more vs less Linux Commands: The SOC Analyst's Log Review Guide

Master Linux more and less Commands: A SOC Analyst's Guide to Fast Log Triage

It's 2:47 AM and a junior SOC analyst is staring down a 4GB auth.log file after an alert fires on a suspicious SSH brute-force pattern. The instinct is to open it in a text editor — and the editor freezes. The system swaps. Precious minutes tick by while an attacker's connection attempts keep piling up in the queue. This is exactly the moment where knowing less instead of reaching for a GUI editor separates analysts who can move fast under pressure from those who can't.

Every SOC analyst, penetration tester, and Linux administrator eventually learns that the humble command-line pagers more and less aren't just "old-school" tools — they're often the fastest, safest way to inspect massive log files, config files, and command output without crashing a terminal session or waiting on a bloated GUI application to load. This guide breaks down both commands from a real investigative and system administration perspective, not just a syntax cheat sheet.

Table of Contents

• Why Pagers Matter in Security Work
• more vs less: What's the Real Difference
• Using more: Commands and Navigation
• Using less: Commands and Navigation
• Real-World Scenario: Chasing a Brute-Force Attempt
• Advanced less Techniques for Analysts
• Best Practices for Safe Log Review
• Expert Tips
• Related Articles
• FAQ
• Conclusion

Why Pagers Matter in Security Work

Log files in enterprise environments are rarely small. Authentication logs, web server access logs, firewall logs, and application logs can easily reach hundreds of megabytes or several gigabytes during an active incident. Opening a file that size in a standard text editor can consume all available memory, freeze a remote SSH session, or simply take far too long when time matters most.

Pagers like more and less solve this by loading content incrementally rather than pulling the entire file into memory at once. For a SOC analyst working inside a jump box or a hardened bastion host with limited resources, this isn't a convenience — it's often the only practical way to review data at all.

more vs less: What's the Real Difference

more is the older, simpler utility. It scrolls forward through a file one page or line at a time but offers very limited backward navigation. less was built as a more capable replacement — the name itself is a play on the old Unix phrase "less is more." It supports scrolling in both directions, live searching, line numbering, and even following files that are actively growing, which makes it far better suited to real-time log monitoring.

In most modern Linux distributions, less is the default pager for tools like man and git log, but more still shows up on minimal systems, containers, and older Unix variants, so knowing both is worth the five minutes it takes to learn them.

Using more: Commands and Navigation

Start with the basics. To view a file page by page:

more file.txt

This displays the contents of the file one screen at a time, which is useful when you just need a quick read-through without any advanced search capability. Use it when you're on a minimal system image or a container that may not have less installed.

Space

Pressing the space bar moves to the next page of output. This is the primary way to page forward through a long file.

Enter

Pressing Enter moves down exactly one line at a time, which is helpful when you need finer control than a full page jump, such as when scanning line-by-line for a specific timestamp pattern.

q

Pressing q exits the pager and returns you to the shell prompt. Expect no output — the terminal simply returns to normal.

Using less: Commands and Navigation

For anything beyond a quick read, less is the tool analysts reach for. Open a file with:

less file.txt

Unlike more, this lets you scroll both forward and backward freely, which matters enormously when you're cross-referencing timestamps or re-checking a line you just scrolled past.

/keyword

This searches forward through the file for the specified keyword. During an investigation, this is how you'd quickly jump to every occurrence of a suspicious IP address, username, or error code, such as /Failed password in an auth log.

?keyword

This searches backward from your current position. It's especially useful when you've scrolled deep into a file and need to trace an event's origin without restarting the search from the top.

Arrow Down / Arrow Up

These move the view down or up one line at a time, giving precise control when you're reading closely rather than skimming.

Page Down / Page Up

These jump forward or backward by a full screen, which is faster than arrow keys when you're scanning large sections for a pattern before narrowing your search.

g

Jumps immediately to the beginning of the file. Expected result: the view resets to line one, useful when you need to check log rotation headers or the file's initial timestamp.

G

Jumps immediately to the end of the file. This is one of the most-used shortcuts in incident response, since the most recent — and often most relevant — log entries sit at the bottom.

q

Exits less and returns to the shell, identical in behavior to quitting more.

Real-World Scenario: Chasing a Brute-Force Attempt

Picture a typical SOC workflow: a SIEM alert fires indicating repeated failed SSH logins against a production server. The analyst SSHes into the box and needs to confirm the alert against raw evidence before escalating. Instead of copying a multi-gigabyte log file off the box — which risks tipping off an attacker with persistence on the host, and violates good forensic hygiene — the analyst opens it directly with less.

From there, jumping to the end of the file with G shows the most recent entries first. A forward search for the suspected source IP using / quickly confirms the volume and timing of failed attempts. If the analyst needs to see whether the same IP succeeded at any point, a search for Accepted password or Accepted publickey narrows it down in seconds. None of this requires downloading the file, installing extra tooling, or risking a memory-heavy GUI editor crashing the session — which matters when you're working against the clock on a live host.

Advanced less Techniques for Analysts

Beyond the basics, a few flags turn less into a genuinely powerful triage tool:

less -N file.txt

This displays line numbers alongside the content. When you need to reference an exact line in a report, or hand off a location to another analyst, this removes ambiguity — "check line 4,821" is far more precise than "somewhere near the middle."

less +F logfile.log

This follows a growing file in real time, similar to tail -f, but with the added benefit that you can still scroll back through history without losing the live-follow behavior when you press Ctrl+C and then resume. This is genuinely useful for watching an active log during a live incident without switching tools.

less file1.txt file2.txt

This opens multiple files in a single session, letting you navigate between them with :n for next file and :p for previous. This is handy when comparing logs from two related hosts side by side, such as a web server and its load balancer.

less -I file.txt

This enables case-insensitive searching, so a search for admin also matches Admin or ADMIN. This matters more than it seems in log analysis, since usernames and hostnames in real environments are rarely consistently cased.

ls -la | less

Piping command output directly into less is one of the most common patterns in daily SOC work. Any command producing more output than fits on one screen — directory listings, process lists, grep results — benefits from being piped into less rather than scrolling through unpaged terminal output.

Best Practices for Safe Log Review

A few habits separate careful analysts from ones who accidentally introduce risk during an investigation:

• Avoid editing production log files directly. Pagers are read-only by design, which protects log integrity during an active investigation — never open evidence in a full editor unless you intend to preserve a working copy first.
• Prefer piping filtered output (via grep, awk, or cut) into less rather than scrolling through raw files, which reduces the chance of missing relevant entries in noisy logs.
• Use less -N when documenting findings for a report or ticket, since exact line references make peer review and chain-of-custody documentation far easier.
• When working on shared or production systems, remember that less +F holds a file handle open — always exit cleanly with q rather than killing the terminal session.

Expert Tips

• Combine less with grep -n for a quick line-numbered pre-filter before opening the full file, especially on logs exceeding a few hundred megabytes.
• Set export LESS='-N -I' in your shell profile if you review logs frequently — this makes line numbers and case-insensitive search the default without retyping flags each time.
• On minimal Docker or Alpine-based containers, check for less availability first; many stripped-down images only ship more or omit pagers entirely, requiring a package install before use.

Related Cybersecurity Topics You Should Explore

• JFrog Artifactory Hacked: Attackers Are Minting Admin Tokens
  
• tail -f Explained: The Linux Command That Beats Your SIEM's Delay
  
• Brave Browser Now Hides Your Real Email From Every Website
  
• D-Link Router Flaw Lets Hackers Steal Your Wi-Fi Password
  
• 'This Blog Has Been Locked' — How to Backup Blogger the Right Way
  
• cPanel Zero-Day Lets Hackers Seize Root Control of Your Server
  
• TP-Link Kasa Vulnerability Lets Hackers Hijack Your Smart Home Devices
  
• CVE-2026-16444: The TeamViewer Bug That Turns File Transfer Into RCE
  
• Hackers Weaponize Fake Resumes to Hijack PCs Silently
  
• 8.7M Airport Customers Breached — Are You One of Them?
  
• Claude Code Opus 5 Auto Mode Hijacked via Prompt Injection Attack
  
• A Broken Bluetooth Headset Exposed AliExpress's Secret Tracker

Frequently Asked Questions

What is the main difference between more and less in Linux?

more only scrolls forward through a file, while less allows scrolling in both directions, live keyword searching, and following files that are actively growing.

Why do SOC analysts prefer less over text editors for log review?

Because less loads content incrementally instead of pulling an entire file into memory, it handles multi-gigabyte log files without freezing the terminal or risking a system crash during time-sensitive investigations.

Can less follow a log file in real time like tail -f?

Yes. Running less +F logfile.log follows new content as it's written, while still allowing you to scroll back through earlier entries when needed.

How do I search for a specific keyword inside less?

Press / followed by your keyword and Enter to search forward, or ? followed by your keyword to search backward from your current position.

Is less installed by default on all Linux systems?

Not always. Many minimal container images and stripped-down distributions only include more by default, so less may need to be installed separately depending on the environment.

How do I view line numbers while reading a file in less?

Use less -N file.txt to display line numbers alongside each line, which is useful when documenting exact locations for a report or handoff.

Can I open more than one file at once with less?

Yes. Running less file1.txt file2.txt opens both files in a single session, letting you switch between them with :n and :p.

Conclusion

Pagers like more and less might not carry the appeal of a flashy SIEM dashboard, but they're some of the most reliable tools in a SOC analyst's daily toolkit. Knowing how to move quickly through massive log files, search precisely, and follow live data without straining system resources is a foundational skill that pays off during every incident — especially the ones that start at 2 AM with a wall of raw log data and a ticking clock. Master these two commands, and you'll never dread opening a huge log file again.