head and tail in Linux CLI - Commands & Configuration

Introduction

Sometimes you want to quickly see the beginning or the end of a file without opening the whole thing. The head and tail commands let you do just that by showing the first or last lines of a file.

When you want to check the first few lines of a log file to see its header or initial entries

When you want to see the last few lines of a log file to check recent events or errors

When you want to preview the start of a CSV file to understand its structure

When you want to monitor the end of a file that is actively growing, like a server log

When you want to extract a specific number of lines from the start or end of any text file

Commands

This command shows the first 5 lines of the syslog file to quickly check its beginning entries.

Terminal

head -n 5 /var/log/syslog

Expected Output

Apr 26 10:00:01 server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Apr 26 10:00:01 server CRON[1235]: (root) CMD (some other command)

Apr 26 10:01:15 server systemd[1]: Starting Daily apt download activities...

Apr 26 10:01:16 server systemd[1]: Started Daily apt download activities.

Apr 26 10:05:01 server CRON[1236]: (root) CMD (run-parts /etc/cron.daily)

→

-n - Specify the number of lines to show from the start

This command shows the last 5 lines of the syslog file to see the most recent log entries.

Terminal

tail -n 5 /var/log/syslog

Expected Output

Apr 26 11:55:01 server CRON[2345]: (root) CMD (run-parts /etc/cron.hourly)

Apr 26 11:55:01 server CRON[2346]: (root) CMD (some other command)

Apr 26 11:56:15 server systemd[1]: Starting Daily apt download activities...

Apr 26 11:56:16 server systemd[1]: Started Daily apt download activities.

Apr 26 12:00:01 server CRON[2347]: (root) CMD (run-parts /etc/cron.daily)

→

-n - Specify the number of lines to show from the end

Shows the first 3 lines of the passwd file to preview user account entries.

Terminal

head -n 3 /etc/passwd

Expected Output

root:x:0:0:root:/root:/bin/bash

daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

bin:x:2:2:bin:/bin:/usr/sbin/nologin

→

-n - Number of lines to display

Shows the last 2 lines of the passwd file to see the last user entries.

Terminal

tail -n 2 /etc/passwd

Expected Output

sshd:x:106:65534::/run/sshd:/usr/sbin/nologin

systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin

→

-n - Number of lines to display

Key Concept

If you remember nothing else, remember: head shows the start of a file, tail shows the end.

Common Mistakes

Using head or tail without specifying the number of lines when you want more or fewer than the default 10 lines.

The commands will show 10 lines by default, which might be too many or too few for your needs.

Always use the -n flag followed by the number of lines you want to see.

Trying to use head or tail on a binary or non-text file.

The output will be unreadable or may contain strange characters.

Use head and tail only on text files or files you know contain readable text.

Summary

head command shows the first lines of a file, tail shows the last lines.

Use the -n flag to specify how many lines to display.

These commands help quickly inspect parts of large files without opening them fully.

Practice

1. What does the head command do by default when run on a text file?

easy

A. Counts the number of lines in the file

B. Shows the last 10 lines of the file

C. Deletes the first 10 lines of the file

D. Shows the first 10 lines of the file

Solution

1. Step 1: Understand the default behavior of head

   The head command shows the start of a file, by default 10 lines.

2. Step 2: Compare with other options

   tail shows the end, but head shows the beginning lines.

3. Final Answer:

   Shows the first 10 lines of the file -> Option D

4. Quick Check:

   head = first 10 lines [OK]

Hint: Remember: head = start, tail = end of file [OK]

Common Mistakes:

• Confusing head with tail
• Thinking head deletes lines
• Assuming head counts lines

2. Which of the following is the correct syntax to display the last 5 lines of a file named log.txt?

easy

A. tail -n 5 log.txt

B. head -n 5 log.txt

C. tail 5 log.txt

D. head 5 log.txt

Solution

1. Step 1: Identify the command to show last lines

   tail shows the end of a file, so it is used to show last lines.

2. Step 2: Use correct syntax with -n option

   The option -n 5 specifies to show 5 lines. So tail -n 5 log.txt is correct.

3. Final Answer:

   tail -n 5 log.txt -> Option A

4. Quick Check:

   tail -n 5 shows last 5 lines [OK]

Hint: Use -n with tail to specify number of lines [OK]

Common Mistakes:

• Using head instead of tail
• Omitting -n option
• Using tail without -n for line count

3. Given a file data.txt with 20 lines, what will be the output of head -n 3 data.txt | tail -n 2?

medium

A. Lines 2 and 3 of data.txt

B. Lines 1 and 2 of data.txt

C. Lines 18 and 19 of data.txt

D. Lines 3 and 4 of data.txt

Solution

1. Step 1: Understand head -n 3 data.txt

   This command outputs the first 3 lines: lines 1, 2, and 3.

2. Step 2: Apply tail -n 2 on the output

   tail -n 2 takes the last 2 lines of the previous output, so lines 2 and 3.

3. Final Answer:

   Lines 2 and 3 of data.txt -> Option A

4. Quick Check:

   head 3 then tail 2 = lines 2 & 3 [OK]

Hint: Pipe head then tail to slice lines from start [OK]

Common Mistakes:

• Assuming tail works on whole file, not head output
• Confusing line numbers
• Thinking tail -n 2 shows first 2 lines

4. You run head -n 5 file.txt but get an error: head: invalid option -- 'n'. What is the likely cause?

medium

A. The file file.txt does not exist

B. The head command version does not support -n

C. You need to use --lines=5 instead of -n 5

D. You must run the command as root

Solution

1. Step 1: Analyze the error message

   The error says invalid option -- 'n', meaning -n is not recognized.

2. Step 2: Understand command version differences

   Some older or non-GNU versions of head do not support -n and require different syntax.

3. Final Answer:

   The head command version does not support -n -> Option B

4. Quick Check:

   Invalid option error means unsupported flag [OK]

Hint: Check command version if options cause errors [OK]

Common Mistakes:

• Assuming file missing causes option error
• Trying to run as root unnecessarily
• Using wrong syntax without checking version

5. You want to monitor the last 15 lines of a growing log file app.log in real-time but only want to see the newest lines as they appear. Which command combination is best?

hard

A. head -n 15 app.log

B. tail -n 15 app.log

C. tail -n 15 -f app.log

D. head -n 15 -f app.log

Solution

1. Step 1: Understand the need to see last lines and follow updates

   You want the last 15 lines and to watch new lines as they are added.

2. Step 2: Use tail with -n 15 and -f

   tail -n 15 -f app.log shows last 15 lines and follows file changes live.

3. Final Answer:

   tail -n 15 -f app.log -> Option C

4. Quick Check:

   tail -n 15 -f = last 15 lines + live updates [OK]

Hint: Use tail -f to follow file changes live [OK]

Common Mistakes:

• Using head which shows start, not end
• Omitting -f to follow updates
• Using head -f which is invalid