الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

tail

Show the last lines of files, and follow a log file live while it grows.

المستوى
امتحان RHCSA
المجموعة
النصوص والبحث
يحتاج root
لا
الحزمة
coreutils

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

tail prints the last 10 lines of a file. With -n you choose how many. With -f (follow) it keeps the file open and prints new lines as they come: the classic way to watch a log while you test something.

-F is like -f, but it also keeps working when the log file is rotated (renamed and recreated).

طريقة الكتابة

tail [OPTION]... [FILE]...

الخيارات 13

الأكثر استخدامًا

-n, --lines=[+]num
Print the last NUM lines. With a plus: start at line NUM.
-f, --follow[={name|descriptor}]
Keep printing new lines as the file grows.
-F
Same as --follow=name --retry: keep following after log rotation.
-c, --bytes=[+]num
Print the last NUM bytes (or from byte NUM with +).
--retry
Keep trying to open a file that is not there (yet).
--pid=pid
With -f: stop when this process ends.
-s, --sleep-interval=n
With -f: check every N seconds.
--max-unchanged-stats=n
With --follow=name: reopen the file after N checks without change.
-q, --quiet, --silent
Do not print file name headers.
-v, --verbose
Always print file name headers.
-z, --zero-terminated
Lines end with NUL.
--help
Show help.
--version
Show the version.

أمثلة 11

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1The last 10 lines

    tail /var/log/messages

    The newest events of a log.

  2. 2The last 50 lines

    tail -n 50 /var/log/secure

    Recent logins and sudo use.

  3. 3Watch a log live

    tail -f /var/log/messages

    Press Ctrl+C to stop. Open it in a second terminal while you restart a service.

  4. 4Follow a log that is rotated

    tail -F /var/log/httpd/access_log

    Keeps following when logrotate makes a new file.

  5. 5Watch several logs at once

    tail -f /var/log/secure /var/log/messages

    A header shows which file each line comes from.

  6. 6Watch only errors

    tail -f /var/log/messages | grep --line-buffered -i error

    --line-buffered makes grep print each line at once.

  7. 7Everything from line 100 to the end

    tail -n +100 big.log

    Skip a header or the first part.

  8. 8Remove the header line of a CSV

    tail -n +2 export.csv > data-only.csv

    Starts at line 2.

  9. 9Stop following when a process ends

    tail -f build.log --pid=$(pgrep -n make)

    Ends by itself when the build is done.

  10. 10Follow failed SSH logins live

    tail -F /var/log/secure | grep --line-buffered "Failed password"

    Live view of a brute-force attack.

  11. 11Watch a deployment log in a container host

    tail -f /var/log/containers/web-*.log

    Same idea works for any app that writes to files.

انتبه

  • On RHEL, many services log only to the journal. If a file in /var/log stays empty, use journalctl -f.
  • tail -f on a rotated file stops showing new lines; use -F.

نصائح للحفظ

  • tail -f = live. tail -F = live, survives rotation. tail -n +2 = skip the first line.