Assorted less(1) tips | Hacker News Reader

Assorted less(1) tips

blog.thechases.com

238 pointstodsacerdoti55 comments

Surprised they missed follow! It’s a bit odd to use, but once you get used to it it’s better than tail in many circumstances IMO. `less +F` starts less following stdin or whatever file argument you’ve provided. <C-c> breaks following, allowing you to search around a business-as-usual `less` session. Hitting `F` (that’s uppercase) starts following again. Yes, you can just start following within a session with `F` too if you forgot to add +F to the `less` invocation.

I'm so mad that I didn't know the hitting F thing!

It would be nice to have a mode that follows in the sense of automatically picking up new output, but that simultaneously would let you navigate around, similar to how terminals behave. Then you’d only need an autoscroll toggle for when you’re at the bottom.

Take a look at "lnav" ...

To elaborate on this, lnav (https://lnav.org) is always polling files to check for new data and will load it in automatically. It does not require the user to do anything.

As far as following the tail of the file: if the focused line is at the end of the file, the display will scroll automatically; otherwise, the display will stick to the current position. Also, if there is a search active, matches in the new data will be found and highlighted.

> autoscroll toggle

This exists on IBM keyboards and is called 'Pause'. Sadly most programs don't use it.

With `tail` you can press enter a few times to put some empty lines after the last line. This is useful e.g. when you trigger a function multiple times and want to easily see line groups from each attempt. It's the only reason I still use `tail` for following when `less` is available.

A visual mark would be nice, agreed. I haven't tried it, but I wonder if you could approximate it with the bookmarking feature that less(1) does have. It wouldn't be visible, but it would scroll to a consistent mark.

I usually use tail when I need to do some ad-hoc log following.

Having to set bookmarks and remember them is a PITA I can usually do without. If I'm looking at "normal" log output, it's usually set up in a nice aggregator somewhere, where I can easily exclude noise and otherwise uninteresting output.

If you're following a pipe (such as `kubectl logs | less +F`), <C-c> is sent to all processes in a pipeline, so it stops less from following and it stops the other process entirely. Then you can't start following again with F, or load more data in with G.

Less provides an alternative of <C-x> to stop following, but that is intercepted by most shells.

> Less provides an alternative of <C-x> to stop following, but that is intercepted by most shells.

WoW, thanks a lot! That was my pain for many years. C-x works in Gnome Console just fine.

Funnily enough, it literally tells you right there on the bottom line: “Waiting for data... (^X or interrupt to abort)”. No shame in not noticing, just another case of blindness to long-familliar messages I guess.

By the shell or by the kernel’s terminal discipline or by the terminal emulator? AFAIU the shell is basically out of the picture while `less` is running.

I can <C-z> while less is running to background that process using the shell, so the shell is clearly not completely gone.

I might be misremembering, but I think I just had to rebind <C-x> in zsh to get less working.

I think by "out of the picture" PP meant that the shell is not processing the input, not that it has exited.

C-z is not processed by the shell but by the terminal "infrastructure".

You can disable it, or change the key binding, and a lot more, with stty(1).

> I can <C-z> while less is running to background that process using the shell, so the shell is clearly not completely gone.

The shell isn’t gone, but it isn’t active either from what I understand. The function of converting the user’s typing ^Z on a terminal (or a ^Z arriving on the master end of a pseudoterminal) into a SIGTSTP signal to the terminal’s foreground process group is[1] a built-in function of the kernel, much like for ^C and SIGINT or ^\ and SIGQUIT. (The use of ^Z resp. ^C or ^\ specifically, as well as the function being active at all, is configurable via a TTY ioctl wrapped by termios wrapped in turn by `stty susp` resp. `stty intr` or `stty quit`.) So is the default signal action of stopping (i.e. suspending) the process in response to that signal. The shell just sees its waitpid() syscall return and handles the possibility of that having happened due to the process stopping rather than dying (by updating its job bookkeeping, making itself the foreground process group again, and reëntering the REPL).

I am not saying that doing job control by filtering the child’s input would be a bad design in the abstract, and it is how terminal multiplexers work for instance. I admit the idea of kernel-side support for shell job control is pretty silly, it’s just how it’s traditionally done in a Unix system.

[1] https://www.gnu.org/software/libc/manual/html_node/Concepts-...

Whew! Advanced Unix system programming level stuff. I've dabbled a bit in that field, in C, on Unix, some older versions on PCs. It was fun. Any recommendation for a tutorial style book or site or blog on the subject, other than man pages and the Kerrisk book (TLPI, which is more of a reference), for Linux?

Maybe OT, but I thought for a long time that "follow" was some sophisticated file descriptor trickery that required you to somehow "stream" the file while reading and would therefore be incompatible with opening a file "normally".

My mind was blown when finding out its really just "keep on polling after EOF". Meaning there is absolutely no difference between opening a file normally and "following" a file - and software could easily switch between the two "modes" on the fly.

> It’s a bit odd to use

I would say it's a bad UX and not just odd. I can't see any benefit to making it modal. It should just load new data as it becomes available without making the user do anything.

Also -X or --no-init

" ... desirable if the deinitialization string does something unnecessary, like clearing the screen."

I prefer to not clear the screen. I usually want to continue to refer to something or even copy/paste from the content to my current command line.

And combined with -E, it'll quit immediately if the output is smaller than the terminal size.

...And combined with some of the other options in the post, my go-to has been "less -SEXIER" for a long time. Specifying E twice doesn't seem to do anything except make this easier to remember.

I'm reading it correctly that it will cause less to exit if you scroll until the end of file even if the file is larger than the terminal size?

Yeah; in both cases (text is larger or smaller than terminal) it makes "less" act the same as "more" with auto-exiting.

I hate -E. Quitting immediately does not do good things to my muscle memory. I’m using to hitting q to quit less when I am done. Now the q key becomes part of the input to the shell prompt (or worse if there’s a different tool invoking less and now q might be interpreted differently by that tool). I value the consistency of user interaction more than saving a keystroke.

I recommend -FX instead of -EX. They both quit immediately if the output is smaller than the screen size, but -FX does not quit if the output is larger and you jump to the end of a large file, so you can continue to do things like scroll back or search.

git uses "less -FRX" by default. This is how I learned about -F.

(To be pedentic, git uses "LESS=FRX less", which accomplishes the same thing.)

If you want the `-X` behavior only some of the time, see https://news.ycombinator.com/item?id=46472859. (Maybe I should've posted it in this thread)

The tip that I've been using quite a lot lately by debugging long log files is using `&` to filter what I want to read and `&!` to filter-out what's not useful (and they support regexes).

Admittedly, they are a bit slow sometime and sure, you could use `grep -v` then pipe which is way faster, but they've saved me on removing noise from logfiles from time to time when you don't always know what to filter beforehand :).

EDIT: It was in TFA.

Two things that have helped me a lot of times:

-L: skip preprocessing the input file. When opening rotated log files with the names like logfile.1, logfile.2... the default preprocessor on some distros will recognize them as man page source and helpfully pipe through nroff. If the file is largish this introduces an annoying pause. Using -L skips all that.

Ctrl-R as the first character of a search string will search for that literal string, not the regular expression. Nice if you have regex metacharacters in the search string and don't want to bother with escaping (and don't need the regex facilities, of course.)

There's a way to make `^q` quit `less` and not clear the screen (like `less -X`), while `q` quits `less` and clears the screen (like normal `less`).

1. Do `echo '^q toggle-option -redraw-screen\nq' >> ~/.config/lesskey`

2. Make sure `less` is invoked without `-X` (or with `-+X` if you want to be sure).

This `^q` command is particularly useful for `git log` output and other things where you might need to refer back to them in the next terminal command you do. (In fact, `git` uses `less -FRX` by default, so you'd need to override its config to use `less -FR` instead for the above to work as intended). The `q` command is useful when you don't want to lose what you had on the screen before invoking `less`.

Actually, it would be more correct to do

    echo '^q toggle-option -redraw-on-quit\nq' >> ~/.config/lesskey

The original version I suggested works too, but by accident. `redraw-on-quit` is the actual option name.

(I'd edit my original message, but it's too late for that)

----

Also, note that if you put `--redraw-on-quit` into your `LESS` config (and not `-X`), and set up `^q` as above, things will still work but with flipped behavior of `q` and `^q`.

If your version of `less` is new enough, I believe that the `--redraw-on-quit` behavior is in every way (slightly) better than the `-X` behavior. In addition to the above, some terminals have special behaviors in alternate screen (like converting mouse wheel to up/down keys), which `--redraw-on-quit` will preserve.

Less can be configured with a ~/.lesskey file

I have a single line in my config[1] which binds s to back-scroll, so that d and s are right next to each other and I can quickly page up/down with one hand.

If you’re on macOS, you may not be able to use this unless you install less from Homebrew, or otherwise replace the default less.[2]

[1] https://github.com/jez/dotfiles/blob/master/lesskey#L2

[2] https://apple.stackexchange.com/questions/27269/is-less1-mis...

I also like to bind N to next-file. Really burns my britches that MacOS doesn't have lesskey.

Maybe I missed it, is there no love for the piping to an external command?

I set a mark, move to somewhere else, then save the area between where I am and the mark: ma(assign mark "a" to position), jjj(move three lines away), |a(pipe from current-position to the "a" mark then a ! prompt appears so enter...) cat >somefile (which dumps the selected text, cur-pos to mark "a", into somefile).

That was great for saving snippets of news or emails.

Also, the -j setting. Sets the line position for searches so context is available, eg using -j8 means the search is 8 lines from the top of the screen.

I use the piping feature of less to add some interactivity to git-log.

When a commit is "selected" (at the top line of the screen), usually after a series of n/N, I can press a shortcut that invokes an action on this commit.

Currently, I use it for two things:

1. Running git-show on a commit I'm interested in. The cool thing is that once I quit the git-show's less, I'm back to where I was in git-log's less. They stack.

2. fixup-ing a commit, after verifying with the command from 1. that it really is the one I want. I've had enough problems with git-absorb and git-fixup that I prefer to do it myself.

I detect when a particular command is running[1] and set up keyboard shortcuts that send key sequences to less and ultimately lead to the top line of the screen being piped to a short script of mine that extracts the commit hash and does something with it.

[1]: via a debug trap in bash, which sets the terminal title, which, in turn, is detected by keyd-application-mapper; other setups are possible, I used to use tmux for that.

Don't forget that you can enable syntax highlighting/file rendering(like pdf, markdown) in less with lesspipe https://github.com/wofr06/lesspipe. It is exteremely useful and improves readability a lot. What's nice is that this functionality is typically disabled in pipes, so you can be sure that your script will behave as intended.

You may also have to specify "-R" for less such that ANSI escape sequences are honoured.

(I usually invoke this when viewing jq output, a JSON data formatter / query tool.)

True. To combat that you can define a variable LESS with default options in your config file. In my case, I have export LESS='-R --quit-if-one-screen -i' (interpret escape sequences, cat input instead of showing it in a pager if it fits on a screen, enable smart-case searching)

One of the more obscure things OpenBSD man does is provide tags to the pager(less). So you can do things like ":t test" in man ksh and end up right at that section.

However while I think the feature is neat, a clever use of an existing feature, I never use it. I think it is sort of the same as info pages and why the technologically superior solution sort of lost to the stupider simpler man pages. Having a simple uniform interface "press / to search, all information in one document" is far less cognitively distracting than the better system.

And final thoughts: if unfamiliar the bsd's use the mdoc set of troff macros to build semantic man pages. sort of like how latex lets you build semantic documents on the tex typesetting engine. Where linux man pages are usually plain troff. OpenBSD actually went one step further and now uses a specific mandoc program to render them rather than the troff + mdoc macros that was used before.

https://man.openbsd.org/mdoc

> The ! lets you invoke an external command.

Also useful for privilege escalation...

If a script running as root uses less (or vi), just do "!bash" and you have a root shell. Note that systems that let you do this are usually pretty weak, and there are often many other ways to get root access, but this is a particularly simple one that I used a few times in the past.

You can disable things like this by setting the environment variable `LESSSECURE` to `1`. You can also compile `less` without these features [0], but I don't think most distros provide a restricted `less` by default.

[0]: https://github.com/gwsw/less/blob/master/README#L67-L70

You can also press `s` to save data from a pipe to a file rather than manually copy pasting.

I came here to suggest the same! It's incredibly handy and I use it all the time at work: there's a process that runs for a very long time and I can't be sure ahead of time if the output it generates is going to be useful or not, but if it's useful I want to capture it. I usually just pipe it into `less` and then examine the contents once it's done running, and if needed I will use `s` to save it to a file.

(I suppose I could `tee`, but then I would always dump to a file even if it ends up being useless output.)

Some of these come intuitively when you know how to use vim. I expect to be able to search when pressing / in terminal programs, just like I expect Ctrl+F to work in GUIs.

There -R to quit if the file is less than the screen size. There's also most as an alternative pager, and also glow (of course which, my fork of it is better) to render md files in the terminal.

Oh I see what you mean about glow, that looks like a nice UX improvement - I'm going to try your fork.

https://github.com/charmbracelet/glow/compare/master...fragm...

I like less and found that https://github.com/noborus/ov can be a good modern alternative to it.

Looks cool! Annoyingly less sometimes bugs out and starts spinning, have to kill it from the outside.

Another nice one is moor (née moar): https://github.com/walles/moor

> I've got more less tips than the Bible's got Psalms

But there are (at least) 150 Psalms! You're going to need more less tips to match that.

My biggest problem with less(1) is that the regex engine is unreasonably slow. When processing large files, I frequently need to search with grep (or more recently, rip-grep) with large -A/-B buffers, and then pipe that through less, because the regex engine in less won't find what I want on any reasonable time scale.

One thing I find myself wanting is an emacs-lite alternative to less/more. Something that would let me page though a file, but use my emacs bindings to search, filter, browse etc. I've already built up my muscle memory, so it would be great if I could reuse it for this purpose.

Thought I'd tag along to this submission and see if anyone has a recommendation?

Answering my own question after a brief wiki walk from most (referenced in another comment) -> pagers -> Terminal Pager.

`emacs -nw -e "(view-mode)"`

I've been using less for years, still learned a few things from the article and comments. I used less + PCRE (for pattern highlighting) for many years for detailed code analysis. It was a great way to get "down in the weeds" and really explore the code. less' bookmarks were another key microtool in that work.

If you want security, unset LESSOPEN

s/assorted/useful/

Reply on news.ycombinator.com