tail Command

Display the last lines of files and monitor file changes in real-time for log analysis and file monitoring.

Syntax

tail [OPTIONS] [FILE...] tail -f [FILE...] tail -n NUMBER [FILE...]

The tail command displays the last part of files, making it essential for viewing log files and monitoring file changes in real-time.

Common Options

Option Description
-n NUM Display last NUM lines (default: 10)
-NUM Same as -n NUM (shorthand)
-f Follow file changes (monitor in real-time)
-F Follow with retry (handle file rotation)
-c NUM Display last NUM bytes instead of lines
-q Quiet mode (suppress headers)
-v Verbose mode (always show headers)
--pid=PID Terminate after process PID dies
-s SEC Sleep SEC seconds between iterations
--retry Keep trying to open file if inaccessible

Basic Usage

Display last lines

# Display last 10 lines (default) tail file.txt tail /var/log/syslog # Display last 20 lines tail -n 20 file.txt tail -20 file.txt # Display last 5 lines tail -n 5 /etc/passwd tail -5 /etc/passwd # Display last 100 lines tail -n 100 /var/log/apache2/access.log

Display the last lines of files

Multiple files

# Display last lines of multiple files tail file1.txt file2.txt file3.txt # Last 5 lines of multiple files tail -n 5 *.log # Multiple log files tail /var/log/syslog /var/log/auth.log # Suppress headers for multiple files tail -q file1.txt file2.txt # Always show headers tail -v file.txt

Work with multiple files simultaneously

Byte-based output

# Display last 100 bytes tail -c 100 file.txt # Display last 1KB tail -c 1024 largefile.dat # Display last 1MB tail -c 1M database.sql # Combine with other options tail -c 500 -f logfile.txt

Display files by byte count instead of line count

Real-time Monitoring

Follow file changes

# Monitor file in real-time tail -f /var/log/syslog tail -f /var/log/apache2/access.log # Follow with specific number of lines tail -n 50 -f application.log # Follow multiple files tail -f /var/log/syslog /var/log/auth.log # Follow with custom sleep interval tail -f -s 2 slowlog.txt # Stop following with Ctrl+C

Monitor files for new content in real-time

Advanced following

# Follow with retry (handle file rotation) tail -F /var/log/application.log # Follow until process dies tail -f --pid=1234 process.log # Retry opening inaccessible files tail -f --retry /var/log/secure # Follow with verbose headers tail -f -v file1.log file2.log # Follow quietly (no headers) tail -f -q *.log

Advanced real-time monitoring with special handling

Log Monitoring

System logs

# Monitor system log tail -f /var/log/syslog # Monitor authentication log tail -f /var/log/auth.log # Monitor kernel messages tail -f /var/log/kern.log # Monitor mail log tail -f /var/log/mail.log # Monitor cron jobs tail -f /var/log/cron.log

Monitor various system log files

Application logs

# Web server logs tail -f /var/log/apache2/access.log tail -f /var/log/apache2/error.log tail -f /var/log/nginx/access.log tail -f /var/log/nginx/error.log # Database logs tail -f /var/log/mysql/error.log tail -f /var/log/postgresql/postgresql.log # Application-specific logs tail -f /var/log/myapp/application.log tail -f /opt/app/logs/debug.log

Monitor application-specific log files

Custom log monitoring

# Monitor with filtering tail -f /var/log/syslog | grep ERROR tail -f /var/log/apache2/access.log | grep "404" # Monitor multiple logs with labels tail -f /var/log/syslog /var/log/auth.log # Monitor with timestamps tail -f /var/log/application.log | while read line; do echo "$(date): $line" done # Monitor and save to file tail -f /var/log/syslog | tee monitoring.log

Custom log monitoring with filtering and processing

Practical Examples

Development and debugging

# Monitor application logs during development tail -f logs/development.log # Watch for errors in real-time tail -f /var/log/myapp/error.log | grep -i error # Monitor multiple environments tail -f logs/dev.log logs/staging.log # Debug with specific line count tail -n 100 /var/log/application.log | grep "user_id=123" # Monitor API requests tail -f /var/log/nginx/access.log | grep "/api/"

Use tail for development and debugging workflows

System administration

# Monitor system performance tail -f /var/log/syslog | grep -E "(CPU|memory|disk)" # Watch for security events tail -f /var/log/auth.log | grep -E "(Failed|Invalid)" # Monitor service status tail -f /var/log/syslog | grep nginx # Check recent system messages tail -n 50 /var/log/messages # Monitor disk usage alerts tail -f /var/log/syslog | grep -i "disk\|space"

System administration tasks with tail

Log analysis and troubleshooting

# Find recent errors tail -n 1000 /var/log/application.log | grep -i error # Check last hour of activity tail -n 500 /var/log/access.log | grep "$(date '+%d/%b/%Y:%H')" # Monitor specific user activity tail -f /var/log/auth.log | grep "user=john" # Track failed login attempts tail -f /var/log/auth.log | grep "Failed password" # Monitor database connections tail -f /var/log/mysql/mysql.log | grep "Connect"

Analyze logs and troubleshoot issues

Advanced Usage

Combining with other commands

# Tail with grep for filtering tail -f /var/log/syslog | grep -i error # Tail with awk for processing tail -f /var/log/access.log | awk '{print $1, $7}' # Tail with sed for transformation tail -f /var/log/app.log | sed 's/ERROR/*** ERROR ***/' # Count occurrences in real-time tail -f /var/log/access.log | grep "404" | wc -l # Extract specific fields tail -f /var/log/nginx/access.log | cut -d' ' -f1,7

Combine tail with other commands for powerful log processing

Scripting with tail

#!/bin/bash # Log monitoring script LOGFILE="/var/log/application.log" ALERT_EMAIL="[email protected]" # Monitor for critical errors tail -f "$LOGFILE" | while read line; do if echo "$line" | grep -q "CRITICAL"; then echo "Critical error detected: $line" | mail -s "Alert" "$ALERT_EMAIL" fi done # Monitor multiple logs with rotation tail -F /var/log/app1.log /var/log/app2.log | \ while read line; do echo "$(date '+%Y-%m-%d %H:%M:%S'): $line" >> /var/log/combined.log done

Use tail in scripts for automated monitoring

Performance considerations

# Monitor large files efficiently tail -n 100 -f hugefile.log # Use byte-based tail for binary files tail -c 1024 -f binary.dat # Reduce CPU usage with longer sleep tail -f -s 5 /var/log/slowlog.txt # Monitor with process termination tail -f --pid=$$ /var/log/app.log & # Handle file rotation properly tail -F /var/log/rotated.log

Optimize tail usage for performance and resource efficiency

File Rotation Handling

Understanding file rotation

File Rotation Scenarios
  • logrotate - System rotates logs daily/weekly
  • Application rotation - Apps rotate their own logs
  • Manual rotation - Administrator moves/renames files
  • Truncation - Files are emptied but not moved

Handling rotation with tail

# Use -F for file rotation handling tail -F /var/log/application.log # Monitor rotated logs tail -F /var/log/syslog* # Follow with retry tail -f --retry /var/log/app.log # Monitor current and rotated files tail -f /var/log/nginx/access.log /var/log/nginx/access.log.1 # Script to handle rotation while true; do if [ -f /var/log/app.log ]; then tail -f /var/log/app.log fi sleep 1 done

Handle log file rotation scenarios effectively

Troubleshooting

Common Issues and Solutions
  • File not found - Check file path and permissions
  • Permission denied - Use sudo or check file ownership
  • tail stops following - File may have been rotated, use -F
  • No output - File might be empty or binary
  • High CPU usage - Increase sleep interval with -s

Debugging tail issues

# Check file existence and permissions ls -la /var/log/application.log # Test file readability head -1 /var/log/application.log # Check if file is being written to lsof /var/log/application.log # Monitor file changes stat /var/log/application.log # Check for binary content file /var/log/application.log # Verify tail is working echo "test" >> testfile.txt && tail -1 testfile.txt

Debug and resolve tail-related issues

Best Practices

tail Usage Best Practices
  • Use -F instead of -f for log files that rotate
  • Combine with grep for filtering to reduce output noise
  • Use appropriate line counts to balance detail and performance
  • Consider using less +F for interactive monitoring
  • Monitor multiple related files together for better context
  • Use scripts for automated monitoring and alerting
  • Be mindful of resource usage when monitoring large files
Performance Considerations
  • Large files - Use byte-based tail for very large files
  • Multiple files - Monitor only necessary files to reduce overhead
  • Network files - Be cautious with tail on network-mounted files
  • Binary files - Avoid tail on binary files unless using -c option
  • Resource usage - Monitor CPU and memory usage during long-running tail sessions

See also