ls command in Linux: read ls -l, show hidden files, sort by size and list only directories

ls                 # names in the current directory
ls -la             # long list, hidden files included
ls -lh             # human-readable sizes
ls -lhS            # biggest first
ls -ltr            # oldest first, newest at the bottom
ls -d */           # only directories
ls -R              # everything below, directory by directory

Every output block below was run on one of our Debian 12 servers with GNU coreutils 9.1 and bash 5.2.15, inside a small test tree in a scratch directory (a web root with a log, a backup, a symlink called current and a file with a space in its name). The other systems follow their manuals and package pages, named in the text.

How to read ls -l output, column by column

$ ls -la
total 40
drwxr-xr-x 6 root root      4096 Nov  2 02:31 .
drwxr-xr-x 4 root root      4096 Nov  2 03:13 ..
drwxr-xr-x 2 root root      4096 Nov  1 12:00 .git
-rw-r--r-- 1 root root         2 Nov  2 02:30 .htaccess
-rw-r--r-- 1 root root 146800640 Mar 14  2025 backup.tar.gz
lrwxrwxrwx 1 root root        19 Nov  1 12:00 current -> releases/2026-11-01
-rw-r--r-- 1 root root      1080 Oct 30 09:15 index.html
drwxr-xr-x 3 root root      4096 Nov  1 22:40 logs
-rw-r--r-- 1 root root         6 Nov  2 02:30 my notes.txt
drwxr-xr-x 3 root root      4096 Nov  1 12:00 releases
-rwxr-xr-x 1 root root        18 Nov  2 02:30 run.sh
drwxr-xr-x 2 root root      4096 Oct 12 17:05 uploads

Take one line apart, the one for the shell script:

-rwxr-xr-x  1  root  root  18  Nov  2 02:30  run.sh
|\_/\_/\_/  |   |     |    |   |             |
| |  |  |   |   |     |    |   |             name (symlinks add "-> target")
| |  |  |   |   |     |    |   modification time
| |  |  |   |   |     |    size in bytes
| |  |  |   |   |     group
| |  |  |   |   owner
| |  |  |   hard link count
| |  |  others: r-x
| |  group: r-x
| owner: rwx
file type: - regular file

The total line is not the sum of the sizes. It is the disk space the listed files occupy, in blocks of 1 KiB with GNU ls. In the test tree, backup.tar.gz reports 140 MiB yet the total is 40, because that file (and logs/app.log) was created with truncate and is sparse: it has a size but no blocks on disk yet. VM disk images and some database files behave the same way. ls -s shows the allocated blocks per file, and du agrees with it:

$ ls -l logs/app.log; du -h logs/app.log; du -h --apparent-size logs/app.log
-rw-r--r-- 1 root root 26214400 Nov  1 22:40 logs/app.log
0	logs/app.log
25M	logs/app.log

Two variants of the long format help in scripts and audits: ls -g leaves out the owner, ls -o the group. To change what the owner and group columns say, see the chown guide.

ls hidden files: -a and -A

Linux has no hidden attribute. A name that starts with a dot is left out of a plain ls, and that is all “hidden” means. Three ways to see them:

$ ls -a
.
..
.git
.htaccess
backup.tar.gz
...
$ ls -A
.git
.htaccess
backup.tar.gz
...
$ ls -ld .[!.]*
drwxr-xr-x 2 root root 4096 Nov  1 12:00 .git
-rw-r--r-- 1 root root    2 Nov  2 02:30 .htaccess

• ls -a (all) shows everything, including . (this directory) and .. (the parent).
• ls -A (almost all) leaves out . and .., which is the one you want most of the time.
• ls -ld .[!.]* shows only the hidden entries. The -d matters: without it, ls would print the contents of .git instead of the line for .git itself. Since bash 5.2 the simpler ls -d .* also works, because the new default globskipdots no longer lets .* match . and ..; bash before 5.2 lists both.

The same rule applies to the shell: * skips dot files, so rm * or cp * leaves .htaccess and .env behind. Moving a website to a new server is where that bites; shopt -s dotglob makes bash include them.

Sort by size, time, extension or version

With no option, ls sorts by name. The order follows your locale: our server runs LANG=C.UTF-8, which sorts by character code, so capitals come before lower case. Locales such as en_US.UTF-8 use dictionary order, and LC_COLLATE=C ls forces the byte order anywhere.

ls sort by size: -S

$ ls -lhS
total 24K
-rw-r--r-- 1 root root 140M Mar 14  2025 backup.tar.gz
drwxr-xr-x 3 root root 4.0K Nov  1 22:40 logs
drwxr-xr-x 3 root root 4.0K Nov  1 12:00 releases
drwxr-xr-x 2 root root 4.0K Oct 12 17:05 uploads
-rw-r--r-- 1 root root 1.1K Oct 30 09:15 index.html
lrwxrwxrwx 1 root root   19 Nov  1 12:00 current -> releases/2026-11-01
-rwxr-xr-x 1 root root   18 Nov  2 02:30 run.sh
-rw-r--r-- 1 root root    6 Nov  2 02:30 my notes.txt

Biggest first; add -r for smallest first. Note the three directories at 4.0K: ls sorts them by the size of the directory entry, not by what is inside. To find which directory is big, ask du:

$ du -sh */
8.0K	current/
8.0K	logs/
4.0K	releases/
180K	uploads/

On a full disk, the guide to checking disk usage on Linux takes df and du from the whole filesystem down to the one directory to clean up.

Sort by date: -t, -ltr and the newest file

$ ls -ltr
total 24
-rw-r--r-- 1 root root 146800640 Mar 14  2025 backup.tar.gz
drwxr-xr-x 2 root root      4096 Oct 12 17:05 uploads
-rw-r--r-- 1 root root      1080 Oct 30 09:15 index.html
drwxr-xr-x 3 root root      4096 Nov  1 12:00 releases
lrwxrwxrwx 1 root root        19 Nov  1 12:00 current -> releases/2026-11-01
drwxr-xr-x 3 root root      4096 Nov  1 22:40 logs
-rwxr-xr-x 1 root root        18 Nov  2 02:30 run.sh
-rw-r--r-- 1 root root         6 Nov  2 02:30 my notes.txt

-t sorts newest first; -ltr reverses it so the newest file sits at the bottom, right above your prompt, which is the habit for log and backup directories. -t uses the modification time. Combine it with -u to sort by last access, or with -c for the last status change (permissions, owner, rename). Neither is a creation time.

For the creation (birth) time, GNU ls has --time=birth since coreutils 8.32: ls -l --time=birth shows it and ls -lt --time=birth sorts by it, where the filesystem records one (ext4 does). In the test tree the files were created today and then given older dates with touch -d, so the two columns differ:

$ ls -l backup.tar.gz index.html
-rw-r--r-- 1 root root 146800640 Mar 14  2025 backup.tar.gz
-rw-r--r-- 1 root root      1080 Oct 30 09:15 index.html
$ ls -l --time=birth backup.tar.gz index.html
-rw-r--r-- 1 root root 146800640 Nov  2 03:41 backup.tar.gz
-rw-r--r-- 1 root root      1080 Nov  2 03:41 index.html

stat shows the same value on its Birth: line. Note that a copy or a restore from backup is a new file with a new birth time, even when it keeps the old modification time.

By extension, version or not at all

$ ls
backup-1.sql
backup-10.sql
backup-11.sql
backup-2.sql
backup-9.sql
$ ls -v
backup-1.sql
backup-2.sql
backup-9.sql
backup-10.sql
backup-11.sql

• -v sorts numbers inside names naturally, so backup-10 comes after backup-9.
• -X groups by extension (everything without one first, then .gz, .html, .sh, .txt).
• --group-directories-first keeps directories (and symlinks to them) at the top and still sorts each group by the other options.
• -U does not sort at all and prints entries in directory order, which is the fast choice in a directory with hundreds of thousands of files.

Human-readable sizes: -h, --si and --block-size

$ ls -lh backup.tar.gz
-rw-r--r-- 1 root root 140M Mar 14  2025 backup.tar.gz
$ ls -lh --si backup.tar.gz
-rw-r--r-- 1 root root 147M Mar 14  2025 backup.tar.gz
$ ls -l --block-size=K index.html "my notes.txt"
-rw-r--r-- 1 root root 2K Oct 30 09:15 index.html
-rw-r--r-- 1 root root 1K Nov  2 02:30 my notes.txt

-h counts in powers of 1024 (the M means MiB), --si in powers of 1000, the way disk vendors count. --block-size=K, M or G fixes the unit for every line so the column lines up, but it rounds up: a 6-byte file shows as 1K and a 1,080-byte file as 2K.

ls only directories

$ ls -d */
current/
logs/
releases/
uploads/
$ ls -p | grep /
logs/
releases/
uploads/
$ find . -mindepth 1 -maxdepth 1 -type d -printf '%f\n'
releases
.git
uploads
logs

Three answers, and they disagree on purpose:

• ls -d */: the shell expands */ to every directory, and -d tells ls to print those names instead of opening them. It includes current, a symlink that points to a directory, and skips hidden directories. Add .*/ (ls -d */ .*/) to include them, or use ls -ld */ for the long format.
• ls -p | grep /: -p appends a slash to directories only, so the symlink drops out. ls -p | grep -v / is the opposite: everything that is not a directory.
• find -type d: real directories only, hidden ones included, no symlinks, in directory order rather than sorted. Pipe through sort if order matters; the find guide covers the rest of its tests.

Avoid ls -l | grep '^d' in scripts: it works for a look, but it parses ls output, which the section on parsing ls explains.

ls recursive: ls -R vs tree vs find

$ ls -R
.:
backup.tar.gz
current
index.html
logs
my notes.txt
releases
run.sh
uploads

./logs:
app.log
old

./logs/old:

./releases:
2026-11-01

./releases/2026-11-01:

./uploads:
photo.jpg

ls -R lists one directory, then each subdirectory under its own heading, all the way down. ls -lR does the same in long format with a total per directory. It does not follow the current symlink, so the release is listed once. Good for a quick look at a small tree; on a big one it floods the screen: ls -R /usr printed 90,139 lines on our test server.

To search the tree rather than read it, for files over 100 MiB or files changed today, use find; it was built for that job.

List files by pattern: ls *.log, *.conf, *.d

$ ls *.txt
my notes.txt
$ ls -l /etc/*.conf | head -3
-rw-r--r-- 1 root root  3040 May 25  2023 /etc/adduser.conf
-rw-r--r-- 1 root root  6979 Oct 22 06:56 /etc/ca-certificates.conf
-rw-r--r-- 1 root root  2969 Jan  8  2023 /etc/debconf.conf
$ ls -d /etc/*.d | head -3
/etc/apparmor.d
/etc/bash_completion.d
/etc/binfmt.d
$ ls *.pdf
ls: cannot access '*.pdf': No such file or directory

ls itself knows nothing about *. The shell expands the pattern to the matching names before ls starts, and ls lists exactly those. Three things follow from that:

• A pattern that matches a directory lists its contents. ls /etc/*.d prints what is inside every .d directory; -d (ls -d /etc/*.d) prints the directory names.
• When nothing matches, bash passes the pattern on unchanged, and ls reports cannot access '*.pdf' with exit status 2.
• Patterns do not search subdirectories: ls *.log only looks in the current directory. For a whole tree, use find . -name '*.log'; with many thousands of matches, see Argument list too long below.

Useful ls options by task

ls aliases and colors on Debian and Ubuntu

If ls shows colors for you but not for root, or ll works on one server and not the next, the difference is the shell startup file, not ls. New users on both systems get /etc/skel/.bashrc, which sets:

alias ls='ls --color=auto'      # Debian 12 and Ubuntu 24.04
alias ll='ls -alF'              # Ubuntu (Debian 12: #alias ll='ls -l')
alias la='ls -A'                # Ubuntu: on; Debian: commented out
alias l='ls -CF'                # Ubuntu: on; Debian: commented out

Root on Debian gets its .bashrc from base-files, where every ls line (LS_OPTIONS, dircolors, alias ls, ll, l) is commented out, so a stock Debian install shows plain, uncolored output to root until you remove the #. Check what you are running and bypass an alias for one call:

type ls          # ls is aliased to `ls --color=auto'  (or: ls is /usr/bin/ls)
\ls -l           # backslash: skip the alias once
command ls -l    # same, and works for functions too

• --color=auto only colors a terminal. Pipe ls into less or grep and the colors disappear; ls --color=always | less -R keeps them. The default palette from dircolors is bold blue for directories, bold cyan for symlinks and bold green for executables; ~/.dircolors overrides it.
• No colors even with --color=always? Since coreutils 8.23, with neither LS_COLORS nor COLORTERM set, ls honors an empty or unknown TERM. With TERM=dumb our test printed plain names. Some minimal containers and serial consoles start that way.
• Why 'my notes.txt' has quotes. Since coreutils 8.25, ls quotes names with spaces or special characters when it writes to a terminal, so the name can be pasted back into a command. When one name in the listing is quoted, the others get a space in front to keep the columns aligned. ls -N or export QUOTING_STYLE=literal turns it off. By default, pipes and files get no quotes; -Q, -b, --quoting-style or an exported QUOTING_STYLE quote there too.

$ ls
 backup.tar.gz	 index.html  'my notes.txt'   run.sh
 current	 logs	      releases	      uploads
$ ls -N
backup.tar.gz  index.html  my notes.txt  run.sh
current        logs	   releases	 uploads

Why you should not parse ls output

ls output is made for people. A file name on Linux may contain spaces, tabs and even a newline, and ls prints them as they are when it writes into a pipe. Two lines that look fine and break:

$ for f in $(ls); do echo "[$f]"; done
[backup.tar.gz]
...
[my]
[notes.txt]
...
$ touch $'bad\nname.txt'
$ ls | wc -l
10

The loop split my notes.txt into two words, and the count says 10 for 9 visible entries because the newline in one name made two lines. A common tip, piping find into xargs ls -l, fails the same way:

$ find . -name '*.txt' | xargs ls -l
ls: cannot access './my': No such file or directory
ls: cannot access 'notes.txt': No such file or directory
$ find . -name '*.txt' -exec ls -l {} +
-rw-r--r-- 1 root root 6 Nov  2 02:30 ./my notes.txt

What to use instead, each tested on the same tree:

for f in *; do echo "[$f]"; done                     # loop: let the shell expand the glob
shopt -s nullglob dotglob; set -- *; echo "$#"       # count entries, hidden ones included
find . -mindepth 1 -maxdepth 1 -printf '.' | wc -c   # count, safe with newlines in names
stat -c '%s %y %n' -- *                              # size and date as fields you choose
find . -maxdepth 1 -type f -printf '%s\t%p\n' | sort -nr   # files by size, for a script

stat and find -printf give you exactly the fields you ask for, in a format that does not change with the locale or the age of the file (remember that the ls date column switches from time to year after six months). For a single file, stat -c '%A %U %G %s %y %n' index.html prints the same facts as one ls -l line, without the guesswork. GNU ls 9.0 added --zero for NUL-separated output, but it is not in BusyBox or older systems, so find stays the portable choice.

GNU ls vs BusyBox ls (Alpine and Docker images)

Inside an Alpine container, other BusyBox-based Docker images and initramfs shells, ls is BusyBox, one small binary that implements the common options and drops the rest. A script that runs fine on the host can then stop with an unknown option:

For scripts that have to run in both places, stick to the options in the first three rows, or call find and stat (both also exist in BusyBox, with fewer options). On Ubuntu 25.10 and later there is a third implementation: Canonical made rust-coreutils (uutils) the default, ls included, and kept a few tools such as cp, mv and rm on GNU in 26.04 LTS. Ubuntu 26.10 (October 15, 2026) moved those last ones to uutils as well; the coreutils-from-gnu package switches a system back to GNU. uutils aims at GNU compatibility; ls --version tells you which one you have before you rely on an edge case.

ls errors and what they mean

Frequently asked