Linux Tail Command

Introduction

Before discussing Linux tail command, let's briefly understand-What is Tail Command ?

The tail command displays the latest part of one or more files or piped data (10 lines by default). It can also be used to keep track of real-time file modifications.

The tail command is frequently used to monitor and analyze logs and other files that change over time, usually in conjunction with other tools such as grep.

We'll show you how to use the Linux tail command with examples and full explanations of the most frequent tail parameters in this tutorial. We will also address a few FAQs on Linux tail command.

Tail Command Syntax

Let's go through the basic syntax of the tail command before we get into how to utilize it.

The tail command syntax is written as follows:

tail [OPTION]... [FILE]...

OPTION - tail options. In the next sections, we'll go over the most frequent options.
FILE - Name of one or more input files. tail will read the standard input if no FILE is supplied or if FILE is -.

How to Use the Tail Command

When used without any options, the tail command displays the last 10 lines in its most basic form.

tail filename.txt

Display a Specific Number of Lines

To set the number of lines to be displayed, use the -n (--lines) option:

tail -n <NUMBER> filename.txt

You can also use simply the hyphen (-) and the number instead of the letter n. (with no space between them).

You would use the following command to display the latest 50 lines of a file named filename.txt:

tail -n 50 filename.txt

The following example will produce the same result as the commands above:

tail -50 filename.txt

Display a Specific Number of Bytes

Use the -c (--bytes) option to display a given number of bytes.

tail -c <NUMBER> filename.txt

To display the latest 500 bytes of data from the file filename.txt, for example, type:

tail -c 500 filename.txt

You can also define the number of bytes to be displayed by appending a multiplier suffix to the number. b multiplies it by 512, kB multiplies it by 1000, K multiplies it by 1024, MB multiplies it by 1000000, M multiplies it by 1048576, and so on.

The following program will reveal the filename.txt last two kilobytes (2048):

tail -c 2k filename.txt

How to Watch a File for Changes

Use the -f (--follow) option to keep an eye on a file for changes:

tail -f filename.txt

This feature is especially handy for keeping track of log files. For example, you could use the following command to display the last 10 lines of the /var/log/nginx/error.log file and watch it for updates:

tail -f /var/log/nginx/error.log

Ctrl+C will interrupt the tail command while it is viewing a file.

Use the -F option to keep monitoring the file once it is regenerated.

tail -F filename.txt

When the tail command is used to follow a rotating log file, this option comes in handy. The tail command, when used with the -F option, will reopen the file as soon as it becomes available again.

How to Display Multiple Files

The tail command will display the last ten lines from each file if multiple files are given as input.

tail filename1.txt filename2.txt

The same choices as to when viewing a single file are available.

The final 20 lines of the files filename1.txt and filename2.txt are shown in this example:

tail -n 20 filename1.txt filename2.txt

How to Use Tail with Other Commands

By using pipes to redirect standard output from/to other utilities, the tail command can be used in conjunction with other commands.

To monitor the apache access log file and only show lines containing the IP address 192.168.42.12 for example, type:

tail -f /var/log/apache2/access.log | grep 192.168.42.12

The top 10 running processes, organized by CPU consumption, can be found with the ps command:

ps aux | sort -nk +3 | tail -5

FAQs on Linux Tail Command

How does the `tail` command work?

The tail command reads the specified file and outputs the last portion of it. By default, it displays the last 10 lines, but this can be adjusted using options.

How do I use the `tail` command to display the last 10 lines of a file?

To display the last 10 lines of a file using tail, simply provide the filename as an argument. For example, tail filename will show the last 10 lines of the filename file.

Can I customize the number of lines displayed with `tail`?

Yes, you can use the -n or --lines option followed by a number to specify the number of lines to display. For example, tail -n 20 filename will display the last 20 lines of the filename file.

How can I continuously monitor a file with `tail`?

To continuously monitor a file and display additional lines as they appear, use the -f or --follow option. For example, tail -f filename will display new lines appended to the filename file in real time.

Can `tail` display lines in reverse order?

No, the tail command is designed to display lines from the end of a file. If you need to display lines in reverse order, you can pipe the output of tail to the tac command (which reverses lines).

Can `tail` follow log files that are rotated or renamed?

Yes, the -F or --follow=name option is used to follow files even if they are rotated. This option enables tail to continue reading a file even if it is renamed or truncated.

How can I display a specific number of characters instead of lines with `tail`?

You can use the -c or --bytes option followed by a number to display a specific number of bytes. For example, tail -c 100 filename will display the last 100 bytes of the filename file.

Conclusion

You should now be able to use the Linux tail command with confidence. It works in tandem with the head command, which displays the first few lines of a file on the terminal.

If you have any queries, please leave a comment below and we’ll be happy to respond to them.