Chapter Objective
Use wildcards, redirection, and pipes to work efficiently with files, view file content without opening an editor, and archive and compress files for storage or transfer.
Key Commands
catlessheadtailtargzipdudf
Use wildcards, redirection, and pipes to work efficiently with files, view file content without opening an editor, and archive and compress files for storage or transfer.
catlessheadtailtargzipdudfThe shell expands special characters into matching file names before a command ever runs — a process called globbing. This lets you operate on many files at once without typing each name.
| Wildcard | Matches |
|---|---|
* | Zero or more of any character |
? | Exactly one of any character |
[abc] | Any single character in the set: a, b, or c |
[a-z] | Any single character in the range a through z |
[!abc] | Any single character not in the set |
# All files ending in .log ls *.log # Any file named report, followed by exactly one character, .txt ls report?.txt # Files starting with an uppercase letter ls [A-Z]* # Files NOT starting with a dot (the shell's default anyway) ls [!.]*
rm *.tmp is expanded by the shell into a full list of matching files before rm ever sees it. Always check what a wildcard will match with ls first, especially before pairing it with rm.
# Print an entire file to the terminal cat /etc/hostname # Page through a longer file, one screen at a time less /var/log/messages # Show just the first 10 lines (default) of a file head /etc/passwd # Show just the first 3 lines head -n 3 /etc/passwd # Show just the last 10 lines tail /var/log/messages # Follow a log file live as new lines are appended tail -f /var/log/messages # Count lines, words, and bytes in a file wc -l /etc/passwd
cat dumps the whole file at once — fine for a short config file, painful for a multi-thousand-line log. Reach for less or tail instead once a file gets long.
By default, a command reads from standard input and writes to standard output and standard error. The shell lets you redirect any of these to a file, or connect one command's output directly into another's input.
| Operator | Effect |
|---|---|
> | Redirect standard output to a file, overwriting it |
>> | Redirect standard output to a file, appending to it |
2> | Redirect standard error to a file |
< | Redirect a file's content in as standard input |
| | Pipe: send one command's output into the next command's input |
# Save command output to a new file, overwriting any existing content ls -l /etc > etc-listing.txt # Append instead of overwriting echo "New line" >> notes.txt # Send only error messages to a separate file find / -name "*.conf" 2> errors.log # Pipe output from one command into another ls -l /etc | less # Chain multiple commands together cat /etc/passwd | grep student | wc -l
> (overwrite) and >> (append) cold — using the wrong one against a file you meant to preserve is a classic, avoidable mistake.
Beyond the basics from the previous chapter, cp and mv support options that make bulk operations safer and more transparent.
# Prompt before overwriting an existing file cp -i report.txt /backups/ # Never overwrite an existing file cp -n report.txt /backups/ # Only copy if the source is newer than the destination cp -u report.txt /backups/ # Show each file as it's copied cp -v *.log /backups/ # Preserve permissions, ownership, and timestamps cp -p original.conf original.conf.bak
-i to cp or mv. A confirmation prompt is a lot cheaper than a lost file.
tar (tape archive) bundles multiple files and directories into a single file, preserving directory structure, permissions, and ownership. It's the standard way to package files for backup or transfer on Linux.
# Create an archive (c = create, v = verbose, f = file) tar -cvf backup.tar /etc/ssh # List the contents of an archive without extracting tar -tvf backup.tar # Extract an archive into the current directory tar -xvf backup.tar # Extract into a specific directory tar -xvf backup.tar -C /tmp/restore/
tar handles bundling; compression tools handle shrinking. tar can invoke a compressor automatically with an extra flag.
| Tool | tar flag | Extension | Notes |
|---|---|---|---|
gzip | -z | .tar.gz / .tgz | Fast, most common default |
bzip2 | -j | .tar.bz2 | Better compression, slower |
xz | -J | .tar.xz | Best compression, slowest |
# Create a gzip-compressed archive in one step tar -czvf backup.tar.gz /etc/ssh # Extract a gzip-compressed archive (tar auto-detects the format too) tar -xzvf backup.tar.gz # Compress a single file directly, replacing it with a .gz version gzip largefile.log # Decompress it back gunzip largefile.log.gz
tar can usually detect gzip, bzip2, or xz compression automatically on extraction, so tar -xvf archive.tar.gz often works fine even without -z. Still, know the explicit flags for the exam.
Before and after large file operations, it's good practice to check how much space is actually available.
# Show disk space usage for mounted filesystems df -h # Show the total size of a directory's contents du -sh /var/log # Show sizes of each item inside a directory, human-readable du -h --max-depth=1 /home
du reports space used by files; df reports space used on the filesystem as a whole. A large deleted-but-still-open file (held by a running process) can make df show much less free space than du would suggest.
|* and ? as shell wildcards?> and >> when redirecting output to a file?/var/log/messages live as new lines are written to it.cp would make it prompt you before overwriting an existing file?tar command that creates a gzip-compressed archive named etc-backup.tar.gz from the /etc directory.du -sh and df -h report?