What I know and use regularly

I love how I can add commands to less with the +-parameter from the commandline. I like this for instant searching:

$ less +/DHCP /var/log/syslog
# result: syslog at the point of the first occurrence of DHCP

Yet I also like to set it to follow the output like this:

$ less +F /var/log/syslog
# result: a syslog that follows the file, very much like tail -f would.

What I would like to use

But every once in a while I'd like BOTH. But I do not have any Idea how to do it.

$ less +F +/DHCP /var/log/syslog
# result: "Pattern not found" - it will actually bunch up both things to one string.

Bonus Points to anyone who can tell me how I can automatically filter without having to press at the beginning?

$ less +\&DHCP /var/log/syslog
# result: "please press enter" after which the filtering search _is_
# running correctly. I would love to get rid of that extra <enter>

edit2: Funny is, that i can combine these:

$ less +?DHCP +G /var/log/syslog
# result: jumps to the end and reverse-searches for DHCP
# But I have to press enter (which I'd like to avoid)

but i can not do this:

$ less +G +?DHCP /var/log/syslog
# this is being bunched up to ?DHCPG and subsequently not found.

So, the order seems to be important, and all strings are interpreted as if it was one?

Version info

edit here's the version of less installed on my system, but i'd be willing to install another version if neccessary!

$ less --version
less 458 (GNU regular expressions)
Copyright (C) 1984-2012 Mark Nudelman
  • If I'm interpreting your "it will actually bunch up both things to one string.", it almost sounds like you have an alias or wrapper around less that is interfering with normal processing. Because my version of less works as I think you're expecting it to. If I use both +F and +/pattern it will update the display of the file and continue to highlight new instances of "pattern". Also, please let us know which version of less you are using.
    – deltaray
    Sep 6, 2016 at 18:57
  • Looking further I learned, that I actually need a way to tell less, where the search pattern ends. This would solve the last part of the question, and I could probably then use +/DHCP[end??!]F for the first part of the question as well.
    – amenthes
    Sep 6, 2016 at 18:58
  • @deltaray Sorry, I'll update the question with the exact version shortly.
    – amenthes
    Sep 6, 2016 at 19:00
  • I have two env-vars: $ env | grep -i less LESSOPEN=| /usr/bin/lesspipe %s LESSCLOSE=/usr/bin/lesspipe %s %s and no alias for less. which gives /usr/bin/less which is a symlink to /bin/less, which is the actual binary. Anywhere else I should look?
    – amenthes
    Sep 6, 2016 at 19:05
  • Run 'type less' to see if its an alias or function by chance. If it is not, it should say "less is hashed (/usr/bin/less)".
    – deltaray
    Sep 6, 2016 at 19:06

3 Answers 3


I don't think I understand the first part of your question based on your later comments. For me, using less +F +/pattern logfile works and continues to highlight new instances of pattern as they appear in the updated file.

As for the bonus part of your question, you can try one of the following commands:

less +\&DHCP$'\n' /var/log/syslog


less +\&DHCP^M /var/log/syslog

In that second command the ^M is generated by pressing Ctrl-V then Enter. Kinda easier to just press enter when less starts though unless you're looking to script it or something.

  • Bonus Points for explaining how to get ^M! I did not know this :)
    – amenthes
    Sep 6, 2016 at 19:18
  • and while less +F +/DHCP /var/log/syslog refuses to work for me, less +F +/DHCP^M /var/log/syslog works just fine! So I guess this answers my question!
    – amenthes
    Sep 6, 2016 at 19:20
  • 2
    THIS IS AWESOME! I CAN less +\&\!DHCP^M/kernel^MSF /var/log/syslog - which will: remove all lines with DHCP, search (and highlight) kernel, chop long lines and follow the file. Thank you so much!
    – amenthes
    Sep 6, 2016 at 19:23
  • 1
    It should be noted that one can't just copy&paste these commands! the copied ^M becomes two charactes ^ and M. The ^M has to be generated by Ctrl+V Enter. You can tell by the way they react to the backspace. The correct one will be deleted with one keystroke.
    – amenthes
    Sep 6, 2016 at 21:06

And on the massive overcomplication front: auto-tail with changeable search terms via an expect wrapper!

#!/usr/bin/env expect
# Sticky search wrapper for less; tails the given file, though with
# input of
#   /asdf
# or whatever will search for that new term then re-tail the file.
# Probably needs `less` with (the default) hilight mode enabled.

if {[llength $argv] == 0} {
  puts stderr {Usage: $argv0 [searchterm] file}
  exit 64
} elseif {[llength $argv] == 1} {
  set fname [lindex $argv 0]
  set search ""
} else {
  set fname [lindex $argv 1]
  set search [lindex $argv 0]

# FIXME soas to nix any default options (like turning off hilight) and
# on account of LESSOPEN and LESSCLOSE being security risks due to the
# defaults certain vendors set.
foreach ev [list LESS LESSOPEN LESSCLOSE] {
  if {[info exists env($ev)]} {
    unset env($ev)

match_max 999
set timeout -1

spawn -noecho less $fname
expect {
  # TODO need better way to detect that less didn't fly...
  -ex "No such file or directory" { exit }
  -re "." { }
  default { exit }

if {$search ne ""} {
  send -- "/$search\r"
send -raw "F"
interact {
  -echo -re "/(.*)\[\n\r]" {
#   send_user "DBG search $interact_out(1,string)"
    send -raw "\003\r/"
    send -- $interact_out(1,string)
    send -raw "\rF"
  • Massive overcomplication, indeed. But on the other hand: now i know about expect. Might come in handy down the road!
    – amenthes
    Sep 6, 2016 at 22:03
  • Of all the languages in the world, why TCL?
    – cat
    Sep 6, 2016 at 23:47
  • 1
    @cat because I'm reading a tcl book at the moment?
    – thrig
    Sep 7, 2016 at 0:17

From what I understand, you're wanting to read the /var/log/syslog file, and see all entries with "DHCP", and keep seeing new entries as they appear. If this is correct, it can be achieved with tail -f /var/log/syslog | grep DHCP. If my interpretation of your request is not correct, where did I go wrong?

  • Thank you for taking the time to answer. I specifically want to do this with less, for the navigational additions (using Ctrl+C to break out of the follow-mode, then using up/down, maybe refilter, also +S (chop long lines instead of word-wrapping) is not available in tail.
    – amenthes
    Sep 6, 2016 at 18:51
  • Also, in the very last part, the combination of +F and +/pattern is just an example, I'd like to learn how i can combine any possible command - if less permits it, that is.
    – amenthes
    Sep 6, 2016 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .