Learn Why ‘less’ is Faster Than ‘more’ Command for Effective File Navigation

More is a *nix command line used to display the contents of a file in a console. The basic usage of more command is to run the command against a file as shown below:

Read Also: Learn Difference Between ‘cat’ and ‘tac’ Commands with Examples

Learn Linux ‘more’ Command

# more /var/log/auth.log
View Contents of auth.log File
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root
Apr 12 12:05:02 tecmint CRON[7435]: pam_unix(cron:session): session closed for user root
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
....

Another way to use more command in conjunction (pipe) with other commands, such as cat command, as presented on below example:

# cat /var/log/auth.log | more
View and Navigate Contents of File

View and Navigate Contents of File

In order to navigate through the file line by line press Enter key or press Spacebar key to navigate one page at a time, the page being your current terminal screen size. To exit the command just press q key.

A useful option of more command is the -number switch which allows you to set the number of line a page should contain. As an example display the auth.log file as a page of 10 lines:

# more -10 /var/log/auth.log
Show Only First 10 Lines of File

Show Only First 10 Lines of File

Also, you can display a page starting from a specific line number using the +number option as illustrated below:

# more +14 /var/log/auth.log
Show Only First 14 Lines of auth.log File
Apr 12 12:09:01 tecmint CRON[7542]: pam_unix(cron:session): session closed for user root
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:10:01 tecmint CRON[7577]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:15:01 tecmint CRON[7700]: pam_unix(cron:session): session closed for user root
Apr 12 12:15:01 tecmint CRON[7699]: pam_unix(cron:session): session closed for user root
Apr 12 12:16:01 tecmint mate-screensaver-dialog: gkr-pam: unlocked login keyring
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:17:01 tecmint CRON[7793]: pam_unix(cron:session): session closed for user root
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:20:01 tecmint CRON[7905]: pam_unix(cron:session): session closed for user root
Apr 12 12:25:01 tecmint CRON[8107]: pam_unix(cron:session): session opened for user root by (
uid=0)
Apr 12 12:25:01 tecmint CRON[8108]: pam_unix(cron:session): session opened for user root by (

Learn Linux ‘less’ Command

Similar to more, less command allows you to view the contents of a file and navigate through file. The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.

In can be used as a standalone command issued against a file or used with pipes with a multitude of Linux commands in order to narrow their screen output allowing you to scroll through results.

# less /var/log/auth.log
# ls /etc | less

You can navigate through the file line by line pressing Enter key. Page navigation can be handled with spacebar key. The page size is represented by your current terminal screen size. To exit command type q key, same way as for more command.

A useful feature of less command is the use of /word-to-seach option. For instance you can search and match all sshd messages from a log file by interactively specifying the /sshd string.

View File Content Using less Command

View File Content Using less Command

In order to display a file staring at a specific line number use the following syntax:

# less +5 /var/log/auth.log

If you need to track down the number of every line with less command use the -N option.

# less -N /var/log/daemon.log
Show Number for Every Line in File
      1 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session opened for user root by (uid=0)
      2 Apr 12 11:50:01 tecmint CRON[6932]: pam_unix(cron:session): session closed for user root
      3 Apr 12 11:55:01 tecmint CRON[7159]: pam_unix(cron:session): session opened for user root by (uid=0)
      4 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session opened for user root by (uid=0)
      5 Apr 12 11:55:01 tecmint CRON[7160]: pam_unix(cron:session): session closed for user root
      6 Apr 12 11:55:02 tecmint CRON[7159]: pam_unix(cron:session): session closed for user root
      7 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session opened for user root by (uid=0)
      8 Apr 12 12:00:01 tecmint CRON[7290]: pam_unix(cron:session): session closed for user root
      9 Apr 12 12:05:01 tecmint CRON[7435]: pam_unix(cron:session): session opened for user root by (uid=0)
     10 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session opened for user root by (uid=0)
     11 Apr 12 12:05:01 tecmint CRON[7436]: pam_unix(cron:session): session closed for user root

By default the only way to exit less command is to hit q key. To change this behavior and automatically exit file when reaching the end of file use the -e or -E option:

# less -e /var/log/auth.log
# less -E /var/log/auth.log

To open a file at the first occurrence of a pattern use the following syntax:

# less +/sshd /var/log/auth.log
Show Given Matching String in File
Apr 12 16:19:39 tecmint sshd[16666]: Accepted password for tecmint from 192.168.0.15 port 41634 ssh2
Apr 12 16:19:39 tecmint sshd[16666]: pam_unix(sshd:session): session opened for user tecmint by (uid=0)
Apr 12 16:19:39 tecmint systemd-logind[954]: New session 1 of user tecmint.
Apr 12 16:19:48 tecmint sshd[16728]: Received disconnect from 192.168.0.15: 11: disconnected by user
Apr 12 16:19:48 tecmint sshd[16666]: pam_unix(sshd:session): session closed for user tecmint
Apr 12 16:20:01 tecmint CRON[16799]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:20:02 tecmint CRON[16799]: pam_unix(cron:session): session closed for user root
Apr 12 16:25:01 tecmint CRON[17026]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 12 16:25:01 tecmint CRON[17025]: pam_unix(cron:session): session opened for user root by (uid=0)

The above command tells less to open auth.log file at the first match of sshd string.

In order to automatically append the content of a file opened in less command use the Shift+f keys combination or run less with the following syntax.

# less +F /var/log/syslog

This makes less to run in interactive mode (live) and display new content on-fly while waiting for new data to be written to file. This behavior is similar to tail -f command.

In combination with a pattern you can watch the log file interactively with Shift+f key stroke while matching a keyword. To exit live mode just press Ctrl+c keys.

# less +/CRON /var/log/syslog

Whether you decide to use more or less, which is a personal choice, remember that less is more with more features.

Read Also: Manage Files Effectively Using head, tail and cat Commands

Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Matei Cezar

I'am a computer addicted guy, a fan of open source and linux based system software, have about 4 years experience with Linux distributions desktop, servers and bash scripting.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

5 Responses

  1. hagay godovanik says:

    And then there is “most”.

  2. LTT MDM says:

    One of the things I like about less command is that you can jump to the bottom of a file by typing an uppercase "G" — and just as quickly jump to the beginning of the file by typing a lowercase "g". Combined with the -N option, it gives you a quick, interactive means of inspecting the contents of a file and counting lines.

    There are about a million commands you can use in less… typing a lowercase "h" in-program will display a lengthy help file.

    • Ravi Saive says:

      @Thomlandin,

      Thanks for sharing the tips about Linux less command, hope users will find it useful and yes, me too likes less command and as articles states, yes its quicker than more command..

  3. Linux says:

    A little mistake at the beginning of 4th line under “Learn Linux ‘less’ Command”

  4. Geoff says:

    It is not true that “The main difference between more and less is that less command is faster because it does not load the entire file at once and allows navigation though file using page up/down keys.”

    Not loading the entire file is the primary reason more was created, so that a file could be quickly viewed with more instead of waiting for it to load in an editor. There may be ancient versions of more around which don’t support navigating back up the file, but POSIX standard versions of more do support it.

    While it’s true that “less is more with more features”, most of the extra features you describe for less in this article are actually also present in (modern versions of) more.

Leave a Reply to Geoff Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.