Day 3 - Viewing and Finding Contents

📌 Key Takeaways

• Four ways to view contents: cat (all at once) · less (page through) · head (the beginning) · tail (the end).
• tail -f follows new content appended to the file in real time. Use it for viewing logs.
• find finds files, and grep finds strings inside files. This distinction is an exam point.
• find is written path first — find /etc -name "*.conf".
• wc counts lines, words, and characters. wc -l is the line count.

Viewing File Contents

head -n 5 a.txt      # first 5 lines
tail -n 20 a.txt     # last 20 lines
tail -f /var/log/messages   # follow in real time
wc -l a.txt          # line count only

• The default for head and tail is 10 lines. Use -n to change the count.
• The f in tail -f stands for follow. Use it to watch a log that keeps growing, and get out with Ctrl+C.

Specifying the Line Count for head · tail, in Four Shapes

head -n 20 a.txt | tail -n 5     # only lines 16-20 (the last 5 of the first 20)
tail -n +2 list.csv              # everything except the first (header) line
tail -f -n 50 /var/log/messages  # show the last 50 lines, then keep following

• To pull out a middle section of a file, chain head and tail with a pipe. The first line above is the classic example.
• tail -f is not a command that modifies the file. It only reads, and prints new lines appended at the end to the screen.

The Difference Between more and less

• Both are grouped as "commands that show one screen at a time," but the dividing line is that the one you can scroll back in is less. Depending on the implementation, more can also go back one screen with b when viewing a file, but the exam asks using this contrast.
• Both are used after a pipe to break up long output — ls -l /etc | less.

Reading wc Output

$ wc /etc/passwd
  42   78 2104 /etc/passwd
   │    │    │
   │    │    └── byte count
   │    └─────── word count
   └──────────── line count

• Used with no options, it prints three numbers in the order lines → words → bytes. The order shows up in exam questions.
• For a file with only English text, -c and -m are the same, but they differ once Korean (Hangul) text is mixed in. That is because in UTF-8 a single Hangul character is 3 bytes.
• In /etc/passwd each line is one account, so wc -l /etc/passwd is exactly the number of accounts.

Inside less

• man pages are actually displayed with less, so the controls are the same.

Other Uses of cat

cat a.txt b.txt          # print two files back to back (concatenate)
cat a.txt > b.txt        # save the contents to b.txt (overwrite)
cat -n a.txt             # print with line numbers

• cat is short for concatenate. It is originally a command that prints several files joined together.

cat > memo.txt           # save what you type on the keyboard to a file. End with Ctrl+D
cat a.txt >> b.txt       # append to the end of b.txt (keeping existing contents)
cat -b a.txt             # number only the non-blank lines

• > overwrites and >> appends. Be careful: using the same file for both input and output, like cat a.txt > a.txt, empties its contents.
• Typing just cat with no arguments waits for keyboard input. It hasn't frozen, so get out with Ctrl+D (end of input).

Finding Files — find

   find  /etc  -name "*.conf"
    │      │        │
    │      │        └── condition
    │      └─────────── where to start looking (required)
    └────────────────── command

find /home -name "*.txt"        # by name
find / -type d -name "log"      # directories only
find . -size +100M              # larger than 100MB
find /var -mtime -1             # changed within a day

• Always write the path first. find -name "*.txt" /home does not work.
• Wrap the pattern in quotes. If you don't, the shell first replaces *.txt with the file names in the current directory, and find receives unexpected arguments.

The + and - in Front of a Number

For conditions that take a number, like -size and -mtime, the sign changes the meaning.

• The units for -size are c bytes · k KB · M MB · G GB. They are case-sensitive, so -size +10m is an error.

Combining Conditions and Running a Command on What Was Found

find /home -name "*.log" -size +1M       # two conditions side by side is AND
find /etc -name "*.conf" -o -name "*.cfg" # -o is OR
find /tmp ! -user root                    # ! is NOT — not owned by root
find /var/log -type f -empty              # files with size 0
find /usr -perm 644                       # exactly permission 644
find . -maxdepth 1 -type d                # descend only one level

find /tmp -name "*.tmp" -mtime +7 -exec rm {} \;
#                                  │      │  │
#                                  │      │  └── end marker for -exec (\ protects the ;)
#                                  │      └───── where the found file name goes
#                                  └──────────── run this command on every file found

• {} receives the found file names one at a time, and \; marks the end of the command. These two are the fixed pair of -exec.
• Before a delete command, it is safer to run it first without -exec to check what gets matched.
• find actually searches the disk, so it is slow. For quickly finding just names, there is locate, which uses a prebuilt index (refresh the index with updatedb).

$ touch /tmp/newfile.txt
$ locate newfile.txt
$ sudo updatedb
$ locate newfile.txt
/tmp/newfile.txt

• A file you just created not showing up in locate is not a malfunction. The index is usually refreshed automatically once a day, and to reflect changes right away, run updatedb as root.

There are more "finding" commands, and they get mixed together in exam questions. Tell them apart by what they look for.

$ whereis ls
ls: /usr/bin/ls /usr/share/man/man1/ls.1.gz

Finding Contents — grep

grep "root" /etc/passwd          # print lines containing that word
grep -i "ERROR" app.log          # ignore case
grep -n "root" /etc/passwd       # with line numbers
grep -v "root" /etc/passwd       # only lines without that word (inverse)
grep -r "TODO" /home/user        # recursively through subdirectories
grep -c "root" /etc/passwd       # count only

$ grep -n "root" /etc/passwd
1:root:x:0:0:root:/root:/bin/bash
10:operator:x:11:0:operator:/root:/sbin/nologin
$ grep -c "root" /etc/passwd
2
$ grep -w "root" /etc/passwd | wc -l
2
$ grep "root" /etc/passwd /etc/group
/etc/passwd:root:x:0:0:root:/root:/bin/bash
/etc/passwd:operator:x:11:0:operator:/root:/sbin/nologin
/etc/group:root:x:0:

• grep works line by line. It prints not just the matching text but the entire line that contains it.
• -c is the number of matching "lines". Even if root appears three times on one line, it counts as 1.
• If you give two or more files, file name: is prepended to each line.
• Don't mix them up with the uppercase options — -i is ignore case, -l is file names only, and -v is the inverse.

Symbols Used in Patterns

A grep pattern is not a simple string but a regular expression. You can specify where in the line something sits.

grep "bash$" /etc/passwd | wc -l     # number of accounts whose login shell is bash
grep -v "^#" /etc/fstab              # only lines without comments (starting with #)
grep -E "error|fail" app.log         # lines containing error or fail

⚠️ The * in wildcards and the * in regular expressions are different. In file names * means "any string," but in a grep pattern * means "zero or more repetitions of the character just before it." The pattern for find -name is a wildcard, and the pattern for grep is a regular expression.

find vs grep — finding files by name is find, and finding contents inside files is grep. When a question says "lines that contain a specific string," it is grep.

Chaining Together — Pipes

ls -l | grep ".txt"          # only .txt from the ls result
cat a.txt | wc -l            # line count of a.txt
ps -ef | grep httpd          # httpd among the running processes
grep "ERROR" app.log | head  # the first 10 of the error lines

• | (pipe) passes the output of the previous command as the input of the next command.
• Each command is simple on its own, but chained together they become powerful — this is the Unix design philosophy.
• | sends to a command, > sends to a file. ls | wc -l passes to a command called wc, while ls > wc ends up creating a file named wc.
• You can chain as many pipes as you like — cat /etc/passwd | grep bash | wc -l.

$ wc -l /etc/passwd
42 /etc/passwd
$ cat /etc/passwd | wc -l
42

• When you give a file as an argument, the name is printed too, and when it receives input through a pipe, only the number is printed. That is because wc was handed just the contents without knowing the file name.

Tomorrow we will learn the commands for dealing with the people who use the system, that is, users and accounts.

📖 Glossary

• cat : A command that prints file contents joined together. Short for concatenate.
• less : A pager for viewing long files one screen at a time. man is also displayed with it.
• tail -f : An option that follows and prints content newly added to a file in real time.
• find : A command that finds the files themselves matching conditions on disk.
• grep : A command that finds lines containing a string inside files.
• locate : A command that quickly finds file names from a prebuilt index.
• Pipe (|) : A symbol that connects the output of the previous command to the input of the next command.
• wc : A command that counts lines, words, and characters. -l is the line count.