s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

tail

Show the last lines of files, and follow a log file live while it grows.

Level
RHCSA exam
Group
Text and search
Needs root
No
Package
coreutils

What it does

tail prints the last 10 lines of a file. With -n you choose how many. With -f (follow) it keeps the file open and prints new lines as they come: the classic way to watch a log while you test something.

-F is like -f, but it also keeps working when the log file is rotated (renamed and recreated).

How to write it

tail [OPTION]... [FILE]...

Options 13

Most used

-n, --lines=[+]num
Print the last NUM lines. With a plus: start at line NUM.
-f, --follow[={name|descriptor}]
Keep printing new lines as the file grows.
-F
Same as --follow=name --retry: keep following after log rotation.
-c, --bytes=[+]num
Print the last NUM bytes (or from byte NUM with +).
--retry
Keep trying to open a file that is not there (yet).
--pid=pid
With -f: stop when this process ends.
-s, --sleep-interval=n
With -f: check every N seconds.
--max-unchanged-stats=n
With --follow=name: reopen the file after N checks without change.
-q, --quiet, --silent
Do not print file name headers.
-v, --verbose
Always print file name headers.
-z, --zero-terminated
Lines end with NUL.
--help
Show help.
--version
Show the version.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1The last 10 lines

    tail /var/log/messages

    The newest events of a log.

  2. 2The last 50 lines

    tail -n 50 /var/log/secure

    Recent logins and sudo use.

  3. 3Watch a log live

    tail -f /var/log/messages

    Press Ctrl+C to stop. Open it in a second terminal while you restart a service.

  4. 4Follow a log that is rotated

    tail -F /var/log/httpd/access_log

    Keeps following when logrotate makes a new file.

  5. 5Watch several logs at once

    tail -f /var/log/secure /var/log/messages

    A header shows which file each line comes from.

  6. 6Watch only errors

    tail -f /var/log/messages | grep --line-buffered -i error

    --line-buffered makes grep print each line at once.

  7. 7Everything from line 100 to the end

    tail -n +100 big.log

    Skip a header or the first part.

  8. 8Remove the header line of a CSV

    tail -n +2 export.csv > data-only.csv

    Starts at line 2.

  9. 9Stop following when a process ends

    tail -f build.log --pid=$(pgrep -n make)

    Ends by itself when the build is done.

  10. 10Follow failed SSH logins live

    tail -F /var/log/secure | grep --line-buffered "Failed password"

    Live view of a brute-force attack.

  11. 11Watch a deployment log in a container host

    tail -f /var/log/containers/web-*.log

    Same idea works for any app that writes to files.

Watch out

  • On RHEL, many services log only to the journal. If a file in /var/log stays empty, use journalctl -f.
  • tail -f on a rotated file stops showing new lines; use -F.

Tips to remember

  • tail -f = live. tail -F = live, survives rotation. tail -n +2 = skip the first line.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man tail

Open the man page (linux.die.net)man7.org