tail

Understanding the tail Command

The tail command, at its core, displays the last part of a file. Its primary application lies in observing the most recent entries in log files for system administration, debugging, and monitoring applications. Without any arguments, tail defaults to displaying the last 10 lines.

Basic Usage: Displaying the Last Lines of a File

The simplest usage involves specifying the file path:

tail mylogfile.txt

This command will show the last 10 lines of mylogfile.txt. To display a different number of lines, use the -n option:

tail -n 20 mylogfile.txt  # Displays the last 20 lines
tail -n +10 mylogfile.txt # Displays from the 10th line to the end.

Monitoring Files in Real-time: The -f Option

The truly powerful aspect of tail is its ability to monitor files for changes. The -f (or --follow) option keeps tail running, continuously updating the output as new lines are appended to the file. This is perfect for live log monitoring:

tail -f /var/log/syslog

This command will display the contents of /var/log/syslog and continuously update the output as new log entries are written. Press Ctrl+C to stop the monitoring.

Filtering Output with grep

Combine tail with grep to filter the output based on specific patterns. For example, to monitor only lines containing “error” in /var/log/apache2/error.log:

tail -f /var/log/apache2/error.log | grep "error"

This provides a focused view of error messages within the log file.

Specifying Multiple Files

tail can handle multiple files simultaneously. The file names are simply listed as arguments:

tail -n 5 file1.log file2.log file3.log

This will show the last 5 lines of each file, with a header indicating which file each section belongs to.

Advanced Usage: Following Symbolic Links and Handling Large Files

The -F option combines the functionality of -f and automatically follows renamed files. For very large files where reading the entire file is undesirable, specifying a specific number of bytes or a number of lines from the end can improve performance. For instance, to display the last 100 kilobytes of a large file named “bigfile.log”:

tail -c 100k bigfile.log

This will display only the last 100 kilobytes, avoiding the overhead of processing the entire file.

Working with Compressed Files

While tail itself doesn’t directly handle compressed files, combining it with tools like zcat (for .gz files) or bzcat (for .bz2 files) allows you to view the contents:

zcat mylogfile.txt.gz | tail -n 20

This command decompresses mylogfile.txt.gz on-the-fly and then displays the last 20 lines. Similar approach applies to other compression formats.