Linux Tail Command with Examples

linux tail command
As you may know, cat command is used in displaying the entire content of a file via standard input. But in some cases, we have to print the last part of the file. In Linux and Unix, tail command is used to display the last 10 lines (by default) of a file using standard output.

Tail command is commonly used to watch and analyze files as it can display newly appended lines. This feature is mostly used for viewing logs or other files that update time to time.

In this tutorial, we learn how to use tail command in Linux with some practical examples. We will also go through tail options in detail.

Syntax of Tail Command

The following line shows the tail command syntax:

tail [OPTION]... [FILE]...

Without any OPTION or FILE, tail command accepts input from STDIN. So at STDIN, if you enter more than 10 lines, only last 10 lines will be displayed where head command does the exact opposite of the tail command.

Tail command can accept one or more input file names (FILE).

1) Using tail command to view the last ten lines of a file

Without any option, tail command with display last 10 lines of the input file.

In following examples tail command display bottom 10 lines of the 'file1.txt' file:

$ tail file1.txt
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

2) Display Specific (limited) number of lines

If you want to display only a specific number of lines, then you have to use -n option.

We can use three different options to limit the number of lines.

The following three commands (-n100 , -n 100, -100) display the last 100 lines from the '/var/log/apache2/error.log' file:

$ tail -n100 /var/log/apache2/error.log

or

$ tail -100 /var/log/apache2/error.log

or

$ tail -n 100 /var/log/apache2/error.log

3) How to show multiple files

Tail command can display from multiple files when given as an argument. Then it outputs the last 10 lines of each file and with a header displaying the name of the file.

$ tail file1.txt file2.txt
==> file1.txt <== 
memtest86+_multiboot.bin 
System.map-2.6.38-12-generic 
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
==> file2.txt <==
smi.conf
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
tr command

If you do not want to print the headers ('==> file1.txt <==' and '==> file2.txt <=='), you can use quiet mode with -q, --quiet or --silent option. This option can be used to combine files.

$ tail -q file1.txt file2.txt

If you always want to print headers, even when only one filename is provided as argument, you can use -v or --verbose option

$ tail -v file1.txt

4) Display last Specific bytes of a file

For displaying the last specific bytes of the file, use -c or --bytes option.

The following tail command prints last 30 bytes of file2.txt file:

$ tail -c 30 file2.txt
sudoers.d
sysctl.conf
sysctl.d

Alternatively, you can use -c +number to output everything starting at byte number.

$ tail -c +300 file1.txt

5) Watch File Changes

Use -f or --follow option for monitoring file changes. This option is very commonly used for monitoring and troubleshooting log files.

The following command will display last 10 changes on the terminal for the '/var/log/Xorg.1.log' file.

$ tail -f /var/log/Xorg.1.log
[ 86.774] (**) Option "xkb_layout" "us"
[ 86.774] (**) Option "xkb_options" "terminate:ctrl_alt_bksp"
[ 86.774] (II) Toshiba input device: (II) is tagged by udev as: Keyboard
[ 86.774] (II) Toshiba input device: (II) device is a keyboard
[ 88.453] (II) Display (Seiko/Epson (DFP-0)) does not support NVIDIA 3D
[ 88.453] (II) Vision stereo.
[ 102.094] (II) Display (Seiko/Epson (DFP-0)) does not support NVIDIA 3D
[ 102.094] (II) Vision stereo.
[ 540.435] (II) Axis 0x1 value 1158 is outside expected range
See https://wayland.freedesktop.org for details

The -f option will always wait for the appended data and won’t quit by itself. You have to press Ctrl+C to exit.

Let’s try to display the last 3 lines of a tail output using the -n and f options.

$ tail -n3 -f /var/log/Xorg.1.log
[ 102.094] (II) Vision stereo.
[ 540.435] (II) Axis 0x1 value 1158 is outside expected range
See https://wayland.freedesktop.org for details

Using the -fq option you can monitor changes from multiple files.

$ tail -fq /var/log/Xorg.1.log file2.txt

With the -s or --sleep-interval (default is 1 second), you can adjust the sleep interval between the iterations.

$ tail -f -s 4 /var/log/Xorg.1.log

As mentioned above with the -f option the shell doesn't exit by itself, but you can tell the command to terminate after a process dies with the --pid option.

The command will exit as soon as the process with PID 4309 dies.

$ tail -f file2.txt --pid=4309

With the --retry option, you can keep trying to open a file even when it is, or becomes, inaccessible. Once it becomes accessible, the output will be displayed.

$ tail -f file2.txt --retry

6) Using tail with pipes

The tail command can be piped to/from other commands to produce optimized results.

The following example uses ls command to list all files and directory and list all directories at top.

$ ls -l /etc | tail | sort
drwxr-xr-x.  2 root root   4096 Mar  3 08:15 yum.repos.d
drwxr-xr-x.  2 root root   4096 Mar  3 08:17 yum
drwxr-xr-x.  2 root root   4096 Sep 25 14:54 xinetd.d
drwxr-xr-x.  4 root root   4096 Sep 25 14:54 xdg
drwxr-xr-x.  6 root root   4096 Sep 25 14:54 X11
lrwxrwxrwx.  1 root root     12 Dec 19 15:43 yum.conf -> dnf/dnf.conf
-rw-r--r--.  1 root root   1204 Nov 11 19:08 virc
-rw-r--r--.  1 root root   1982 Nov 11 19:08 vimrc
-rw-r--r--.  1 root root     28 Sep 25 14:51 vconsole.conf
-rw-r--r--.  1 root root    642 Dec  9  2016 xattr.conf

If you want to watch for requests for a particular file type use the following command:

$ tail -f /var/log/apache/myvirtualhost.log | grep .jpg

In the following example output tail command is piped and using sort command get the content of 'continent.txt' sorted in alphabetical order.

$ tail -n 5 continent.txt | sort
Africa
Antarctica
Asia
Australia
Europe

Conclusion

Now we've seen how to use the tail command and its options to display the bottom lines of a text file. I hope you enjoyed reading and please leave your suggestions in the below comment section.

Bobbin Zachariah 9:25 am

Comments

Your email address will not be published. Required fields are marked *

All comments are subject to moderation.

1 Comment