How to Use the Tail Command in Linux

Introduction

The tail command in Linux displays the last parts of a file. The command helps you to monitor log files and view the most recent file changes in real time. The tail command supports various options that modify how the command processes and displays the output. These options are useful when monitoring and troubleshooting system issues.

In this article, you'll use the tail command in Linux to view and monitor file contents.

The tail Command Syntax

The following is a basic tail command syntax:

$ tail [options] [file]

In the above command:

• [options]: Accepts optional flags that modify the command's behavior.
• [file]: Specifies the target file you want to process.

The tail command reads content from the standard input (STDIN) if you don't specify a file, allowing you to redirect the command's output to other commands.

Check out how to use the tar command in Linux for quick file archiving and unzipping.

Most Common Linux tail Command Options

The following are the most common Linux tail command options:

Practical tail Command in Linux with Examples

This section uses practical examples to show you how to use the Linux tail command. Follow the steps below to run the samples.

1. Display the last lines in the /var/log/syslog file. By default, the tail command displays the last 10 lines.

   console Copy

   $ sudo tail /var/log/syslog
   

   Output:

   

2. Display the last n lines in the /var/log/syslog file. For example, 20 lines. The -n option overrides the default value of 10 lines.

   console Copy

   $ sudo tail -n 20 /var/log/syslog
   

   Output:

   

3. Display the last 100 bytes in the /var/log/syslog file. For example, 100 bytes.

   console Copy

   $ sudo tail -c 100 /var/log/syslog
   

   Output:

   

4. Monitor multiple files using the -f option and display new lines in real-time.

   console Copy

   $ sudo tail -f /var/log/syslog /var/log/auth.log
   

   Output:

   

   Press Ctrl + C to stop the tail command output.

5. Monitor the /var/log/auth.log file and specify the sleep interval between updates. For example, 2 seconds. This option is useful when monitoring active log files to reduce the system load.

   console Copy

   $ sudo tail -f -s 2 /var/log/auth.log
   

   Output:

   

6. Monitor the /var/log/syslog file until a specific process ID (For instance, 1234) terminates. This command is useful for automatically monitoring logs attached to a specific process.

   console Copy

   $ sudo tail -f --pid=1234 /var/log/syslog
   

   Output:

   

7. Display the last lines of a file and stop after 10 unchanged iterations. The --max-unchanged-stats option limits the number of times the tail command reopens the /var/log/syslog file if it detects no changes in the size.

   console Copy

   $ sudo tail -f --max-unchanged-stats=10 /var/log/syslog
   

   Output:

   

Advanced Linux tail Command Usage

The Linux tail command supports more advanced options to customize the output, as illustrated below:

1. Skip n number of lines from the start of the /var/log/syslog file using a positive number. For instance, display all lines starting from the 10th line in the file.

   console Copy

   $ sudo tail -n +10 /var/log/syslog
   

   Output:

   

2. Pipe the tail command output to the grep command to search for specific contents like MAC to filter log updates in real-time.

   console Copy

   $ sudo tail -f /var/log/syslog | grep 'MAC'
   

   Output:

   

3. Monitor multiple files and display headers for clarity. Showing headers makes it clear from which file each line comes from when monitoring multiple files.

   console Copy

   $ sudo tail -f -v /var/log/syslog /var/log/auth.log
   

   Output:

   

4. Use the --retry option to handle inaccessible files. For instance, retry opening the /var/log/syslog file if it's inaccessible. The option is useful when working with log files that are not available immediately or frequently rotated.

   console Copy

   $ sudo tail -f --retry /var/log/syslog
   

   Output:

   

Automate Scripts with Linux tail Command

You can use the tail command with scripts to monitor log files and act based on certain conditions. Follow the steps below to create a sample script that checks for a specific string in a log file's last 100 lines.

1. Create a new sample script file. For instance, check_log.sh using a text editor like nano.

   console Copy

   $ nano check_log.sh
   

2. Add the following contents to the check_log.sh file.

   bash Copy

   #!/bin/bash
   if tail -n 100 /var/log/syslog | grep -q 'error'; then
       echo "Error found in log file"
   fi
   

   Save and close the file.

3. Enable execute permissions on the file.

   console Copy

   $ chmod +x check_log.sh
   

4. Run the script.

   console Copy

   $ sudo bash check_log.sh
   

   The above script uses the tail command to get the last 100 lines in a log file and pipes the output to the grep command to search for the error string. If the script finds the string, it prints the Error found in log file message, which is useful when automating log monitoring tasks.

   

Use the tail Command Interactively

You can use the tail command with other commands to process the output further. Follow the steps below.

1. Combine tail with awk to extract specific fields from the last few lines of a file. For instance, use the command to display and print the second field (usually the date or time) from the last 10 lines of the /var/log/syslog log file.

   console Copy

   $ sudo tail -n 10 /var/log/syslog | awk '{print $2}'
   

   Output:

   

2. Combine tail with sort to filter the last lines of a file. For instance, sort the last 15 lines of the /var/log/syslog file.

   console Copy

   $ sudo tail -n 15 /var/log/syslog | sort
   

   Output:

   

3. Combine tail with xargs to delete files listed in the last n number of lines. For instance, display the contents of a backup.sh file and remove the last 5 files listed in the file.

   console Copy

   $ sudo tail -n 5 backup.sh | xargs rm
   

   Output:

   

4. Combine tail with head to monitor the latest log entries. For instance, display the last 50 lines of the /var/log/syslog file and extract the first 10 lines, effectively showing lines 41 through 50.

   console Copy

   $ sudo tail -n 50 /var/log/syslog | head -n 10
   

   Output:

   

Monitor Log Files in Real Time Using tail

Another useful tail command option is the -f option that monitors files in real-time. Follow the steps below.

1. Monitor the /var/log/syslog file and constantly display new entries in real-time. This option is useful when tracking system events and diagnosing issues as they occur.

   console Copy

   $ sudo tail -f /var/log/syslog
   

   Output:

   

   Press Ctrl + C to stop monitoring the file changes.

2. Monitor webserver logs if available. For example, display Nginx webserver log updates in real-time from the /var/log/nginx/access.log file.

   console Copy

   $ sudo tail -f /var/log/nginx/access.log
   

   Output:

   

Conclusion

You have used the tail command in Linux to display the last parts of files. The tail command is valuable when monitoring and troubleshooting the Linux system. You can efficiently track file updates, filter output, and automate monitoring tasks in your Linux environment using the tail command. For more information, run man tail to view more command options.