How To Use Tail Command In Linux

The tail command in Linux shows the last ten lines of a file by default, but you can specify any number. Learning how to use tail command in linux is essential for anyone working with log files, monitoring real-time data, or quickly checking the end of a file. This guide will walk you through everything you need to know, from basic usage to advanced options.

Think of tail as your window into the end of a file. It’s simple, fast, and incredibly useful for system administrators, developers, and regular users alike. You don’t need to open a massive file just to see the latest entries.

Let’s get started with the basics and then move to more powerful features. By the end, you’ll be using tail like a pro.

The tail command is part of the GNU Core Utilities, so it’s available on virtually every Linux distribution. You can use it without installing anything extra.

Here’s the most basic syntax:

tail [options] [file]

If you run tail filename, it shows the last 10 lines of that file. That’s the default behavior.

Basic Usage Examples

Let’s look at some simple examples to get you comfortable.

View last 10 lines of a file:
tail /var/log/syslog
View last 20 lines:
tail -n 20 /var/log/syslog
View last 5 lines:
tail -n 5 /var/log/syslog
View all lines from line 50 onwards:
tail -n +50 /var/log/syslog

The -n option is the most common. You can also use --lines instead of -n for the same effect.

Real-Time Monitoring With The -F Option

One of the most powerful features of tail is real-time monitoring. This is perfect for watching log files as they update.

Use the -f (follow) option:

tail -f /var/log/syslog

This keeps the command running and shows new lines as they are added. Press Ctrl+C to stop.

There’s also --follow=name which follows the file by name, not by descriptor. This is useful if the file gets rotated (replaced with a new one).

For even better rotation handling, use -F (capital F). This combines -f with retries if the file becomes inaccessible.

Practical Example: Monitoring Apache Logs

If you run a web server, you can monitor access logs in real time:

tail -f /var/log/apache2/access.log

This shows every new request as it comes in. Great for debugging or seeing live traffic.

Displaying Multiple Files

You can tail multiple files at once. Just list them all:

tail -f /var/log/syslog /var/log/auth.log

Each line will be prefixed with the filename in brackets, like this:

==> /var/log/syslog <==
Jan 15 10:23:45 server kernel: [12345.678] CPU usage high
==> /var/log/auth.log <==
Jan 15 10:23:46 server sshd[1234]: Failed password for root

This makes it easy to monitor multiple logs simultaneously.

Using Tail With Other Commands (Pipes)

Tail becomes even more powerful when combined with other commands using pipes (|).

For example, to see the last 20 lines of a file and then filter for errors:

tail -n 20 /var/log/syslog | grep "error"

Or to count how many lines appear in the last 100:

tail -n 100 /var/log/syslog | wc -l

You can also pipe into tail. For instance, to see the last 5 processes:

ps aux | tail -n 5

This shows only the last 5 lines of the process list.

Controlling Output With The -Q Option

When tailing multiple files, you might not want the filename headers. Use -q (quiet) to suppress them:

tail -q -f /var/log/syslog /var/log/auth.log

This shows the lines without any filename prefixes. Clean and simple.

Using The -V Option For Verbose Output

Conversely, you can force filename headers with -v (verbose):

tail -v -n 5 /var/log/syslog

This always shows the header, even for a single file.

Combining Tail With Head

Sometimes you want a specific range of lines from the end. Combine tail with head to achieve this.

For example, to see lines 10 through 15 from the end of a file:

tail -n 15 filename | head -n 6

This takes the last 15 lines, then shows only the first 6 of those. You get lines 10-15 from the end.

Using Tail With The -C Option (Bytes)

Instead of lines, you can specify bytes with -c:

tail -c 100 filename

This shows the last 100 bytes of the file. Useful for binary files or when you need exact byte counts.

You can also use suffixes like K, M, G for kilobytes, megabytes, gigabytes:

tail -c 1M filename

This shows the last 1 megabyte of the file.

Practical Use Cases For Tail

Here are some real-world scenarios where tail shines:

Debugging applications: Watch application logs as they write errors.
Monitoring system health: Check /var/log/syslog for hardware issues.
Tracking user activity: Monitor /var/log/auth.log for login attempts.
Checking cron jobs: See if your scheduled tasks ran correctly.
Viewing the end of large files: Quickly see the latest entries in a huge CSV file.

Common Mistakes And How To Avoid Them

Even experienced users make errors. Here are a few to watch out for:

Forgetting the -f option: If you want real-time updates, don't forget -f. Otherwise, tail exits immediately.
Using -f with a static file: If the file isn't being updated, tail will just sit there. Use Ctrl+C to exit.
Mixing up -n and -c: -n is for lines, -c is for bytes. Using the wrong one gives unexpected results.
Not using -F for rotating logs: If your logs rotate, -f might stop working. Use -F to follow the file name.

Advanced Tips And Tricks

Once you're comfortable with the basics, try these advanced techniques:

Using Tail With Sed

You can use sed to print specific line ranges from the end:

sed -n '100,200p' filename | tail -n 50

This prints lines 100-200, then tails the last 50 of those.

Watching Multiple Logs With Tmux Or Screen

If you need to monitor many logs, use terminal multiplexers like tmux or screen. Open multiple panes, each running tail -f on a different log.

Using Tail With AWK

Combine tail with awk for powerful filtering:

tail -f /var/log/syslog | awk '/error/ {print $0}'

This shows only lines containing "error" in real time.

Understanding The Difference Between Tail And Head

Tail and head are complementary commands. Head shows the beginning of a file, tail shows the end. Use them together for precise control.

For example, to see lines 50-60 of a file:

head -n 60 filename | tail -n 11

This takes the first 60 lines, then shows the last 11 of those (lines 50-60).

Working With Binary Files

Tail works with binary files too, but the output might be gibberish. Use -c to control byte output:

tail -c 50 /bin/ls

This shows the last 50 bytes of the ls binary. Not human-readable, but useful for scripting.

Using Tail In Scripts

Tail is excellent for automation. Here's a simple bash script that monitors a log and sends an alert:

#!/bin/bash
tail -f /var/log/syslog | while read line; do
    if echo "$line" | grep -q "CRITICAL"; then
        echo "Critical error detected: $line" | mail -s "Alert" admin@example.com
    fi
done

This runs forever, checking each new line for the word "CRITICAL" and sending an email if found.

Performance Considerations

Tail is very efficient. It doesn't read the entire file, just the last part. For huge files (gigabytes), tail is much faster than cat or less.

However, using -f on a very active log can use some CPU. It's usually negligible, but on busy servers, consider using --sleep-interval to reduce polling frequency:

tail -f --sleep-interval=5 /var/log/syslog

This checks for new data every 5 seconds instead of every second.

Alternatives To Tail

While tail is great, there are alternatives for specific needs:

less: Use less +F filename for a similar follow mode with scrolling.
multitail: A tool for monitoring multiple logs in one window with color coding.
lnav: An advanced log viewer with search, filtering, and syntax highlighting.

But for most tasks, tail is all you need.

Troubleshooting Common Issues

Here are solutions to common problems:

Tail says "No such file": Check the file path. Use ls to verify it exists.
Tail shows nothing: The file might be empty. Use wc -l to check line count.
Tail -f exits immediately: The file might not be writable. Check permissions.
Tail -F doesn't follow rotation: Ensure the new file has the same name. Some log rotators rename files.

Summary Of Key Options

Here's a quick reference table:

Option	Description
`-n N`	Show last N lines
`-c N`	Show last N bytes
`-f`	Follow file (real-time)
`-F`	Follow by name (handles rotation)
`-q`	Quiet (no headers)
`-v`	Verbose (show headers)
`--sleep-interval=N`	Check every N seconds

Frequently Asked Questions

How Do I Use Tail To Monitor A Log File In Real Time?

Use tail -f /path/to/logfile. This shows new lines as they are added. Press Ctrl+C to stop.

Can I Tail Multiple Files At The Same Time?

Yes, just list all files: tail -f file1 file2 file3. Each line will be prefixed with the filename.

What Is The Difference Between Tail -F And Tail -F?

-f follows the file descriptor, while -F follows the file name. -F is better for rotated logs because it re-opens the file if it's replaced.

How Do I See A Specific Number Of Lines From The End Of A File?

Use tail -n 50 filename to see the last 50 lines. Replace 50 with any number.

Can I Use Tail With Pipes To Filter Output?

Absolutely. For example: tail -f /var/log/syslog | grep "error" shows only lines containing "error" in real time.

Now you have a solid understanding of how to use tail command in linux. Practice these examples on your own system. Start with simple tail -n commands, then move to -f for real-time monitoring. Combine it with grep and other tools for powerful log analysis.

Tail is one of those commands that seems simple but becomes indispensable once you master it. Whether you're debugging a server issue, monitoring application logs, or just checking the end of a file, tail is your go-to tool.

Remember the key options: -n for line count, -f for follow mode, and -F for rotation handling. With these, you can handle almost any scenario.

If you run into trouble, check the man page with man tail for full documentation. Happy tailing!