Introduction

Sometimes you want to quickly see the beginning or the end of a file without opening the whole thing. The head and tail commands let you do just that by showing the first or last lines of a file.

When you want to check the first few lines of a log file to see its header or initial entries

When you want to see the last few lines of a log file to check recent events or errors

When you want to preview the start of a CSV file to understand its structure

When you want to monitor the end of a file that is actively growing, like a server log

When you want to extract a specific number of lines from the start or end of any text file

Commands

This command shows the first 5 lines of the syslog file to quickly check its beginning entries.

Terminal

head -n 5 /var/log/syslog

Expected OutputExpected

Apr 26 10:00:01 server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly) Apr 26 10:00:01 server CRON[1235]: (root) CMD (some other command) Apr 26 10:01:15 server systemd[1]: Starting Daily apt download activities... Apr 26 10:01:16 server systemd[1]: Started Daily apt download activities. Apr 26 10:05:01 server CRON[1236]: (root) CMD (run-parts /etc/cron.daily)

→

-n - Specify the number of lines to show from the start

This command shows the last 5 lines of the syslog file to see the most recent log entries.

Terminal

tail -n 5 /var/log/syslog

Expected OutputExpected

Apr 26 11:55:01 server CRON[2345]: (root) CMD (run-parts /etc/cron.hourly) Apr 26 11:55:01 server CRON[2346]: (root) CMD (some other command) Apr 26 11:56:15 server systemd[1]: Starting Daily apt download activities... Apr 26 11:56:16 server systemd[1]: Started Daily apt download activities. Apr 26 12:00:01 server CRON[2347]: (root) CMD (run-parts /etc/cron.daily)

→

-n - Specify the number of lines to show from the end

Shows the first 3 lines of the passwd file to preview user account entries.

Terminal

head -n 3 /etc/passwd

Expected OutputExpected

root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin

→

-n - Number of lines to display

Shows the last 2 lines of the passwd file to see the last user entries.

Terminal

tail -n 2 /etc/passwd

Expected OutputExpected

sshd:x:106:65534::/run/sshd:/usr/sbin/nologin systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin

→

-n - Number of lines to display

Key Concept

If you remember nothing else, remember: head shows the start of a file, tail shows the end.

Common Mistakes

Using head or tail without specifying the number of lines when you want more or fewer than the default 10 lines.

The commands will show 10 lines by default, which might be too many or too few for your needs.

Always use the -n flag followed by the number of lines you want to see.

Trying to use head or tail on a binary or non-text file.

The output will be unreadable or may contain strange characters.

Use head and tail only on text files or files you know contain readable text.

Summary

head command shows the first lines of a file, tail shows the last lines.

Use the -n flag to specify how many lines to display.

These commands help quickly inspect parts of large files without opening them fully.