LearnLinux › LearnLinux › CMDS

head Command Reference Guide

Display beginning of files for previewing and data inspection

Overview

Purpose

The head command displays the first lines of a file. Default is 10 lines. Essential for quickly viewing file contents, checking log files, or sampling large datasets without loading them entirely into memory or editor.

Basic Syntax

head [options] filename

Complementary Tool

Use tail to view the end of files. Together with pipes and grep, head and tail are powerful for text processing and log analysis.

Common Options

Option Description
-n NUM Display first NUM lines (default 10)
-c NUM Display first NUM bytes
-q Quiet mode - no filename headers with multiple files
-v Always show filename headers
-NUM Shorthand for -n NUM (e.g., head -5 means first 5 lines)

10 Detailed Examples

1
Display First 10 Lines (Default)
Command
head /var/log/syslog
Jan 15 08:23:12 server kernel: [ 123.456] EXT4-fs (sda1): warning: mounting fs with errors
Jan 15 08:23:13 server systemd[1]: Started Session 142 of user root.
Jan 15 08:23:14 server sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash
Jan 15 08:23:15 server sshd[1234]: Received signal 15; terminating.
Jan 15 08:23:16 server kernel: [ 789.012] audit: type=USER_ACCT acct="testuser"
Jan 15 08:23:17 server sudo: testuser : TTY=pts/1 ; PWD=/home/testuser ; USER=root
Jan 15 08:23:18 server cron[5678]: (root) CMD (run-parts --report /etc/cron.hourly)
Jan 15 08:23:19 server kernel: [ 890.234] Out of memory: Kill process nginx
Jan 15 08:23:20 server systemd[1]: apache2.service: Main process exited
Jan 15 08:23:21 server logger: Backup completed successfully

What This Does:

Displays first 10 lines of syslog. Perfect for quick status check without opening editor or loading entire file.

Common Usage:

Quick log inspection on production systems. View error timestamps and patterns at file beginning.

2
Specify Number of Lines with -n
First 5 lines
head -n 5 /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/sys:/usr/sbin/nologin
sync:x:4:4:sync:/bin:/bin/sync
First 20 lines
head -20 /etc/passwd

What This Does:

The -n flag specifies exact number of lines. Can also use shorthand: head -5 (without the 'n'). Both are equivalent.

Shorthand Syntax:

head -5 is shorthand for head -n 5. Most admins use the shorter form.

3
Display First N Bytes with -c
First 100 bytes
head -c 100 /etc/hostname
myserver.example.com
First 500 bytes of large file
head -c 500 /var/log/apache2/access.log

What This Does:

Shows exactly N bytes instead of N lines. Useful for binary files or checking file format without line-based cutting.

Use Cases:

  • Check binary file headers
  • Partial content of large files
  • Quick format inspection
4
Multiple Files Display
Command
head -n 3 /etc/hostname /etc/hosts /etc/resolv.conf
==> /etc/hostname <=
myserver

==> /etc/hosts <=
127.0.0.1 localhost
::1 localhost
192.168.1.100 myserver.local

==> /etc/resolv.conf <=
nameserver 8.8.8.8
nameserver 8.8.4.4

What This Does:

When given multiple files, head displays them sequentially with filename headers. Useful for comparing configuration files or checking multiple logs.

Suppress Headers with -q:

head -q -n 3 /etc/hostname /etc/hosts shows content without file headers.

5
Piping from Commands with head
List first 5 largest files in directory
ls -lS /var/log | head -6
total 5242880
-rw-r----- 1 syslog adm 512000000 Jan 15 14:32 syslog
-rw-r--r-- 1 root root 250000000 Jan 15 14:31 auth.log
-rw-r--r-- 1 root root 125000000 Jan 15 14:30 kern.log
-rw-r--r-- 1 root root 75000000 Jan 15 14:29 apache2/error.log
-rw-r--r-- 1 root root 50000000 Jan 15 14:28 apache2/access.log

What This Does:

Pipes command output to head to limit results. Essential for manageable output from commands that produce many lines.

Pattern: Command | head -N

Use whenever a command's output is too large. Common with: ps, ls, grep, find, ps, locate, etc.

6
head with grep - Find Log Errors
Show first 5 ERROR entries in log
grep -i ERROR /var/log/app.log | head -5
2024-01-15 08:12:34 ERROR: Database connection timeout
2024-01-15 08:45:12 ERROR: Memory allocation failed
2024-01-15 09:23:45 ERROR: File not found: /tmp/config.ini
2024-01-15 10:01:02 ERROR: Permission denied on /var/data
2024-01-15 11:34:56 ERROR: Disk space critical (5% remaining)

What This Does:

Combines grep to find matching lines, then head to limit output. Perfect for log analysis without generating huge result sets.

Production Workflow:

This pattern is fundamental for log analysis. Find ERROR/WARNING entries, view first 5-10, identify patterns, then investigate specifics.

7
head with tail - Middle Section of File
Lines 50-60 of a file
head -60 /var/log/syslog | tail -11
Jan 15 10:34:20 server systemd[1]: Started Apache HTTP Server
Jan 15 10:34:21 server kernel: [ 1234.567] apache2: new module (pid 5678)
Jan 15 10:34:22 server apache2[5678]: Apache started successfully
[... more lines ...]

What This Does:

Combines head and tail to extract middle section. Head gets first 60, tail gets last 11 from those 60 (lines 50-60).

Formula for Middle Section:

  • To get lines X to Y: head -Y file | tail -((Y-X)+1)
  • To get lines 50-60: head -60 | tail -11
8
Data Sampling with head
Sample first 1000 lines from large CSV
head -1000 /var/data/transactions.csv > /tmp/sample.csv
Check column structure
head -1 /var/data/transactions.csv
transaction_id,customer_id,amount,date,status

What This Does:

Quick sampling of large datasets. Extract first 1000 lines for testing, schema inspection, or processing without loading entire file.

Data Analysis Pattern:

Before processing large files with awk/sed/python, sample first: verify format, test transformations, catch issues early.

9
Monitor Real-Time Logs
Real-time checking (run repeatedly)
while true; do clear; head -20 /var/log/auth.log; sleep 2; done
[Latest 20 lines from auth.log refresh every 2 seconds]
Jan 15 15:23:12 server sshd[1234]: Failed password for invalid user admin from 192.168.1.50
Jan 15 15:23:13 server sshd[1234]: Received disconnect from 192.168.1.50 port 54321
[...continues updating...]

What This Does:

Combines head with a loop to monitor log file in real-time. Simpler than tail -f for just seeing the most recent lines.

Note:

For continuous monitoring, tail -f is better. This approach is useful for quick periodic checks.

10
Advanced: Process Large Dataset Preview
Extract and preview header + 5 data rows from compressed file
zcat /backups/database-dump.sql.gz | head -100 | tail -7
Count unique users in log sample
head -10000 /var/log/access.log | awk '{print $1}' | sort -u | wc -l
4523

What This Does:

Demonstrates practical production patterns: preview compressed backups, sample large logs for analysis, test data transformations without processing entire files.

Production Value:

On systems with terabyte-scale logs/backups, head prevents accidental full-file processing that could crash systems or consume hours of I/O.

head vs tail Comparison

Feature head tail
Default lines First 10 Last 10
Continuous monitoring No Yes (-f flag)
Byte mode Yes (-c) Yes (-c)
Performance on huge files Very fast (no seeking) Slower (seeks to end)
Best for logs Start of file analysis Recent activity (-f)

Common Usage Patterns

Pattern 1: Quick File Preview

head file.txt - Instantly see what's in a file without committing to full view.

Pattern 2: Log Analysis

head -100 /var/log/app.log | grep ERROR - Sample logs for errors without processing entire file.

Pattern 3: Data Sampling

head -1000 huge_dataset.csv | awk -F, '{...}' - Analyze dataset structure before full processing.

Pattern 4: Extract Section

head -N file | tail -M - Get lines between N-M positions.

Performance Notes

Head is Fast

Head doesn't read entire file; it stops after finding first N lines. On a 10GB file, getting first 10 lines is instant.

Network Efficiency

Over SSH: ssh remote 'head -100 /large/file.log' transfers only first 100 lines, not entire file.

Piping Performance

Head stops reading after first N lines, so upstream commands stop producing output. Efficient for large data streams.