InformIT: Mac OS X Unleashed > Examining File Contents

Table of Contents

Examining File Contents

Moving around the file system, and moving files around the file system, isn't all that interesting if you can't look at what's in the files. Unix provides a number of facilities for examining the contents of files, and frequently these are more convenient to use than their graphical counterparts. BBEdit, for example, is a wonderful text editor, and it's light enough in memory footprint to load quickly. However, if what you want to do is see whether the file you're thinking about deleting is really the file you mean to delete, and the information is readily apparent by looking at the beginning of the text, there are much more efficient ways to examine the contents from the command line than starting up a GUI program just to glance at the file.

Looking at the Contents of Files: `cat`, `more`, `less`

Now that you have learned a little bit about how to list your files and copy your files, it is time to learn how to examine the contents of your files.

cat reads files and displays their contents. In this example, you see that m y file is very short.

[localhost:~] nermal% cat myfile

     Hi.  this is nermal.

     I hope you enjoyed myfile.

If the file were longer, it would keep scrolling by on the screen either until you pressed Ctrl+C to break the process or the file came to an end.

It might seem odd that anyone would want a program that just dumped all the output to the terminal, with no convenient way to slow it down or page through it. However, this is part of the Unix philosophy. The cat command reads files and sends their contents to the terminal. (Actually, cat sends their contents to STDOUT, a way of connecting commands that you'll learn more about in Chapter 18. STDOUT just happens to be connected to the terminal, unless you tell the command line otherwise.) In the Unix way of doing things, it is the job of some other program to provide paged display of data.

The complete syntax and options for cat are shown in Table 13.6, the command documentation table.

Table 13.6. The Command Documentation Table for `cat`

`cat`	Concatenates and prints files.
cat [-nbsvetu] <file1> <file2> ... cat [-nbsvetu] [-]
`cat` reads files in sequential, command-line order and writes them to standard output. A single dash represents standard input.
`-n`	Numbers all output lines.
`-b`	Numbers all output lines, except `b` or blank lines.
`-s`	Squeezes multiple adjacent empty lines, causing single-spaced output.
`-v`	Displays nonprinting characters. Control characters print as `^X` for Control+X; delete (octal 0177) prints as `^?`; non- ASCII characters with the high bit set are printed as `M-` (for meta) followed by the character for the low 7 bits.
`-e`	Implies `-v` option. Displays a dollar sign (`$`) at the end of each line as well.
`-t`	Implies `-v` option. Displays tab characters as `^I` as well.
`-u`	Guarantees unbuffered output.

You could also use cat to read the contents of longer files. However, the contents of your file scroll quickly. If you hope to read the contents as they appear, it would be better to use more, which also reads and displays files, but it pauses the display after a screenful.

The contents of nermal's short file look the same when viewed with more:

[localhost:~] nermal% more myfile

     Hi.  this is nermal.

     I hope you enjoyed myfile.

With a longer file, though, more pauses after a screenful:

[localhost:/var/log] joray% more system.log

     Apr 23 03:15:02 localhost syslogd: restart
     Apr 23 03:15:02 localhost sendmail[7423]: NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf:
      line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost sendmail[7424]: NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf:
      line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost CRON[7390]: (root) MAIL (mailed 108 bytes of output but got

      
    status 0x0047 )
     Apr 23 09:01:03 localhost WindowServer[56]: CGXGetSharedWindow: Invalid window -1
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS /ScreenSaverEngine:

      
    kCGSErrorCannotComplete : Cannot create context device
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS /ScreenSaverEngine: kCGSErrorFailure :

      
    Cannot initialize context RIPContext
     Apr 23 10:15:46 localhost WindowServer[56]: CGXGetSharedWindow: Invalid window -1
Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions/A/R
      esources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorCannotComplete : Cannot create context device
     Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine: kCGSErrorFailure :

      
    Cannot initialize context RIPContext
     Apr 23 10:17:26 localhost WindowServer[56]: CGXGetSharedWindow: Invalid window -1
     Apr 23 10:17:26 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 10:17:26 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS /ScreenSaverEngine: kCGSErrorCannotComplet
     system.log (11%)

In this display, we can see at the bottom of the screen that we are looking at a file called sy s tem.log, and that we have viewed about 11% of the file. After we are done looking at that screenful, we can press the space bar and look at the next screenful of text. Although more has many options to it, probably the most common syntax you will use is

more <filename>

The complete syntax and options for more are in Table 13.7, the command documentation table.

Table 13.7. The Command Documentation Table for `more`

`more`	Pages through data or text files.
more [-cdflsu] [-n] [+<linenumber>] [+/<pattern>] <file1><file2> ...
`more` pages through data a screenful at a time. When the user presses a carriage return at the `More` prompt at the bottom of the screen, one more line is displayed. When the user presses the space bar, another screenful of data is displayed. When `more` is invoked as `page`, each screenful is cleared before the next is displayed.
`-c`	Draws each page by beginning at the top of the screen and erasing each line just before it draws on it. This option is ignored if the screen is unable to clear to the end of a line.
`-d`	Prompts user with `Press space to continue, 'q' to quit`. at the end of each screenful. Responds to illegal user input with `Press 'h' for instructions`. instead of ringing the bell.
`-f`	Counts logical rather than screen lines. Long lines are not folded. Useful when trying to display lines containing nonprinting characters or escape sequences.
`-l`	Does not treat `^L` (form feed) as a page break. Where form feeds occur, `more` pauses after them, as if the screen were full. Particularly recommended if piping `nroff` output through `ul`.
`-s`	Squeezes multiple blank lines of output into one blank line of output. Useful for viewing `nroff` output.
`-u`	Suppresses underlining or stand-out mode, whichever the terminal is capable of displaying.
`-n`	Specifies the number of lines to use per screenful rather than the default.
`+` `<linenumber>`	Starts at `<linenumber>` .
`+/` `<pattern>`	Starts two lines before the line containing the regular expression pattern `<pattern>` .
Additional options for interacting with `more` when it pauses ( `i` is an optional integer argument, defaulting to `1`):
`i<return>`	Displays `i` more lines. Advances one line, if `i` is not given.
`i<space>`	Displays `i` more lines. Advances another screenful if `i` is not given.
`^D`	Displays 11 more lines. If `i` is given, scroll size is set to `i` .
`d`	Same as `^D`.
`i` `z`	Same as typing `<space>` , except that if `i` is given, scroll size becomes `i` .
`i` `s`	Skips `i` lines and prints a screenful of lines.
`i` `f`	Skips `i` screenfuls and prints a screenful of lines.
`i` `^F`	Same as `i` `f`.
`i` `b`	Skips back `i` screenfuls and prints a screenful of lines.
`i` `^B`	Same as `i` `b`.
`q`	Exits.
`Q`	Exits.
`=`	Displays the current line number.
`v`	Starts the editor at the current line number, if the environment variable `EDITOR` is set to `vi` or `ex`. If no `EDITOR` is specified, `vi` is the default.
`h`	Displays the help menu.
`i/<` `expression` `>`	Searches for the `i` th occurrence of the regular expression `<expre` `s` `sion>` . If the input is a file rather than a pipe, and there are less than `i` occurrences, the file remains unchanged. Otherwise, the display advances to two lines before the line containing `<expression>`.
`i` `n`	Searches for the `i` th occurrence of the last regular expression entered.
`'`	(Single quote) Goes to the point where the last search was started. If no search has been done on the file, it goes back to the beginning of the file.
`!` `<command>`	Invokes a shell that executes `<command>` . The characters `%` and `!`, when used in the `<command>` , are replaced with the current filename and the previous shell command, respectively. If there is no current filename, `%` is not expanded. To escape expansion, use `\%` and `\%`, respectively.
`i` `:n`	Skips to the `i` th next file given in the command line, or to the last file if `i` is beyond range.
`i` `:p`	Skips to the `i` th previous file in the command line, or to the first file if `i` is beyond range. If `more` is in the middle of displaying a file, it goes to the beginning of the file. If `more` is displaying from a pipe, the bell rings.
`:f`	Displays current filename and line number.
`:q`	Exits.
`:Q`	Exits.
`.`	(Dot) Repeats the previous command.

less is another pager. Because it does not have to read the entire file first, it starts faster. In addition, it has more backward and forward movement. Its commands are based both on more and vi, a text editor which we will examine in Chapter 15, "Command-Line Applications." Although less is frequently thought of as a command, it has enough complex functionality for the user who desires it that less might be better called an application. The fact that it is most frequently used for its command-like capabilities leads to its inclusion here.

The appearance of less output is similar to that from more:

[localhost:/var/log] joray% less system.log

     Apr 23 03:15:02 localhost syslogd: restart
     Apr 23 03:15:02 localhost sendmail[7423]: NOQUEUE: SYSERR(root): /etc/mail/sendmail

      
   .cf: line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost sendmail[7424]: NOQUEUE: SYSERR(root): /etc/mail/sendmail

      
   .cf: line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost CRON[7390]: (root) MAIL (mailed 108 bytes of output but got

      
    status 0x0047 )
     Apr 23 09:01:03 localhost WindowServer[56]: CGXGetSharedWindow: Invalid window -1
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS /ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorCannotComplete : Cannot create context device
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine: kCGSErrorFailure :

      
    Cannot initialize context RIPContext
     Apr 23 10:15:46 localhost WindowServer[56]: CGXGetSharedWindow:  Invalid window -1
     Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorCannotComplete : Cannot create context device
     Apr 23 10:15:46 localhost /System/Library/Frameworks/ScreenSaver.framework/ Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine: kCGSErrorFailure :

      
    Cannot initialize context RIPContext
     Apr 23 10:17:26 localhost WindowServer[56]: CGXGetSharedWindow:  Invalid window -1
     Apr 23 10:17:26 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 10:17:26 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ ScreenSaverEngine:  kCGSErrorCannotComplet
system.log

Like more, less has paused after a screenful. At the bottom, we also see that the file is called system.log, but it is not displaying the percentage of the file that we have examined.

The most common syntax you will use for less is

less <filename>

less is very powerful. The most important thing to remember about less is how to invoke help, which can be done by issuing either less -? or less —help. Depending on how your shell interprets a question mark, you might have to try -\? or "-\?" for help. The man page is quite overwhelming, but the —help option is easy to read and organized nicely. The output from the —help option is included in Table 13.8.

Many options are available in less, and there is much that you can do after you are in less. The syntax and options for less are in Table 13.8, the command documentation table.

Table 13.8. The Command Documentation Table for `less`

`less`	Opposite of `more`.
Pages through data or text files.
less -? less --help less -V less --version less [-[+]aBcCdeEfgGiImMnNqQrsSuUVwX][-b <bufs>][-h <lines>][-j <line>] [-k <keyfile>] [--{oO} <logfile>] [-p <pattern>][-t <tag>] [-T <tags- file>] [-x <tab>] [-y <lines>] [-[-z] <lines>][+[+]<cmd>] [--] [<file1>...]
Summary Of Less Commands Commands marked with * may be preceded by a number, N. Notes in parentheses indicate the behavior if N is given. h H Display this help. q :q Q :Q ZZ Exit. ----------------------------------------------------- MOVING e ^E j ^N CR * Forward one line (or N lines). y ^Y k ^K ^P * Backward one line (or N lines). f ^F ^V SPACE * Forward one window (or N lines). b ^B ESC-v * Backward one window (or N lines). z * Forward one window (and set window to N). w * Backward one window (and set window to N). ESC-SPACE * Forward one window, but don't stop at end-of- file. d ^D * Forward one half-window (and set half-window to N). u ^U * Backward one half-window (and set half-window to N). ESC-( RightArrow * Left 8 character positions (or N positions). ESC-) LeftArrow * Right 8 character positions (or N positions). F Forward forever; like "tail -f". r ^R ^L Repaint screen. R Repaint screen, discarding buffered input. ------------------------------------------- Default "window" is the screen height. Default "half-window" is half of the screen height. ------------------------------------------------- SEARCHING /pattern * Search forward for (N-th) matching line. ?pattern * Search backward for (N-th) matching line. n * Repeat previous search (for N-th occurrence). N * Repeat previous search in reverse direction. ESC-n * Repeat previous search, spanning files. ESC-N * Repeat previous search, reverse dir. & spanning files. ESC-u Undo (toggle) search highlighting. --------------------------------------------- Search patterns may be modified by one or more of: ^N or ! Search for NON-matching lines. ^E or * Search multiple files (pass thru END OF FILE). ^F or @ Start search at FIRST file (for /) or last file (for ?). ^K Highlight matches, but don't move (KEEP position). ^R Don't use REGULAR EXPRESSIONS. ------------------------------------- JUMPING g < ESC-< * Go to first line in file (or line N). G > ESC-> * Go to last line in file (or line N). p % * Go to beginning of file (or N percent into file). { ( [ * Find close bracket } ) ]. } ) ] * Find open bracket { ( [. ESC-^F <c1> <c2> * Find close bracket <c2>. ESC-^B <c1> <c2> * Find open bracket <c1> ---------------------------------------- Each "find close bracket" command goes forward to the close bracket matching the (N-th) open bracket in the top line. Each "find open bracket" command goes backward to the open bracket matching the (N-th) close bracket in the bottom line. m<letter> Mark the current position with <letter>. '<letter> Go to a previously marked position. '' Go to the previous position. ^X^X Same as '. --------------------------------------------------- A mark is any upper-case or lower-case letter. Certain marks are predefined: ^ means beginning of the file $ means end of the file ----------------------------------------------------------- CHANGING FILES :e [file] Examine a new file. ^X^V Same as :e. :n * Examine the (N-th) next file from the command line. :p * Examine the (N-th) previous file from the command line. :x * Examine the first (or N-th) file from the command line. :d Delete the current file from the command line list. = ^G :f Print current filename. ----------------------------------------------------------- MISCELLANEOUS COMMANDS -<flag> Toggle a command line option [see OPTIONS below]. --<name> Toggle a command line option, by name. _<flag> Display the setting of a command line option. __<name> Display the setting of an option, by name. +cmd Execute the less cmd each time a new file is examined. !command Execute the shell command with $SHELL. \|Xcommand Pipe file between current pos & mark X to shell command. v Edit the current file with $VISUAL or $EDITOR. V Print version number of "less". ----------------------------------------------------------- OPTIONS Most options may be changed either on the command line, or from within less by using the - or -- command. Options may be given in one of two forms: either a single character preceded by a -, or a name preceded by --. -? ........ --help Display help (from command line). -a ........ --search-skip-screen Forward search skips current screen. -b [N] .... --buffers=[N] Number of buffers. -B ........ --auto-buffers Don't automatically allocate buffers for pipes. -c -C .... --clear-screen --CLEAR-SCREEN Repaint by scrolling/clearing. -d ........ --dumb Dumb terminal. -D [xn.n] . --color=xn.n Set screen colors. (MS-DOS only) -e -E .... --quit-at-eof --QUIT-AT-EOF Quit at end of file. -f ........ --force Force open non-regular files. -g ........ --hilite-search Highlight only last match for searches. -G ........ --HILITE-SEARCH Don't highlight any matches for searches. -h [N] .... --max-back-scroll=[N] Backward scroll limit. -i ........ --ignore-case Ignore case in searches. -I ........ --IGNORE-CASE Ignore case in searches and in search patterns. -j [N] .... --jump-target=[N] Screen position of target lines. -k [file] . --lesskey-file=[file] Use a lesskey file. -m -M .... --long-prompt --LONG-PROMPT Set prompt style. -n -N .... --line-numbers --LINE-NUMBERS Use line numbers. -o [file] . --log-file=[file] Copy to log file (standard input only). -O [file] . --LOG-FILE=[file] Copy to log file (unconditionally overwrite). -p [pattern] --pattern=[pattern] Start at pattern (from command line). -P [prompt] --prompt=[prompt] Define new prompt. -q -Q .... --quiet --QUIET --silent --SILENT Quiet the terminal bell. -r ........ --raw-control-chars Output "raw" control characters. -s ........ --squeeze-blank-lines Squeeze multiple blank lines. -S ........ --chop-long-lines Chop long lines. -t [tag] .. --tag=[tag] Find a tag. -T [tagsfile] --tag-file=[tagsfile] Use an alternate tags file. -u -U .... --underline-special --UNDERLINE-SPECIAL Change handling of backspaces. -V ........ --version Display the version number of "less". -w ........ --hilite-unread Highlight first new line after forward-screen. -W ........ --HILITE-UNREAD Highlight first new line after any forward movement. -x [N] .... --tabs=[N] Set tab stops. -X ........ --no-init Don't use termcap init/deinit strings. -y [N] .... --max-forw-scroll=[N] Forward scroll limit. -z [N] .... --window=[N] Set size of window. -" [c[c]] . --quotes=[c[c]] Set shell quote characters. -~ ........ --tilde Don't display tildes after end of file. ------------------------------------------------------------ LINE EDITING These keys can be used to edit text being entered on the "command line" at the bottom of the screen. RightArrow ESC-l Move cursor right one character. LeftArrow ESC-h Move cursor left one character. CNTL-RightArrow ESC-RightArrow ESC-w Move cursor right one word. CNTL-LeftArrow ESC-LeftArrow ESC-b Move cursor left one word. HOME ESC-0 Move cursor to start of line. END ESC-$ Move cursor to end of line. BACKSPACE Delete char to left of cursor. DELETE ESC-x Delete char under cursor. CNTL-BACKSPACE ESC-BACKSPACE Delete word to left of cursor. CNTL-DELETE ESC-DELETE ESC-X Delete word under cursor. CNTL-U Delete entire line. UpArrow ESC-k Retrieve previous command line. DownArrow ESC-j Retrieve next command line. TAB Complete filename & cycle. SHIFT-TAB ESC-TAB Complete filename & reverse cycle. CNTL-L Complete filename, list all.

Looking at Portions of the Contents of Files: `head`, `tail`

Sometimes, however, you need to see only a portion of a file, rather than the entire contents. To see only portions of a file, use either head or tail. As the names suggest, head displays the first few lines of a file, whereas tail displays the last few lines of a file.

Let's look at the first few lines of system.log:

[localhost:/var/log] joray% head system.log

     Apr 23 03:15:02 localhost syslogd: restart
     Apr 23 03:15:02 localhost sendmail[7423]: NOQUEUE: SYSERR(root): /etc/mail/sendmail

      
   .cf: line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost sendmail[7424]: NOQUEUE: SYSERR(root): /etc/mail/sendmail

      
   .cf: line 81: fileclass: cannot open /etc/mail/local-host-names: Group writable directory
     Apr 23 03:15:02 localhost CRON[7390]: (root) MAIL (mailed 108 bytes of output but got

      
    status 0x0047 )
     Apr 23 09:01:03 localhost WindowServer[56]: CGXGetSharedWindow:  Ivalid window -1
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/  ScreenSaverEngine:

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window
     Apr 23 09:01:03 localhost /System/Library/Frameworks/ScreenSaver.framework /Versions

      
   /A/Resources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine:

      
    kCGSErrorCannotComplete : Cannot create context device
     Apr 23 09:01:03 localhost  /System/Library/Frameworks/ScreenSaver.framework/Versions/

      
    A/Resources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine: kCGSErrorFailure :

      
    Cannot initialize context RIPContext
     Apr 23 10:15:46 localhost WindowServer[56]: CGXGetSharedWindow:  Invalid window -1
     Apr 23 10:15:46 localhost  /System/Library/Frameworks/ScreenSaver.framework/Versions/

      
    A/Resources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine: 

      
    kCGSErrorIllegalArgument : CGSLockWindowRectBits: Invalid window

Nothing other than the first few lines of the file are displayed. Because head is not a pager, we do not see the name of the file displayed at the bottom of the screen. The complete syntax and options for head are in Table 13.9, the command documentation table.

Table 13.9. The Command Documentation Table for `head`

`head`	Displays the first lines of a file.
head [-n <number>] <file1> <file2> ... head [-n <number>]
`-` `n` `<number>`	Displays the first `<number>` of lines. If `n` is not specified, the default is `10`.

tail behaves in the same way as head, except that only the last few lines of a file are displayed, as you see in this sample:

[localhost:/var/log] joray% tail system.log

     Apr 23 17:30:09 localhost sshd[807]: lastlog_perform_login: Couldn't stat /var/log

      
   /lastlog: No such file or directory
     Apr 23 17:30:09 localhost sshd[807]: lastlog_openseek: /var/log/lastlog is not a file

      
    or directory!
     Apr 23 17:30:10 localhost sshd[807]: lastlog_perform_login: Couldn't stat /var/log

      
   /lastlog: No such file or directory
     Apr 23 17:30:10 localhost sshd[807]: lastlog_openseek: /var/log/lastlog is not a file

      
    or directory!
     Apr 23 17:31:31 localhost su: joray to nermal on /dev/ttyp4
     Apr 23 17:34:07 localhost su: joray to nermal on /dev/ttyp4
     Apr 23 17:36:43 localhost sshd[298]: Generating new 768 bit RSA key.
     Apr 23 17:36:45 localhost sshd[298]: RSA key generation complete.
     Apr 23 17:42:45 localhost su: BAD SU nermal to joray on /dev/ttyp4
     Apr 23 17:42:58 localhost su: nermal to joray on /dev/ttyp4

The complete syntax and options for tail are in Table 13.10, the command documentation table.

Table 13.10. The Command Documentation Table for `tail`

`tail`	Displays the last part of a file.
tail [-f \| -F \| -r] [-b <number> \| -c <number> \| -n <number>] <file> tail [-f \| -F \| -r] [-b <number> \| -c <number> \| -n <number>]
`-f`	Waits for and displays additional data that `<file>` receives, rather than stopping at the end of the file.
`-F`	Similar to `-f`, except that every five seconds, `tail` checks whether `<file>` has been shortened or moved. If so, `tail` closes the current file, opens the filename given, displays its entire contents, and waits for more data. This option is especially useful for monitoring log files that undergo rotation.
`-r`	Displays the file in reverse order, by line. The default is to display the entire file in reverse. This option also modifies the `-b`, `-c`, and `-n` options to specify the number of units to be displayed, rather than the number of units to display from the beginning or end of the input.
`-b` `<number>`	Specifies location in number of 512-byte blocks.
`-c` `<number>`	Specifies location in number of bytes.
`-n` `<number>`	Specifies location in number of lines.
If `<number>` begins with `+`, it refers to the number of units from the beginning of the input. If `<number>` begins with `-`, it refers to the number of units from the end of the input.