Introduction

Unlock the full potential of your Linux command line proficiency! While cat, head, and tail might seem like basic tools, mastering their advanced features can drastically boost your efficiency in Linux system administration and log file analysis. This guide delves into the often-overlooked capabilities of these fundamental Linux command line tools, showing you how to quickly inspect files, monitor real-time logs, and even debug hidden characters without ever opening a text editor. Stop wasting time scrolling and start slicing through data with precision.

Mastering Essential Linux File Commands for System Administration

Every Linux system—be it a cloud VM, a bare-metal server, or a container—generates countless files: configuration files, log files, CSV exports, and deployment outputs. Efficiently reading and inspecting these files from the command line, without resorting to complex scripts, is a fundamental and often underrated skill. This guide explores the powerful, yet simple, head, tail, and cat commands, available on every Linux distribution and integral to effective Bash scripting efficiency.

All examples in this guide are tested on Ubuntu 26.04. Where behavior differs on RHEL 9 / Rocky Linux 9, both variants are shown.

Prerequisites: Basic familiarity with the Linux terminal and navigating the filesystem. No root access is required for most examples; sudo is noted where needed.

The head Command: Efficiently Previewing File Contents

The head command prints the first 10 lines of a file by default. It’s an indispensable tool for quickly checking a file’s format, headers, or initial entries, saving you the overhead of opening an editor.

The basic syntax of the head command is:
head [options] [file(s)]


View the First 10 Lines of a File

head /etc/passwd

Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin

View a Specific Number of Lines

Use -n to control how many lines head displays. Both forms below are equivalent:

head -n 5 /var/log/syslog
head -5 /var/log/syslog

Output:

026-08-18T05:06:36.715382+05:30 pro systemd[1]: rsyslog.service: Sent signal SIGHUP to main process 910 (rsyslogd) on client request.
2026-08-18T05:06:36.715534+05:30 pro rsyslogd: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="910" x-info=" rsyslogd was HUPed
2026-08-18T05:06:36.719902+05:30 pro systemd[1]: logrotate.service: Deactivated successfully.
2026-08-18T05:06:36.720006+05:30 pro systemd[1]: Finished logrotate.service – Rotate log files.
2026-08-18T05:06:36.744453+05:30 pro systemd[1]: Finished libvirt-guests.service – libvirt guests suspend/resume service.

View Multiple Files at Once

You can pass multiple files to head. It adds a header before each file’s output for clarity:

head -5 /etc/passwd /etc/group

Output:

==> /etc/passwd <==
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

==> /etc/group <==
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog,ravi

View a Specific Number of Bytes

Use -c to limit the output by bytes instead of lines. This is useful for inspecting the very beginning of a file or verifying its initial byte sequence:

head -c 50 /var/log/syslog

Output:

2026-08-18T05:06:36.715382+05:30 pro systemd[1]

Skip the Last N Lines

Here’s a powerful GNU head feature: -n -N prints everything except the last N lines. This is incredibly useful for removing footer rows from a CSV file or ignoring trailing summary lines in a log:

head -n -5 access.log

This flag alone can save considerable time and effort in data processing tasks.

The tail Command: Real-time Log Monitoring and Analysis

The tail command prints the last 10 lines of a file by default. It’s particularly useful for checking recent output from large files and is a cornerstone for log file analysis as files are updated in real time.

The basic syntax of the tail command is:
tail [options] [file(s)]


View the Last 10 Lines of a File

tail /var/log/syslog

Output:

2026-08-24T15:54:56.280058+05:30 pro dbus-daemon[1726]: [session uid=1000 pid=1726] Successfully activated service ‘org.xfce.Xfconf’
2026-08-24T15:55:01.529373+05:30 pro CRON[17986]: (ravi) CMD (echo "Cron is working!" >> /home/ravi/cron-test.log)
2026-08-24T15:56:14.729059+05:30 pro systemd[1]: Starting man-db.service – Daily man-db regeneration…
2026-08-24T15:56:15.032277+05:30 pro systemd[1]: man-db.service: Deactivated successfully.
2026-08-24T15:56:15.032440+05:30 pro systemd[1]: Finished man-db.service – Daily man-db regeneration.
2026-08-24T15:56:17.402664+05:30 pro kernel: perf: interrupt took too long (3136 > 3131), lowering kernel.perf_event_max_sample_rate to 63000
2026-08-24T15:57:22.022697+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=1 signal=-68 noise=-100 txrate=0
2026-08-24T15:57:36.358952+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-76 noise=-100 txrate=0
2026-08-24T15:57:47.725661+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-80 noise=-100 txrate=0
2026-08-24T16:00:01.541868+05:30 pro CRON[18307]: (ravi) CMD (echo "Cron is working!" >> /home/ravi/cron-test.log)

View a Specific Number of Lines

Use -n to control how many lines are displayed:

tail -n 20 /var/log/auth.log
tail -20 /var/log/auth.log

Output:

2026-08-24T15:30:01.468427+05:30 pro CRON[16814]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2026-08-24T15:30:01.470116+05:30 pro CRON[16815]: pam_unix(cron:session): session opened for user ravi(uid=1000) by ravi(uid=0)
2026-08-24T15:30:01.470158+05:30 pro CRON[16814]: pam_unix(cron:session): session closed for user root
2026-08-24T15:30:01.471643+05:30 pro CRON[16815]: pam_unix(cron:session): session closed for user ravi
2026-08-24T15:35:01.475150+05:30 pro CRON[16962]: pam_unix(cron:session): session opened for user ravi(uid=1000) by ravi(uid=0)
2026-08-24T15:35:01.479823+05:30 pro CRON[16962]: pam_unix(cron:session): session closed for user ravi
2026-08-24T15:39:01.482578+05:30 pro CRON[17365]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)

Follow a Log File in Real Time

The -f option keeps the file open and displays new lines as they are written. This is one of the most common ways for system administrators to monitor a log while troubleshooting a service:

tail -f /var/log/nginx/error.log

Press Ctrl+C to stop following the file. You can combine -f with -n to display the last N lines first and then continue following new entries:

tail -n 50 -f /var/log/nginx/access.log

Follow Multiple Log Files Simultaneously

You can follow more than one file at the same time:

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

tail prints a header before each file’s output, making it clear which log each line came from, invaluable for simultaneous log file analysis.

Follow by File Name, not File Descriptor

When log rotation replaces a file with a new one (e.g., syslog becomes syslog.1, and a new syslog is created), a normal tail -f may continue following the old file. Use --follow=name to have tail follow the file by name and reopen it when necessary, ensuring you always see the latest logs:

tail –follow=name /var/log/syslog

Output:

2026-08-24T16:07:40.216089+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-76 noise=-100 txrate=0
2026-08-24T16:08:29.469397+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=1 signal=-66 noise=-100 txrate=0
2026-08-24T16:08:35.305708+05:30 pro wpa_supplicant[929]: wlp4s0: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-77 noise=-100 txrate=0
2026-08-24T16:09:01.571086+05:30 pro CRON[18577]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi)

On RHEL/Rocky Linux, a similar approach can be used with /var/log/messages when logs are written to flat files:

tail –follow=name /var/log/messages

Start Output from a Specific Line Number

Using +N tells tail to start displaying output from line N instead of counting backward from the end. This is useful when you want to skip a header or the first few lines:

tail -n +2 /etc/passwd

The command above skips the first line and starts with line 2.

View the Last N Bytes

Use -c when you want to inspect the end of a file by bytes rather than lines:

tail -c 100 /var/log/syslog

Output:

0:01.541868+05:30 pro CRON[18307]: (ravi) CMD (echo "Cron is working!" >> /home/ravi/cron-test.log)

Watch journald Logs on systemd Systems

On modern Ubuntu and RHEL systems, many services write logs to the systemd journal instead of traditional log files. In these cases, the journalctl command provides similar follow functionality for contemporary Linux system administration:

journalctl -u nginx -f
journalctl -u sshd -n 50 -f

Output:

Aug 24 05:25:32 pro.tecmint systemd[1]: Starting nginx.service – A high performance web server and a reverse proxy server…
Aug 24 05:25:33 pro.tecmint systemd[1]: Started nginx.service – A high performance web server and a reverse proxy server.

The first command follows new entries for the nginx service. The second displays the last 50 entries and then continues following new ones, a common pattern for real-time debugging.

The cat Command: Concatenating, Displaying, and Debugging Files

The cat command (short for concatenate) reads files and writes their contents to standard output. It’s a rapid way to display a file, combine multiple files, or pass file contents to another command through a pipeline, crucial for Bash scripting efficiency.

The basic syntax of the cat command is:
cat [options] [file(s)]


Print a File to the Terminal

cat /etc/os-release

Output:

NAME="Linux Mint"
VERSION="22.3 (Zena)"
ID=linuxmint
ID_LIKE="ubuntu debian"
PRETTY_NAME="Linux Mint 22.3"
VERSION_ID="22.3"
HOME_URL="
SUPPORT_URL="
BUG_REPORT_URL="
PRIVACY_POLICY_URL="
VERSION_CODENAME=zena
UBUNTU_CODENAME=noble

Print Multiple files in Sequence

You can provide multiple files, and cat prints them one after another:

cat /etc/hostname /etc/hosts

Concatenate Files into a New File

Use output redirection (>) to combine several files into one:

echo ‘Hi Tecmint-Team’ > 1.txt
echo ‘Keep connected’ > 2.txt
echo ‘Share your thought’ > 3.txt
echo ‘connect us [email protected]’ > 4.txt

cat 1.txt 2.txt 3.txt 4.txt > combined.txt

You can then verify the combined file:

cat combined.txt

Output:

Hi Tecmint-Team
Keep connected
Share your thought
connect us [email protected]

This is also useful in real-world situations, such as assembling configuration snippets or combining log segments:

cat header.txt body.txt footer.txt > report.txt

Copy a File Using cat

You can duplicate a file by redirecting cat output to another file. This is not a replacement for cp, but it can be useful when working with pipelines or when you only need to copy the file contents:

cat /etc/nginx/nginx.conf > /tmp/nginx.conf.bak
cat /tmp/nginx.conf.bak

The second command lets you verify that the copied file contains the expected content.

Create a File Interactively

Running cat with an output redirection (>) and no input file lets you type content directly into a file:

cat > notes.txt
This is line one
This is line two

Press Ctrl+D when you’re finished. This sends an end-of-file signal and returns you to the shell. For scripted or repeatable file creation, a heredoc is usually more convenient.

Show Line Numbers

The -n option numbers every line, including blank lines. Use -b to number only non-blank lines:

cat -n /etc/fstab
cat -b /etc/nginx/nginx.conf

Show Non-Printing Characters

The -A option (equivalent to -vET) makes hidden characters visible. Tabs appear as ^I, while line endings are shown with $. This is especially useful when debugging Bash scripts or configuration files that contain unexpected tabs, trailing characters, or Windows-style \r\n line endings, which can cause subtle yet critical issues in Linux system administration:

cat -A suspicious-script.sh

Show End-of-Line Markers

The -E option displays a $ at the end of each line. This can help you spot trailing spaces or other unexpected whitespace that might affect parsing or script execution:

cat -E /etc/hosts

Create a File with a Heredoc

You can use cat with a heredoc (<<) to create a file and write several lines at once, making it ideal for automating configuration or documentation generation in Bash scripting:

cat > /tmp/test-config.txt << ‘EOF’
server_name=web01
env=production
port=8080
EOF

You can verify the contents with:

cat /tmp/test-config.txt

Output:

server_name=web01
env=production
port=8080

You can also use a custom marker instead of EOF. Any word works as long as the opening and closing markers match:

cat > /tmp/deploy-note.txt << END
Deployed by: ravi
Environment: staging
Date: 2026-06-12
END

Then check the file:

cat /tmp/deploy-note.txt

Output:

Deployed by: ravi
Environment: staging
Date: 2026-06-12

Append to an Existing File

Use >> instead of > when you want to append content without overwriting the existing file:

cat >> /var/log/deploy.log << ‘EOF’
Deployment completed at 2026-06-12 14:32 UTC
EOF

Use cat in a Pipeline

cat can pass file contents to commands such as grep, awk, or sed for filtering and processing, forming powerful Linux command line tools chains:

cat /var/log/auth.log | grep "Failed password" | awk ‘{print $11}’ | sort | uniq -c | sort -rn

For a single file, however, grep, awk, or sed can usually read the file directly, so cat is not always necessary and can be omitted for efficiency:

grep "Failed password" /var/log/auth.log

Read a File in Reverse with tac

tac is essentially the reverse of cat: it prints a file one line at a time, starting with the last line. It’s included with GNU coreutils on major Linux distributions.

For example, create a file containing the months of the year:

cat > months.txt << ‘EOF’
January
February
March
April
May
June
July
August
September
October
November
December
EOF

Now reverse the lines:

tac months.txt

Output:

December
November
October
September
August
July
June
May
April
March
February
January

In practice, tac is useful for quickly reading a log file in reverse so the newest entries appear first, aiding in rapid log file analysis:

tac /var/log/syslog | head -20

Unlike tail -f, this reads the file once and exits, making it useful when you only need a quick reverse view.

Advanced Synergy: Combining head and tail for Precision

You can combine head and tail to extract a specific range of lines from a file. For example, to display lines 20–30:

head -30 /etc/nginx/nginx.conf | tail -11

This works in two steps:

1. head -30 takes the first 30 lines of the file.
2. tail -11 takes the last 11 lines from those 30 lines (lines 20-30).

So the result is lines 20 through 30 of /etc/nginx/nginx.conf.
The output typically contains 11 lines:

types_hash_max_size 2048;

server_tokens off;

server_names_hash_bucket_size 64;

# server_name_in_redirect off;


include /etc/nginx/mime.types;
default_type application/octet-stream;

# SSL Settings


Note that blank lines also count, which is why you might see fewer than 11 lines of visible text. For scripting, sed is often cleaner because it can print a specific range of lines directly, offering more efficient Bash scripting efficiency:

sed -n ‘20,30p’ /etc/nginx/nginx.conf

This directly prints lines 20 through 30, making it simpler and more efficient than chaining head and tail.

Linux File Command Quick Reference

Conclusion: Elevate Your Linux Command Line Proficiency

head, tail, and cat are foundational Linux command line tools, but their true power emerges when you explore their full range of options and combine them strategically. Whether you’re quickly checking a configuration file, inspecting the start or end of a log, monitoring a service in real time, or combining files for a script, these commands empower you to interact with text rapidly and effectively from the terminal.

The real advantage comes from integrating them with pipes, redirections, grep, sed, awk, and other command-line utilities. Once these basics become second nature, inspecting files, troubleshooting, and performing Linux system administration tasks become significantly faster and more efficient, transforming your daily workflow.

FAQ

Question 1: Why use head, tail, cat instead of a text editor like vim or nano?
Answer 1: For quick inspection or dynamic monitoring, head, tail, and cat are significantly faster and lighter than full-blown text editors. Editors load the entire file into memory (or buffer), which can be slow for massive logs. These commands stream output directly, making them ideal for performance-critical tasks, especially in scripts or when dealing with continuously updated files in log file analysis. They also integrate seamlessly into pipelines, allowing for powerful, automated text processing without manual intervention.

Question 2: What’s the main difference between tail -f and tail --follow=name?
Answer 2: tail -f follows the file descriptor of the opened file. If the file is rotated (i.e., renamed and a new file is created with the original name), tail -f will continue reading the old (renamed) file, missing new log entries. tail --follow=name (or -F on some systems) follows the file name. When it detects that the file has been renamed or replaced, it will reopen the file by its original name, ensuring you continue to see new logs from the active file. This is crucial for reliable real-time log monitoring on systems with log rotation.

Question 3: When should I use cat -A or cat -E?
Answer 3: cat -A (or cat -vET) is invaluable for debugging scripts or configuration files, especially when you encounter unexpected behavior that isn’t immediately visible. For example, if a Bash script fails with an "unexpected end of file" error, cat -A can reveal Windows-style \r\n (carriage return followed by newline) characters as ^M$ at the end of lines. These hidden ^M characters can break script execution on Linux systems. It also shows tabs as ^I and other non-printing characters, helping you spot inconsistencies (like invisible trailing spaces) that might cause parsing errors in tools like awk or grep. A recent real-world example involved debugging a Dockerfile where invisible trailing spaces on a RUN command caused build failures – cat -A immediately highlighted the culprits.

Read the original article