:
Ignore
first
N-­‐1
lines
of
the
file
using
tail
command
This
example
shows
how
to
ignore
the
first
N-­‐1
lines
and
show
only
the
remaining
of
the
lines.
The
following
example
ignores
the
1st
four
lines
of
the
/etc/xinetd.conf,
which
contains
only
the
comments.
Syntax: tail -n +N FILENAME
$ tail -n +5 /etc/xinetd.conf
defaults
{
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
cps = 25 30
}
includedir /etc/xinetd.d
Example
6:
View
growing
log
file
in
real
Mme
using
tail
command
2
of
10 18
Apr
12
7:30
pm

3. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
This
is
probably
one
of
the
most
used
command
by
sysadmins.To
view
a
growing
log
file
and
see
only
the
newer
contents
use
tail
-­‐f
as
shown
below.
The
following
example
shows
the
content
of
the
/var/log/syslog
command
in
real-­‐Eme.
Syntax: tail -f FILENAME
$ tail -f /var/log/syslog
Example
7:
Display
specific
lines
(based
on
line
number)
of
a
file
using
head
and
tail
command
The
example
below
will
display
line
numbers
101
–
110
of
/var/log/anaconda.log
file
M
–
StarEng
line
number
N
–
Ending
line
number
Syntax: cat file | tail -n +N | head -n (M-N+1)
$ cat /var/log/anaconda.log | tail -n +101 | head -n 10
cat
:
prints
the
whole
file
to
the
stdout.
tail
-­‐n
+101
:
ignores
lines
upto
the
given
line
number,
and
then
start
prinEng
lines
aaer
the
given
number.
head
-­‐n
10
:
prints
the
first
10
line,
that
is
101
to
110
and
ignores
the
remaining
lines.
Example
8:
Display
lines
matching
a
paPern,
and
few
lines
following
the
match.
The
following
example
displays
the
line
that
matches
“IniEalizing
CPU”
from
the
/var/log/dmesg
and
5
lines
immediately
aaer
this
match.
# grep "Initializing CPU#1" /var/log/dmesg
Initializing CPU#1
[Note: The above shows only the line matching the pattern]
# grep -A 5 "Initializing CPU#1" dmesg
Initializing CPU#1
Calibrating delay using timer specific routine.. 3989.96 BogoMIPS (lpj=1994982)
CPU: After generic identify, caps: bfebfbff 20100000 00000000 00000000
CPU: After vendor identify, caps: bfebfbff 20100000 00000000 00000000
monitor/mwait feature present.
CPU: L1 I cache: 32K, L1 D cache: 32K
[Note: The above shows the line and 5 lines after the pattern matching]
Refer
our
earlier
arEcle
Get
a
Grip
on
the
Grep!
–
15
PracEcal
Grep
Command
Examples
that
explains
how
to
use
grep
command.
As
explained
in
our
previous
grep
command
arEcle,
the
following
operaEons
are
possible.
Viewing
specific
lines
idenEfied
by
paWerns,
which
is
grep’s
default
funcEonality.
Viewing
only
the
matched
characters.
Viewing
N
lines
aaer
the
match
with
-­‐A
opEon.
Viewing
N
lines
before
the
match
with
-­‐B
opEon.
Viewing
N
lines
around
the
match
with
-­‐C
opEon.
Example
9:
Displaying
specific
bytes
from
a
file.
The
following
example
explains
how
to
display
either
the
top
40
or
the
last
30
bytes
of
a
file.
Display
first
40
bytes
from
syslog.
3
of
10 18
Apr
12
7:30
pm

4. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
$ head -c40 /var/log/syslog
Display
last
30
bytes
from
syslog.
$ tail -c30 /var/log/syslog
Example
10:
Viewing
compressed
log
files
Aaer
a
specific
Eme
all
the
system
log
files
are
rotated,
and
compressed.
You
can
uncompress
it
on
the
fly,
and
pipe
the
output
to
another
unix
command
to
view
the
file
as
explained
below.
Refer
to
our
earlier
arEcle
The
Power
of
Z
Commands
–
Zcat,
Zless,
Zgrep,
Zdiff
Examples
Display
the
first
N
lines
of
a
compressed
file.
$ zcat file.gz | head -250
Display
the
last
N
lines
of
a
compressed
file.
$ zcat file.gz | tail -250
Ignoring
the
last
N
lines
of
a
compressed
file.
$ zcat file.gz | head -n -250
Ignoring
the
first
N
lines
of
a
compressed
file.
$ zcat file.gz | tail -n +250
Viewing
the
lines
matching
the
paWern
$ zcat file.gz | grep -A2 'error'
Viewing
parEcular
range
of
lines
idenEfied
by
line
number.
$ zcat file.gz | sed -n -e 45p -e 52p
If
you
need
to
return,
bookmark
this
page
at
del.icio.us
for
handy
reference.
10 Tweet 25 Like 7
Share
Comment
If
you
enjoyed
this
arMcle,
you
might
also
like..
1. 50
Linux
Sysadmin
Tutorials
Awk
IntroducEon
–
7
Awk
Print
Examples
2. 50
Most
Frequently
Used
Linux
Commands
(With
Examples)
Advanced
Sed
SubsEtuEon
Examples
3. Top
25
Best
Linux
Performance
Monitoring
and
Debugging
8
EssenEal
Vim
Editor
NavigaEon
Fundamentals
Tools
25
Most
Frequently
Used
Linux
IPTables
Rules
4. Mommy,
I
found
it!
–
15
PracEcal
Linux
Find
Command
Examples
Examples
Turbocharge
PuTTY
with
12
Powerful
Add-­‐Ons
5. Linux
101
Hacks
2nd
EdiEon
eBook
4
of
10 18
Apr
12
7:30
pm

5. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
Tags:
Linux
Log
File
ManipulaEon,
Manage
Large
Unix
Log
Files,
View
Big
Linux
Files,
View
ParEal
Unix
Log
Files
{
15
comments…
read
them
below
or
add
one
}
1
Robert
Fisher
August
12,
2009
at
1:22
am
I
have
used
example
8
many
Emes
looking
for
a
response
to
a
specific
error.
I
have
also
used
the
tail
and
head
commands
as
well,
never
really
got
into
sed
so
much,
but
that
example
was
a
good
one.
Thanks
for
posEng
this
informaEon.
2
Nico
August
12,
2009
at
2:23
am
FYI:
Later
versions
of
less(1)
also
displays
.gz
files.
3
Nico
August
12,
2009
at
2:26
am
O
–
and
before
I
forget…
You
can
combine
some
of
the
soluEons,
for
example
combine
#6
and
#8:
$
tail
-­‐f
/some/file
|
grep
keyword
This
will
give
you
only
the
lines
containing
the
keyword
as
it
gets
logged.
4
Nicholas
Sterling
August
12,
2009
at
2:40
am
How
about
sed
-­‐n
300,350p
foo.log
Edit:
oops
—
how
embarrassing.
You
covered
it
and
I
missed
it
somehow.
5
Ashish
August
12,
2009
at
5:12
am
Great
post,
very
useful
arEcle.
6
Ronald
August
12,
2009
at
8:45
am
The
“sed
-­‐n
101,110p
/var/log/cron”
approach
is
really
useful.
Although
I
have
to
say
that
I
wouldn’t
have
come
up
with
that
command
when
looking
at
the
sed-­‐manual….
Sed:
-­‐n,
–quiet,
–silent
suppress
automaEc
prinEng
of
paWern
space
p
Print
the
current
paWern
space.
7
Koen
De
Jaeger
August
13,
2009
at
9:27
am
5
of
10 18
Apr
12
7:30
pm

6. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
Very
nice!
8
Ramesh
Natarajan
August
14,
2009
at
8:56
am
@Robert,
Sed
can
do
lot
of
amazing
things.
But
it
is
hard
to
remember
those
on
top
of
your
head.
I
have
close
to
100
sed
command
that
solves
some
common
problem
in
a
notebook,
which
I
copy/paste
whenever
nedded.
Example
1
of
this
arEcle
is
in
that
list.
@Nico,
Thanks
for
poinEng
that
out.
Most
of
us
forget
that
grep
can
be
combined
with
“tail
-­‐f ”.
This
indeed
can
be
very
handy.
@Nicholas,
Don’t
worry.
I’ve
done
similar
mistakes
several
Emes.
So,
I
can
related
to
it.
@Ashish,
@Koen
I’m
very
glad
that
you
found
this
arEcle
helpful.
@Ronald,
Yeah.
That
is
the
beauty
of
Unix.
We
can
do
amazing
things
with
linux
commands
that
were
not
even
clearly
menEoned
in
the
manual.
This
is
also
the
reason
Windows
admins
don’t
like
Linux,
as
they
hate
reading
manuals.
Even
when
they
read
the
manuals,
it
is
not
really
explained
very
well.
9
ShekarKCB
August
24,
2009
at
5:13
am
Nice
ArEcle,
uses
of
head,
tail,
and
sed
were
nicely
covered.
Thanks
for
the
same.
10
Ted
September
13,
2009
at
12:06
am
The
sed
Ep
I
will
use
for
sure
and
I
also
like
the
tail
-­‐f
|grep.
Thank
you
Ramesh.
Any
chance
you
will
be
posEng
your
most
useful
sed
commands
from
your
note
book
at
some
Eme?
11
Bipin
May
6,
2010
at
5:49
am
Great
stuffs.
Thanks
for
sharing.
12
Brad
July
14,
2010
at
8:49
am
You
showed
zcat,
but
there
is
also
bzcat
and
lzcat,
and
probably
a
few
others.
so
if
you
have
a
file
that
is
bzip2ʹ′d
or
lzma’d,
then
you
can
use
bzcat
and
lzcat
respecEvely
to
display
them.
Also,
it
can
be
piped
to
the
less
command
so
it
can
be
scrolled
across
the
terminal.
13
anton
August
6,
2010
at
3:24
am
Is
the
following
any
beWer
(i.e.
more
efficient)
than
zcat
logfile.gz
|
tail
???
#
emulate
ztail
???
zless
+F
logfile.gz
14
logan
February
21,
2011
at
12:11
am
or
you
can
always
use
6
of
10 18
Apr
12
7:30
pm

7. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
cat
logfile
|
less
which
lets
you
scroll
through
it
OR
cat
logfile
|
less
|
grep
“PATTERN”
which
lets
you
scroll
through
matching
entries
I
search
for
sshd
for
my
auth.log
file
and
can
see
all
and
only
the
ssh
server
entries
15
ks
March
2,
2011
at
5:45
pm
A
nice
and
handy
tutorial.
A
few
comments
about
the
above
comment
by
@logan:
$
cat
logfile
|
less
has
the
same
effect
as
$
less
logfile
and
hence
the
use
of
the
pipe
is
redundant
(‘$’
stands
for
the
command
prompt).
Both
lets
you
scroll
through
the
logfile
and
search
for
paWern
using
‘/’
and
‘?’
(similar
to
vim).
However,
the
second
$
cat
logfile
|
less
|
grep
“PATTERN”
does
not
let
you
scroll,
but
the
following
$
grep
“PATTERN”
logfile
|
less
will
—
through
only
the
the
lines
that
has
the
matching
paWern
“PATTERN”.
Leave
a
Comment
Name
E-­‐mail
Website
NoEfy
me
of
followup
comments
via
e-­‐mail
Submit
Previous
post:
Google
Next-­‐GeneraEon
Search
Engine
is
Already
Here
For
You
Next
post:
Ubuntu
Tips:
How
To
Setup
Dual
Monitor
7
of
10 18
Apr
12
7:30
pm

8. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
Sign
up
for
our
free
email
newsleWer
you@address.com
Sign Up
RSS
TwiWer
Facebook
Search
EBOOKS
8
of
10 18
Apr
12
7:30
pm

9. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
POPULAR
POSTS
12
Amazing
and
EssenEal
Linux
Books
To
Enrich
Your
Brain
and
Library
50
UNIX
/
Linux
Sysadmin
Tutorials
50
Most
Frequently
Used
UNIX
/
Linux
Commands
(With
Examples)
How
To
Be
ProducEve
and
Get
Things
Done
Using
GTD
30
Things
To
Do
When
you
are
Bored
and
have
a
Computer
Linux
Directory
Structure
(File
System
Structure)
Explained
with
Examples
Linux
Crontab:
15
Awesome
Cron
Job
Examples
Get
a
Grip
on
the
Grep!
–
15
PracEcal
Grep
Command
Examples
Unix
LS
Command:
15
PracEcal
Examples
15
Examples
To
Master
Linux
Command
Line
History
Top
10
Open
Source
Bug
Tracking
System
Vi
and
Vim
Macro
Tutorial:
How
To
Record
and
Play
Mommy,
I
found
it!
-­‐-­‐
15
PracEcal
Linux
Find
Command
Examples
15
Awesome
Gmail
Tips
and
Tricks
15
Awesome
Google
Search
Tips
and
Tricks
RAID
0,
RAID
1,
RAID
5,
RAID
10
Explained
with
Diagrams
Can
You
Top
This?
15
PracEcal
Linux
Top
Command
Examples
Top
5
Best
System
Monitoring
Tools
Top
5
Best
Linux
OS
DistribuEons
How
To
Monitor
Remote
Linux
Host
using
Nagios
3.0
Awk
IntroducEon
Tutorial
–
7
Awk
Print
Examples
How
to
Backup
Linux?
15
rsync
Command
Examples
The
UlEmate
Wget
Download
Guide
With
15
Awesome
Examples
Top
5
Best
Linux
Text
Editors
Packet
Analyzer:
15
TCPDUMP
Command
Examples
The
UlEmate
Bash
Array
Tutorial
with
15
Examples
3
Steps
to
Perform
SSH
Login
Without
Password
Using
ssh-­‐keygen
&
ssh-­‐copy-­‐id
Unix
Sed
Tutorial:
Advanced
Sed
SubsEtuEon
Examples
UNIX
/
Linux:
10
Netstat
Command
Examples
The
UlEmate
Guide
for
CreaEng
Strong
Passwords
6
Steps
to
Secure
Your
Home
Wireless
Network
Turbocharge
PuTTY
with
12
Powerful
Add-­‐Ons
About
The
Geek
Stuff
My
name
is
Ramesh
Natarajan.
I
will
be
posEng
instrucEon
guides,
how-­‐to,
troubleshooEng
Eps
and
tricks
on
Linux,
database,
hardware,
security
and
web.
My
focus
is
to
write
arEcles
that
will
either
teach
you
or
help
you
resolve
a
9
of
10 18
Apr
12
7:30
pm

10. 10
Awesome
Examples
for
Viewing
Huge
Log
Files
in
Unix hWp://www.thegeekstuff.com/2009/08/10-­‐awesome-­‐examples...
problem.
Read
more
about
Ramesh
Natarajan
and
the
blog.
Support
Us
Support
this
blog
by
purchasing
one
of
my
ebooks.
Bash
101
Hacks
eBook
Sed
and
Awk
101
Hacks
eBook
Vim
101
Hacks
eBook
Nagios
Core
3
eBook
Contact
Us
Email
Me
:
Use
this
Contact
Form
to
get
in
touch
me
with
your
comments,
quesEons
or
suggesEons
about
this
site.
You
can
also
simply
drop
me
a
line
to
say
hello!.
Follow
us
on
TwiWer
Become
a
fan
on
Facebook
Copyright
©
2008–2012
Ramesh
Natarajan.
All
rights
reserved
|
Terms
of
Service
|
AdverEse
10
of
10 18
Apr
12
7:30
pm