The ls Command in Linux: Flags, Sorting, and Reading the Output

ls is the first command typed in a new terminal. And one of the most superficially known: ls and ls -la, and that is usually it. Yet it has over twenty flags, several sorting modes, and output formats that are easy to parse in scripts. Here is a proper look.

Basic Output

Contents of the current directory:

ls

Contents of a specific directory:

ls /etc/nginx

Multiple directories at once:

ls /etc /var /tmp

By pattern — only .conf files:

ls /etc/nginx/*.conf

Detailed Output: the -l Flag

The most-used mode — long format:

ls -l

total 0
drwxr-xr-x 2 user user  6 Feb 28 14:25 dir1
-rw-r--r-- 1 user user  0 Feb 28 14:25 file1.txt
-rw-r--r-- 1 user user 12 Feb 28 14:25 file2.txt

Fields left to right: type and permissions (first character is type: - file, d directory, l symlink; next 9 are permissions for owner, group, others), hard link count, owner and group, size in bytes, last modification date and time, filename.

Hidden Files: the -a Flag

Linux treats files and directories starting with a dot as hidden. Plain ls does not show them:

ls -a

.bashrc, .ssh, .config and others appear. There are always two entries: . (current directory) and .. (parent).

To see hidden files without . and ..:

ls -A

Human-Readable Sizes: the -h Flag

File size in bytes is hard to read when the numbers run into millions. The -h flag converts to KB, MB, GB:

ls -lh

-rw-r--r-- 1 root root 2.8K Feb 01 nginx.conf
-rw-r--r-- 1 root root 1.4M Mar 05 access.log

Without -h, the second file would show as 1468416.

Flag Combinations

The most useful combination — all files including hidden, long format, readable sizes:

ls -lah

Show directory itself (not its contents) — useful for quickly checking permissions on a folder:

ls -ld /etc/nginx/

Sorting

By default ls sorts alphabetically. Alternatives:

By modification time (newest first):

ls -lt

By modification time (oldest first):

ls -ltr

-r inverts any sort — useful with -t to find the oldest files, or with -S to find the smallest.

By size (largest first):

ls -lS

By size (smallest first):

ls -lSr

Recursive Output: the -R Flag

Show all contents of a directory and every subdirectory inside:

ls -R /etc/nginx

On deep directory trees the output becomes massive. For tree navigation, tree is more readable:

tree /etc/nginx

Install if not available:

sudo apt-get install tree

Show Inode Numbers: the -i Flag

An inode is the unique numeric identifier of a file in the filesystem. Useful when working with hard links and during diagnostics:

ls -li

786435 -rw-r--r-- 1 root root 2893 Feb 01 nginx.conf
786436 -rw-r--r-- 1 root root  512 Feb 01 mime.types

The first column is the inode number.

Sort by Extension: the -X Flag

Group files by extension — useful in directories with mixed content:

ls -lX /var/www/html

Output Without Color for Scripts

On some servers ls is aliased to ls --color=auto. Color escape sequences break output parsing in scripts. Disable:

ls --color=never

Or call without aliases:

/bin/ls -l /path/

One File Per Line: the -1 Flag

One filename per line with no extra columns — useful for scripts and pipes:

ls -1 /etc/nginx/

Pipe to another command:

ls -1 /var/log/nginx/ | grep "access"

Quick Reference