When an application crashes on your Linux server, the exact reason why is recorded in a system log file. However, server log files (like /var/log/syslog) are often massively bloated, containing millions of lines of text and gigabytes of data. If you try to open a 5GB text file using standard editors like nano or vim, your terminal will instantly freeze, and the server might crash from RAM exhaustion. To instantly read exactly what you need without loading the entire file, you must use the incredibly fast head and tail commands.
What Do Head and Tail Do?
These commands are designed for surgical precision. Instead of attempting to load millions of lines of data into the system’s memory, they mathematically skip over the vast majority of the file.
- The
headcommand instantly grabs only the very first few lines at the absolute top of the file. - The
tailcommand instantly grabs only the very last few lines at the absolute bottom of the file.
Using the Commands
By default, both commands will output exactly 10 lines of text.
To see how a log file starts (the absolute top):
- Open your terminal and type:
head /var/log/syslog - Press Enter.
To see how a log file ends (the absolute bottom, which usually contains the exact error code that caused your system to crash five seconds ago):
- Type:
tail /var/log/syslog - Press Enter.
Controlling the Line Count
Sometimes 10 lines are not enough to understand the context of the crash. You can easily instruct the engine to output a highly specific number of lines using the -n (number) flag.
If you want to see exactly the last 50 lines of the system log before the crash occurred:
- Type:
tail -n 50 /var/log/syslog - Press Enter.
The terminal will instantly output precisely 50 lines of data. Because the engine never attempted to load the other three million lines of text, the command executes in less than a millisecond, completely bypassing the massive file size constraints of standard text editors.