Linux Tail Command
The tail command shows the final section (10 lines by default) of one or more files or piped data. It may be additionally used to monitor the file changes in real-time.
One of the most typical applications of the tail command is to observe and analyze logs and other files that change over time, generally paired with additional tools like grep.
This tutorial will teach you how to use the Linux tail command with practical examples and extensive explanations of the most frequent tail parameters.
Tail Command Syntax
Before delving into how to utilize the tail command, let’s start by examining the fundamental syntax.
The tail command expressions assume the following form:
tail [OPTION]... [FILE]...
OPTION - tail options. We will go through the most frequent possibilities in the following sections.
FILE - Zero or more input file names. If no FILE is supplied, or when FILE is -, tail will read the standard input.
How to Use the Tail Command
In its simplest form, the tail command will show the previous 10 lines when used without any argument.
How to Display a Specific Number of Lines
Use the -n (—lines) option to select the number of lines to be shown:
tail -n <NUMBER> filename.txt
You may alternatively skip the letter n and use simply the hyphen (-) and the number (with no space between them) (with no space between them).
To show the last 50 lines of a file called filename.txt, you would use:
tail -n 50 filename.txt
The following example will produce the same result as the above commands:
tail -50 filename.txt
How to Display a Specific Number of Bytes
Use the -c (—bytes) option to display specified bytes.
tail -c <NUMBER> filename.txt
For example, to show the last 500 bytes of data from the file called filename.txt, you would use:
tail -c 500 filename.txt
You may also add a multiplier suffix after the number to define the number of bytes to be presented. b multiplies it by 512, kB multiplies it by 1000, K multiplies it by 1024, MB multiplies it by 1000000, M multiplies it by 1048576, and so on.
The following program will show the last two kilobytes (2048) of the file filename.txt:
tail -c 2k filename.txt
How to Watch a File for Changes
To watch a file for changes, use the -f (—follow) option:
tail -f filename.txt
This feature is very handy for monitoring log files. For example, to show the latest 10 lines of the /var/log/nginx/error.log file, and monitor the file for changes you would use:
tail -f /var/log/nginx/error.log
To interrupt the tail command while viewing a file, use Ctrl+C.
To monitor the file when it is regenerated, use the -F option.
tail -F filename.txt
This option is helpful in instances where the tail command is tracking a log file that rotates. When used with the -F option, the tail command will reopen the file when it becomes accessible again.
How to Display Multiple Files
If many files are supplied as input to the tail command, it will show the latest 10 lines from each file.
tail filename1.txt filename2.txt
You may use the same parameters as to when showing a single file.
This sample displays the last 20 lines of the files filename1.txt and filename2.txt:
tail -n 20 filename1.txt filename2.txt
How to Use Tail with Other Commands
The tail command may be used in tandem with other commands by diverting the standard output from/to other utilities via pipes.
For example, to monitor the apache access log file and only show those lines that include the IP address 192.168.42.12, you would use:
tail -f /var/log/apache2/access.log | grep 192.168.42.12
The following ps command will list the top 10 running processes ordered by CPU usage:
ps aux | sort -nk +3 | tail -5
By now, you should have a decent knowledge of how to utilize the Linux tail command. It is supplementary to the head command, which publishes the first lines to the terminal.