What I know and use regularly

I love how I can add commands to less with the +-parameter from the commandline. I like this for instant searching:

$ less +/DHCP /var/log/syslog
# result: syslog at the point of the first occurrence of DHCP

Yet I also like to set it to follow the output like this:

$ less +F /var/log/syslog
# result: a syslog that follows the file, very much like tail -f would.

What I would like to use

But every once in a while I'd like BOTH. But I do not have any Idea how to do it.

$ less +F +/DHCP /var/log/syslog
# result: "Pattern not found" - it will actually bunch up both things to one string.

Bonus Points to anyone who can tell me how I can automatically filter without having to press at the beginning?

$ less +\&DHCP /var/log/syslog
# result: "please press enter" after which the filtering search _is_
# running correctly. I would love to get rid of that extra <enter>

edit2: Funny is, that i can combine these:

$ less +?DHCP +G /var/log/syslog
# result: jumps to the end and reverse-searches for DHCP
# But I have to press enter (which I'd like to avoid)

but i can not do this:

$ less +G +?DHCP /var/log/syslog
# this is being bunched up to ?DHCPG and subsequently not found.

So, the order seems to be important, and all strings are interpreted as if it was one?

Version info

edit here's the version of less installed on my system, but i'd be willing to install another version if neccessary!

$ less --version
less 458 (GNU regular expressions)
Copyright (C) 1984-2012 Mark Nudelman
  • If I'm interpreting your "it will actually bunch up both things to one string.", it almost sounds like you have an alias or wrapper around less that is interfering with normal processing. Because my version of less works as I think you're expecting it to. If I use both +F and +/pattern it will update the display of the file and continue to highlight new instances of "pattern". Also, please let us know which version of less you are using. – deltaray Sep 6 '16 at 18:57
  • Looking further I learned, that I actually need a way to tell less, where the search pattern ends. This would solve the last part of the question, and I could probably then use +/DHCP[end??!]F for the first part of the question as well. – amenthes Sep 6 '16 at 18:58
  • @deltaray Sorry, I'll update the question with the exact version shortly. – amenthes Sep 6 '16 at 19:00
  • I have two env-vars: $ env | grep -i less LESSOPEN=| /usr/bin/lesspipe %s LESSCLOSE=/usr/bin/lesspipe %s %s and no alias for less. which gives /usr/bin/less which is a symlink to /bin/less, which is the actual binary. Anywhere else I should look? – amenthes Sep 6 '16 at 19:05
  • Run 'type less' to see if its an alias or function by chance. If it is not, it should say "less is hashed (/usr/bin/less)". – deltaray Sep 6 '16 at 19:06

I don't think I understand the first part of your question based on your later comments. For me, using less +F +/pattern logfile works and continues to highlight new instances of pattern as they appear in the updated file.

As for the bonus part of your question, you can try one of the following commands:

less +\&DHCP$'\n' /var/log/syslog


less +\&DHCP^M /var/log/syslog

In that second command the ^M is generated by pressing Ctrl-V then Enter. Kinda easier to just press enter when less starts though unless you're looking to script it or something.

  • Bonus Points for explaining how to get ^M! I did not know this :) – amenthes Sep 6 '16 at 19:18
  • and while less +F +/DHCP /var/log/syslog refuses to work for me, less +F +/DHCP^M /var/log/syslog works just fine! So I guess this answers my question! – amenthes Sep 6 '16 at 19:20
  • 2
    THIS IS AWESOME! I CAN less +\&\!DHCP^M/kernel^MSF /var/log/syslog - which will: remove all lines with DHCP, search (and highlight) kernel, chop long lines and follow the file. Thank you so much! – amenthes Sep 6 '16 at 19:23
  • 1
    It should be noted that one can't just copy&paste these commands! the copied ^M becomes two charactes ^ and M. The ^M has to be generated by Ctrl+V Enter. You can tell by the way they react to the backspace. The correct one will be deleted with one keystroke. – amenthes Sep 6 '16 at 21:06

And on the massive overcomplication front: auto-tail with changeable search terms via an expect wrapper!

#!/usr/bin/env expect
# Sticky search wrapper for less; tails the given file, though with
# input of
#   /asdf
# or whatever will search for that new term then re-tail the file.
# Probably needs `less` with (the default) hilight mode enabled.

if {[llength $argv] == 0} {
  puts stderr {Usage: $argv0 [searchterm] file}
  exit 64
} elseif {[llength $argv] == 1} {
  set fname [lindex $argv 0]
  set search ""
} else {
  set fname [lindex $argv 1]
  set search [lindex $argv 0]

# FIXME soas to nix any default options (like turning off hilight) and
# on account of LESSOPEN and LESSCLOSE being security risks due to the
# defaults certain vendors set.
foreach ev [list LESS LESSOPEN LESSCLOSE] {
  if {[info exists env($ev)]} {
    unset env($ev)

match_max 999
set timeout -1

spawn -noecho less $fname
expect {
  # TODO need better way to detect that less didn't fly...
  -ex "No such file or directory" { exit }
  -re "." { }
  default { exit }

if {$search ne ""} {
  send -- "/$search\r"
send -raw "F"
interact {
  -echo -re "/(.*)\[\n\r]" {
#   send_user "DBG search $interact_out(1,string)"
    send -raw "\003\r/"
    send -- $interact_out(1,string)
    send -raw "\rF"
  • Massive overcomplication, indeed. But on the other hand: now i know about expect. Might come in handy down the road! – amenthes Sep 6 '16 at 22:03
  • Of all the languages in the world, why TCL? – cat Sep 6 '16 at 23:47
  • 1
    @cat because I'm reading a tcl book at the moment? – thrig Sep 7 '16 at 0:17

From what I understand, you're wanting to read the /var/log/syslog file, and see all entries with "DHCP", and keep seeing new entries as they appear. If this is correct, it can be achieved with tail -f /var/log/syslog | grep DHCP. If my interpretation of your request is not correct, where did I go wrong?

  • Thank you for taking the time to answer. I specifically want to do this with less, for the navigational additions (using Ctrl+C to break out of the follow-mode, then using up/down, maybe refilter, also +S (chop long lines instead of word-wrapping) is not available in tail. – amenthes Sep 6 '16 at 18:51
  • Also, in the very last part, the combination of +F and +/pattern is just an example, I'd like to learn how i can combine any possible command - if less permits it, that is. – amenthes Sep 6 '16 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.