Mastering how to read and edit text files in Linux: cat, tac, less, more, head, and tail -f for real-time log monitoring, plus an introduction to the CLI editors nano and vim along with practice editing configuration files.

After episode 3 where you mastered filesystem navigation and file management — from pwd, ls, cd for moving around, to mkdir, cp, mv, rm for organizing files — in this episode we'll cover what you'll do with those files: reading, viewing, and editing their contents.
Why is this skill so fundamental? Almost all Linux and DevOps administration work revolves around text: reading configuration files in /etc, monitoring application logs flooding /var/log, editing nginx.conf, or fixing sshd_config. Linux configuration is text, logs are text, even the kernel data in /proc is text. You can't be an effective Linux administrator without being fluent in "talking" with text.
This episode 4 is divided into two big parts: first, the commands for reading files (cat, tac, less, more, head, tail -f) with a focus on real-time log monitoring; second, CLI text editors (nano for beginners and vim for those who want to get serious), closing with practice editing configuration files and a list of common pitfalls.
cat and taccat (concatenate) is the simplest command for displaying file contents. Its name comes from "concatenate" — to join — because its original function was to chain several files into one output:
cat README.md
cat file1.txt file2.txtFor small and medium files, cat is a quick and sufficient choice. tac is cat backwards (read: cat reversed) — it displays the file from the last line to the first:
tac access.logtac is very useful when you want to see the newest log at the top — because log files are usually written with the newest line at the bottom.
Warning
Never cat a large file or a binary file (like /dev/sda or an image file) to the terminal. The output will flood the screen with thousands of lines, and binary files can make your terminal display strange characters or hang. For large files, use less. To check a file's type before reading it, use file <name>.
less and moreFor large files — logs with hundreds of thousands of lines, or long configuration files — printing everything with cat doesn't make sense. This is where less becomes your best friend: it displays the file page by page and allows scrolling up and down.
less /var/log/syslogNavigation in less resembles Vim (not a coincidence — both share a common heritage): use Space to advance a page, b to go back, arrow keys for line by line, /word to search, n for the next result, and q to quit.
more is the more primitive predecessor of less — it can only go forward, not backward. In fact, when less was born, its tagline was "less is more": more complete features with the same usage. In the real world, you'll almost always use less.
| Command | Can scroll back | Search | Recommendation |
|---|---|---|---|
more | ❌ | Limited | Only for short files |
less | ✅ | ✅ (/pattern) | Always for large files |
Tip
Make a habit of using less for every file longer than one screen. The combination of less + /search + n to move between results is a pattern you'll use daily when debugging logs — far more efficient than manual scrolling.
head and tailhead displays the starting lines of a file (10 lines by default), while tail displays the ending lines. Both accept the -n option to specify the number of lines:
head -n 20 /etc/passwd # first 20 lines
tail -n 50 /var/log/syslog # last 50 linesThe most common use of tail: because logs are written from the bottom, tail gives you the newest log — that's why log debugging always starts with tail -n.
tail -fThis is the command you'll use almost every day as a DevOps Engineer: tail -f (follow). It doesn't stop after showing the last line — it keeps displaying new lines as they're added to the file. Like watching a live stream of your logs.
tail -f /var/log/syslogWhen a request hits your application, an error appears, or a service crashes — new lines show up on your screen immediately without retyping. This is the most important interactive debugging tool for production servers.
Caution
tail -f never ends — it keeps running until you press Ctrl+C to stop it. If the terminal looks "frozen", that's not a hang — it's actually a sign that tail -f is working properly, waiting for new lines. Don't force-close the terminal; just Ctrl+C. A practical combination for direct searching: tail -f /var/log/syslog | grep -i error.
nanoOnce you can read, it's time to edit. nano is the most beginner-friendly CLI text editor — its display is simple, and all commands are clearly shown at the bottom of the screen.
nano /etc/nginx/nginx.confYou can start typing to edit right away. The core commands to remember:
| Command | Function |
|---|---|
Ctrl+O | Save the file (Save; then Enter to confirm) |
Ctrl+X | Exit nano |
Ctrl+G | Help — all commands are here |
Ctrl+K | Cut a line |
Ctrl+U | Paste |
Ctrl+W | Search for text |
nano is perfect for beginners and quick edits. If you're just starting out, use nano first — and don't feel obligated to switch to Vim right away.
vim (and Neovim)vim is a far more powerful editor, but with a steep learning curve. It runs anywhere (production servers without a GUI, containers, SSH sessions) and is the de facto editor for Linux administrators. neovim is vim's modern successor — faster and configurable with Lua — but the basic commands are identical.
The most important Vim concept that often panics beginners: Vim has modes. You can't type directly like in nano — you have to enter insert mode first.
| Mode | Function | How to Enter |
|---|---|---|
| Normal | Navigation & edit commands (default) | Esc |
| Insert | Typing text | i (before cursor), a (after cursor) |
| Command-line | Commands like save/quit | : |
The basic flow: open vim → still in normal mode → press i to enter insert mode → type/edit → press Esc to return to normal mode → type :wq then Enter to save & quit.
Navigation in normal mode uses letters: h (left), j (down), k (up), l (right) — positioned to mimic the keyboard layout. Jump words with w (forward) and b (backward).
Save/quit commands in command-line mode:
:w # save the file
:wq # save and quit
:q # quit (fails if there are unsaved changes)
:q! # force quit without savingSome of the most used edit commands: dd deletes a line (in normal mode), u for undo, x deletes a character, and /word for searching (followed by n for the next result).
vim /etc/hosts
# 1. In normal mode, press i → enter insert mode
# 2. Type/edit the text you want
# 3. Press Esc → return to normal mode
# 4. Type :wq then Enter → save and quitImportant
The feeling of being "stuck" in Vim is a universal experience. If you accidentally enter insert mode and can't get out, just press Esc. If the terminal looks weird and you don't know what to do, press Esc then :q! to force quit without saving — you won't lose anything. If you're curious, run vimtutor (the built-in interactive tutorial) — 30 minutes alone will turn fear into comfort.
nano vs vim| Aspect | nano | vim |
|---|---|---|
| Learning curve | Low — usable immediately | Steep — requires practice |
| Editing speed | Medium | Very fast once proficient |
| Navigation | Arrow keys | hjkl modes + motions |
| Available on servers | Yes | Yes (almost always present) |
| Scripting power | None | Macros, plugins, recording |
| Best for | Beginners, quick edits | Serious administrators, daily driver |
The best choice: start with nano, then transition to vim once you're comfortable with the terminal. In the DevOps world, basic Vim skills are almost mandatory — someday you'll SSH into a server without a GUI and the only editor available is Vim.
Let's practice both with a real scenario: modifying the /etc/hostname file so the server's hostname is correct. This is exactly the kind of work you do when provisioning a new server.
Step 1 — with nano:
sudo nano /etc/hostname
# Type the new hostname, then Ctrl+O to save, Ctrl+X to quitStep 2 — with vim (same file, same result):
sudo vim /etc/hostname
# Press i to enter insert mode, change the text, press Esc, type :wq then EnterTo see the changes you make before and after, here's an illustration of the /etc/hostname contents before/after editing:
my-old-server
my-new-serverOr a more practical approach in the real world — back up first, then compare automatically:
cp /etc/hostname /etc/hostname.bak
sudo nano /etc/hostname
diff /etc/hostname.bak /etc/hostnameThe diff command shows line-by-line differences between two files — a skill you'll use constantly when debugging configuration.
Note
When modifying system configuration files like /etc/hostname, always make a habit of: (1) backing up with cp ... .bak, (2) editing carefully, (3) verifying with cat or diff, (4) if it's service-related, restart the service (sudo systemctl restart <name> — we'll cover this in the systemd episode). This routine saves you from broken configuration that eats hours of time.
| Mistake | Symptom | Solution |
|---|---|---|
| Vim "stuck" in insert mode | Typing becomes a strange mode, can't get out | Press Esc; if needed :q! |
tail -f seems to hang | Terminal unresponsive | It's not a hang — press Ctrl+C to stop |
cat a large/binary file | Screen flooded with thousands of lines / strange characters | Use less; check the type with file |
more can't scroll back | Can't see the starting lines | Use less |
| Quitting Vim without saving | Changes lost | Always :wq; if unsure :q! to cancel |
| Editing system files without sudo | Permission denied on save | Open with sudo nano/vim |
| No backup before editing | Broken configuration can't be restored | Always cp file file.bak first |
In this episode 4, you've mastered the text reading and editing skills that are the core of Linux administration: cat/tac for quick reads, less/more for large files page by page, head/tail for the beginning-end of files, tail -f for real-time log monitoring, and two CLI editors — the beginner-friendly nano and the powerful vim with its three modes (normal, insert, command-line) — closing with practice editing configuration files.
Key takeaways:
tail -f is a must-master tool for real-time log monitoring; stop it with Ctrl+C.less replaces more for large files; don't cat large or binary files.i for insert, Esc to return to normal, :wq save & quit, :q! force quit.nano, transition to vim — both run on servers without a GUI.cp file file.bak) before editing configuration files, and verify with diff.This ability to read and edit text is the foundation for the next episode. In episode 5, we'll discuss Pipelines, Redirection & I/O Streams — understanding the three standard streams (stdin, stdout, stderr), redirection operators (>, >>, 2>), and the pipeline (|) that will change how you chain commands into powerful automated workflows. Stay motivated, because the more concepts you master, the more you'll feel Linux's true power!