It's 2:47 AM and a SOC analyst is staring down a 4GB auth.log file after an SSH brute-force alert fires. Opening it in a text editor freezes the session. Every second lost matters.
This is exactly where knowing more and less instead of reaching for a GUI editor separates analysts who move fast under pressure from those who don't.
Why Pagers Matter
Enterprise log files — auth logs, web server access logs, firewall logs — routinely reach hundreds of megabytes or several gigabytes during an active incident. A standard text editor tries to load the whole file into memory, which can freeze a remote SSH session or crash a resource-limited jump box entirely.
Pagers load content incrementally instead. For an analyst working on a hardened bastion host, that's often the only practical way to review data at all.
more vs less
more is the older utility — it scrolls forward only, with very limited backward navigation. Still shows up on minimal systems and containers.
less is the more capable replacement (the name is a play on "less is more"). It supports bidirectional scrolling, live search, line numbering, and real-time file following.
Core Commands
less file.txt # open with full navigation
/keyword # search forward
?keyword # search backward
g / G # jump to start / end of file
less -N file.txt # show line numbers
less +F logfile.log # follow a growing file, like tail -f
less -I file.txt # case-insensitive search
ls -la | less # pipe command output
Real-World Use Case
During an SSH brute-force investigation, an analyst opens the auth.log directly with less, jumps to the end with G to see recent entries, then searches forward for the suspected source IP to confirm attempt volume and timing — all without downloading the file off a live host.
Full Guide
I break down every command, advanced flags, and a complete investigation walkthrough here:
https://www.xpert4cyber.com/2026/09/more-less-linux-commands-soc-analyst-guide.html
What's your go-to trick for reviewing huge log files fast?
Top comments (0)