Example 1: Printing specific lines by their numbers using the sed command
This command allows you to view only the lines with specific numbers that are explicitly specified.
Syntax:
- $ sed -n -e Xp -e Yp FILENAME
In the example below, lines 120, 145, and 1050 of the syslog file are printed.
- $ sed -n -e 120p -e 145p -e 1050p /var/log/syslog
In the next example, you can view the contents of the /var/log/cron file, starting from line 101 and ending at line 110.
Syntax:
- sed -n M,Np FILENAME
- $ sed -n 101,110p /var/log/cron
Example 2: Printing the first N lines of a file using the head command
In this example, the first 15 lines of the /var/log/maillog file are printed.
Syntax:
- head -n N FILENAME
- $ head -n 15 /var/log/maillog
To print the first 10 lines of the log, replace 15 with 10 in the example.
Example 3: Excluding the last N lines of a file using the head command
This example shows how to ignore the last N lines and display only the remaining lines from the beginning of the file.
Syntax:
- head -n -N FILENAME
The example shows how to display all lines of the /var/log/secure file except the last 250.
- $ head -n -250 /var/log/secure
Example 4: Display the last N lines of a file using the tail command
Syntax: tail -n N FILENAME
In this example, only the last 50 lines of the /var/log/messages file are displayed. To display the last 100 lines of the log, change 50 to 100.
- $ tail -n 50 /var/log/messages
Example 5: Skip the first N-1 lines of a file using the tail command
This command allows you to ignore the first N-1 lines and display only the remaining lines.
Syntax:
- tail -n +N FILENAME
This example shows how to skip the first 4 lines of the /etc/xinetd.conf file, which contain only comments.
- $ tail -n +5 /etc/xinetd.conf
- defaults
- {
- instances = 60
- log_type = SYSLOG authpriv
- log_on_success = HOST PID
- log_on_failure = HOST
- cps = 25 30
- }
- includedir /etc/xinetd.d
Example 6: View a growing log in real time using the tail command
This is probably one of the most frequently used commands by system administrators. To view a growing file and output only the updated content of the log, use the tail -f command as shown below.
In the following example, the content of the /var/log/syslog file is displayed in real time.
Syntax:
- tail -f FILENAME
- $ tail -f /var/log/syslog
Example 7: Output specific lines (by line number) using the head and tail commands
Syntax:
- cat file | tail -n +N | head -n (M-N+1)
In the example below, lines 101–110 of the /var/log/anaconda.log file are displayed.
- $ cat /var/log/anaconda.log | tail -n +101 | head -n 10
Example 8: Output lines matching a pattern, along with several lines immediately following the matches.
The following example shows how to output lines matching the pattern “Initializing CPU” from the /var/log/dmesg file, as well as 5 lines immediately following them.
- # grep "Initializing CPU#1" /var/log/dmesg
- Initializing CPU#1
[Note: this command outputs only lines matching the pattern]
- # grep -A 5 "Initializing CPU#1" dmesg
- Initializing CPU#1
- Calibrating delay using timer specific routine.. 3989.96 BogoMIPS (lpj=1994982)
- CPU: After generic identify, caps: bfebfbff 20100000 00000000 00000000
- CPU: After vendor identify, caps: bfebfbff 20100000 00000000 00000000
- monitor/mwait feature present.
- CPU: L1 I cache: 32K, L1 D cache: 32K
[Note: this command outputs the matching line and the 5 lines following it]
The following operations are also available with the grep command:
Example 9: Output specific bytes from a file.
The following example shows how to output either the first 40 or the last 30 bytes of a file.
Output the first 40 bytes of the syslog file.
- $ head -c40 /var/log/syslog
Output the last 30 bytes of the syslog file.
- $ tail -c30 /var/log/syslog
Example 10: Viewing compressed logs.
At regular intervals, all system logs are compressed. You can decompress them "on the fly" and process the output with another command. How to do this is shown below.
Output the first N lines of a compressed file.
- $ zcat file.gz | head -250
Output the last N lines of a compressed file.
- $ zcat file.gz | tail -250
Ignore the last N lines of a compressed file.
- $ zcat file.gz | head -n -250
Ignore the first N lines of a compressed file.
- $ zcat file.gz | tail -n +250
View lines matching a pattern
- $ zcat file.gz | grep -A2 'error'
View a set of lines by their specified line numbers.
- $ zcat file.gz | sed -n -e 45p -e 52p
