Learn Why ‘less’ is Faster Than ‘more’ Command for Effective File Navigation

More is a *nix command line used to display the contents of a file in a console. The basic usage of more command is to run the command against a file as shown below:

Read Also: Learn Difference Between ‘cat’ and ‘tac’ Commands with Examples

Learn Linux ‘more’ Command

# more /var/log/auth.log
View Contents of auth.log File
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:02 tecmint CRON[7435]: pam_unix(cron:session): session closed for user root
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
....

Another way to use more command in conjunction (pipe) with other commands, such as cat command, as presented on below example:

# cat /var/log/auth.log | more
View and Navigate Contents of File
View and Navigate Contents of File

In order to navigate through the file line by line press Enter key or press Spacebar key to navigate one page at a time, the page being your current terminal screen size. To exit the command just press q key.

A useful option of more command is the -number switch which allows you to set the number of line a page should contain. As an example display the auth.log file as a page of 10 lines:

# more -10 /var/log/auth.log
Show Only First 10 Lines of File
Show Only First 10 Lines of File

Also, you can display a page starting from a specific line number using the +number option as illustrated below:

# more +14 /var/log/auth.log
Show Only First 14 Lines of auth.log File
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
Apr 12 12:16:01 tecmint mate-screensaver-dialog: gkr-pam: unlocked login keyring
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session closed for user root
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session closed for user root
Apr 12 12:25:01 tecmint CRON[8107]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:25:01 tecmint CRON[8108]: pam_unix(cron:session): session opened for user root by (

Learn Linux ‘less’ Command

Similar to more, less command allows you to view the contents of a file and navigate through file. The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.

In can be used as a standalone command issued against a file or used with pipes with a multitude of Linux commands in order to narrow their screen output allowing you to scroll through results.

# less /var/log/auth.log
# ls /etc | less

You can navigate through the file line by line pressing Enter key. Page navigation can be handled with spacebar key. The page size is represented by your current terminal screen size. To exit command type q key, same way as for more command.

A useful feature of less command is the use of /word-to-seach option. For instance you can search and match all sshd messages from a log file by interactively specifying the /sshd string.

View File Content Using less Command
View File Content Using less Command

In order to display a file staring at a specific line number use the following syntax:

# less +5 /var/log/auth.log

If you need to track down the number of every line with less command use the -N option.

# less -N /var/log/daemon.log
Show Number for Every Line in File
      1 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
      2 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
      3 Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
      4 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
      5 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
      6 Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
      7 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
      8 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
      9 Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
     10 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
     11 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root

By default the only way to exit less command is to hit q key. To change this behavior and automatically exit file when reaching the end of file use the -e or -E option:

# less -e /var/log/auth.log
# less -E /var/log/auth.log

To open a file at the first occurrence of a pattern use the following syntax:

# less +/sshd /var/log/auth.log
Show Given Matching String in File
Apr 12 16:19:39 tecmint sshd[16666]: Accepted password for tecmint from 192.168.0.15 port 41634 ssh2
Apr 12 16:19:39 tecmint sshd[16666]: pam_unix(sshd:session): session opened for user tecmint by (uid=0)
Apr 12 16:19:39 tecmint systemd-logind[954]: New session 1 of user tecmint.
Apr 12 16:19:48 tecmint sshd[16728]: Received disconnect from 192.168.0.15: 11: disconnected by user
Apr 12 16:19:48 tecmint sshd[16666]: pam_unix(sshd:session): session closed for user tecmint
Apr 12 16:20:01 tecmint CRON[16799]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:20:02 tecmint CRON[16799]: pam_unix(cron:session): session closed for user root
Apr 12 16:25:01 tecmint CRON[17026]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:25:01 tecmint CRON[17025]: pam_unix(cron:session): session opened for user root by (uid=0)

The above command tells less to open auth.log file at the first match of sshd string.

In order to automatically append the content of a file opened in less command use the Shift+f keys combination or run less with the following syntax.

# less +F /var/log/syslog

This makes less to run in interactive mode (live) and display new content on-fly while waiting for new data to be written to file. This behavior is similar to tail -f command.

In combination with a pattern you can watch the log file interactively with Shift+f key stroke while matching a keyword. To exit live mode just press Ctrl+c keys.

# less +/CRON /var/log/syslog

Whether you decide to use more or less, which is a personal choice, remember that less is more with more features.

Read Also: Manage Files Effectively Using head, tail and cat Commands

Hey TecMint readers,

Exciting news! Every month, our top blog commenters will have the chance to win fantastic rewards, like free Linux eBooks such as RHCE, RHCSA, LFCS, Learn Linux, and Awk, each worth $20!

Learn more about the contest and stand a chance to win by sharing your thoughts below!

Matei Cezar
I'am a computer addicted guy, a fan of open source and linux based system software, have about 4 years experience with Linux distributions desktop, servers and bash scripting.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

6 Comments

Leave a Reply
  1. Great high-level review of the ‘less‘ command. I have not used ‘less‘ in a while and – after reading this I am planning to use it much more. (pun intended).
    Thanks for the comments afterward. It is nice to get a different perspective from other users!

    Reply
  2. One of the things I like about less command is that you can jump to the bottom of a file by typing an uppercase "G" — and just as quickly jump to the beginning of the file by typing a lowercase "g". Combined with the -N option, it gives you a quick, interactive means of inspecting the contents of a file and counting lines.

    There are about a million commands you can use in less… typing a lowercase "h" in-program will display a lengthy help file.

    Reply
    • @Thomlandin,

      Thanks for sharing the tips about Linux less command, hope users will find it useful and yes, me too likes less command and as articles states, yes its quicker than more command..

      Reply
  3. It is not true that “The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.”

    Not loading the entire file is the primary reason more was created, so that a file could be quickly viewed with more instead of waiting for it to load in an editor. There may be ancient versions of more around which don’t support navigating back up the file, but POSIX standard versions of more do support it.

    While it’s true that “less is more with more features”, most of the extra features you describe for less in this article are actually also present in (modern versions of) more.

    Reply

Got Something to Say? Join the Discussion...

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.