Learn › Linux Foundations › Reading Files
head - a hands-on Linux lab on a real virtual machine.
Take a first look at any file with head: the first 10 lines by default, an exact line count with -n, or a byte count with -c. Practice on the intercept log and report right in the terminal.
You have already met cat, the command that prints a whole file to the screen. On a short file that is perfect. But files on a real machine are rarely short. A log file can run to thousands of lines, and cat would fire every one of them past you faster than you can read. You end up staring at the tail end, with the part you actually wanted long gone off the top.
Most of the time you do not need the whole file. You need the beginning: the first few lines, to see what kind of file this is, what its header looks like, or how a log opens. There is a command built for exactly that, and it is called head.
The black boxes in this lesson are a practice terminal: a safe sandbox that only checks the one command each step teaches, so you cannot break anything. On the real machine at the end of the module, the mission runs these commands for real on the same files.
You are working with a folder called intercept, a small pile of captured files. Inside its logs folder sits messages.log, a short system log. Before you learn any options, just point head at it by its path and see what comes back. Type this exact command and press Enter:
head ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: head ~/intercept/logs/messages.log output: line 1: system boot line 2: loading kernel modules line 3: network interface up line 4: mounting filesystems line 5: starting services line 6: user student logged in line 7: running diagnostics line 8: ready hint: Type head, a space, then the path to the file. Like this: head ~/intercept/logs/messages.log
head printed the file from the top. This particular log has only 8 lines, so you saw all of it. That is a clue about how head behaves by default, and the next step spells the rule out.
When you run head with nothing but a file name, it prints the first 10 lines and stops. That is the built-in default. If the file has more than 10 lines, you see the top 10 and the rest stays hidden. If the file has 10 or fewer, like messages.log with its 8 lines, you simply see the whole thing, because there was never a tenth line to cut off.
So head ~/intercept/logs/messages.log showed all 8 lines not because head decided to print everything, but because 8 is already under its limit of 10. On a thousand-line log, the same command would have stopped after line 10 and spared your screen.
head is the natural partner of cat. Reach for cat when you want the entire file, and head when you only need to sample the opening. On anything large, head is the safe first move.
Ten lines is just the default. Most of the time you want to decide for yourself. The -n flag does that. -n is short for number of lines, and head -n <number> <file> prints exactly that many lines from the top.
Say you only want to confirm how this log opens. Three lines is plenty. Ask head for the first 3:
head -n 3 ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: head -n 3 ~/intercept/logs/messages.log output: line 1: system boot line 2: loading kernel modules line 3: network interface up hint: Put -n and the number 3 between head and the path. Like this: head -n 3 ~/intercept/logs/messages.log
Exactly three lines, then head stopped. You told it how deep to read and it obeyed. Change the 3 to any number and you change how much of the top you get. This is the flag you will reach for most, because you almost always know roughly how many lines you want to see.
The power of head shows up when the file is longer than what you want to read. There is a second file in the same logs folder, report.txt, and it runs to 12 lines. Point a plain head at it and the default limit of 10 finally does some cutting. This time ask for the first 5, so you get just the opening section without the rest of the report:
head -n 5 ~/intercept/logs/report.txt
prompt: student@linuxcamp:~$ answer: head -n 5 ~/intercept/logs/report.txt output: SECTION 1: OVERVIEW The intercept station logged traffic across six channels. Channel 1 nominal. Channel 2 nominal. Channel 3 degraded. hint: Same shape as before, five lines this time: head -n 5 ~/intercept/logs/report.txt
Five lines off the top of a 12-line file. You read the overview and the first three channel readings without ever loading the summary at the bottom. That is the whole point of head: on a file too long to want all of, you take just the slice you need and leave the rest untouched.
There is one more way to slice. Instead of counting lines, head can count raw bytes. A byte is a single unit of stored data; for plain English text, one character is one byte, so 20 bytes is roughly 20 characters. The flag is -c, short for count of bytes, and head -c <number> <file> prints that many bytes from the start and then stops, even if it lands in the middle of a line.
Grab the first 20 bytes of the log and see where it draws the line:
head -c 20 ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: head -c 20 ~/intercept/logs/messages.log output: line 1: system boot hint: Swap -n for -c to count bytes, then the number 20: head -c 20 ~/intercept/logs/messages.log
It printed the first line and nothing more. Here is why the math works out clean: line 1: system boot is 19 characters, and the invisible newline that ends the line is the 20th byte. So 20 bytes landed exactly on the end of line one. Ask for a different number, say 10, and head would stop partway through the line, because -c counts bytes with no regard for where lines begin or end. Use -n when you think in lines, -c when you need an exact number of bytes.
Scaffolding off. No command is shown this time. You have every piece you need.
You want to see just the first 3 lines of report.txt, its title line and the first two lines under it, and nothing more. Pick the flag that counts lines, give it the number, and aim it at the report.
prompt: student@linuxcamp:~$ answer: head -n 3 ~/intercept/logs/report.txt output: SECTION 1: OVERVIEW The intercept station logged traffic across six channels. Channel 1 nominal. hint: You want lines, not bytes, so use -n with the number 3, then the report's full path under ~/intercept/logs.
Three lines off the top of report.txt, exactly as ordered. You chose -n because you were counting lines, set it to 3, and pointed it at the right file, all from memory. That is the same move the real machine will ask of you: know what you want, pick the flag, type it without a prompt.
You earned this cheat sheet. Every row is a form of head you have already run:
The one rule to carry away: head reads from the top and stops early. That makes it the safe way to sample any file without letting a huge one flood your screen. Line count with -n, byte count with -c, and plain head gives you the first 10 lines for free.
When you land on an unfamiliar machine and find a giant log, head is one of the first commands to reach for. A quick head -n 20 <file> tells you what you are looking at before you decide what to do with it.
The practice terminal has shown you the shape. The Reading Files module ends with one real machine, and that is where you run head for real.
In the Reading Files capstone mission, a Linux VM boots just for you on this same intercept filesystem. It hands you objectives that use exactly what you just ran: plain head for the first 10 lines, -n to set the count, and -c to slice by bytes. One difference from here: the mission shows no commands. You read the objective, recall the flag, and type it. That recall is what makes it stick.
Finish the other Reading Files lessons, then go take the first look for real.
Practice head in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.