Phase 3 · Free

3.4 Reading and Searching: cat, less, grep, find

Most of IT is finding things: the one line in a log that explains the crash, the config file someone changed, the file that filled the disk. Four commands do most of that work.

25 minPhase 3: Learn to Talk to Your MachineFree

Phase 3. Lesson 4 of 7. About 25 minutes.

Plain entry

Most of IT is finding things: the one line in a log that explains the crash, the config file someone changed, the file that filled the disk. Four commands do most of that work.

Terms

  • Pattern: text you are searching for. Can be plain words or a regex.
  • Case-sensitive: Error and error are different unless you say otherwise.
  • Pager: a program that shows long text one screen at a time. less is the standard one.

Depth

cat /etc/os-release           # print a short file
less /var/log/syslog          # page through a long one (q quits, /word searches, G jumps to end)
head -n 5 /etc/passwd         # first 5 lines
tail -n 20 /var/log/syslog    # last 20 lines
tail -f /var/log/syslog       # follow live, Ctrl+C to stop

Ubuntu 26.04 desktop and server install rsyslog by default, so /var/log/syslog exists. The file belongs to the adm group; the first user created at install is in that group, other users need sudo less. If the file is missing (some minimal images), use journalctl -f instead (Phase 4 covers the journal) or sudo apt install rsyslog. grep, the search tool:

grep -i "ubuntu" /etc/os-release

Expected output:

NAME="Ubuntu"
ID=ubuntu
...

Useful options: -i ignore case, -r search folders, -n show line numbers, -v show lines that do not match, -c count.

grep -rn "PermitRootLogin" /etc/ssh/ 2>/dev/null

find, to locate files by name, type, size, or age:

find ~ -name "*.txt"
find /var/log -type f -size +10M
find ~ -type f -mmin -60        # changed in the last hour

2>/dev/null hides “Permission denied” noise. Lesson 3.5 explains why.

Going further

grep -E enables extended regex: grep -E "fail(ed|ure)" file. find ... -exec runs a command on each result: find ~/lab -name "*.txt" -exec wc -l {} +.

Why it works this way

Logs and configs are plain text on purpose, so any tool can read them. That is why less, grep, and find cover most of your daily searching. Use tail -f while you reproduce a problem: you see the exact line the problem writes, at the moment it happens, instead of guessing which old line matters.

Self-check

  1. How do you watch a log as new lines arrive?
  2. Which grep option shows lines that do not match?
  3. Find every file over 100 MB in your home folder.

Answers: (1) tail -f. (2) -v. (3) find ~ -type f -size +100M.

Sources