Linux has a lot of tools to display file content. cat, less, tail, etc. are some of them. They have different features and usage areas. The tail is mainly developed and used to display the end of the file. We will look at different features and usage examples of the tail command.
tail Command Syntax
We will use following syntax for tail command.
tail [OPTION]... [FILE]...
tail Command Help
We can get help information about the tail command by providing the option --help.
$ tail --help
Print Last 10 Lines with tail Command
We will start simply tailing a file. We will use one of the log files which resides in /var/log directory. We will tail auth.log file which provides authentication-related logs. Tail command by default prints the last 10 lines of the provided file and quit.
$ tail /var/log/auth.log
Specify Count Of Lines To Display
In previous example we have not provided any option or parameter to specify the number of lines to display from end of file. So tail only display last 10 lines by default. But we can specify the count of lines with -n option. In this example we will show last 25 lines of the auth.log file.
$ tail -n 25 /var/log/auth.log
Specify Count Of Bytes To Display
Up to now in the examples, we have specified the line count but there is another type of metric to display file tails. We can specify the count of bytes to display from the end of the file. We will use -c parameter to specify byte count. In this example, we will show only 200 bytes from the end of auth.log file.
$ tail -c 200 /var/log/auth.log
As we can the the output is very less because each character is counted as one byte.
Display Multiple Files with tail Command
In some situations, we may need to display multiple files in a single tail command. There is already this feature in tail command. Just add other files at the end of the tail command. In this example, we will list files auth.log , syslog and dpkg.log .
$ tail -n 25 /var/log/auth.log /var/log/syslog /var/log/dpkg.log
As we can see each file content is separated with delimiters and file name like below.
==> /var/log/syslog <==
Display Newly Added Lines Interactively or Follow with tail Command
One of the most used features of the tail command is the following files. This feature is generally used for log files for debugging and troubleshooting. With this option, the tail will not quit after printing the file end. It will wait for more content which will be added to the file in real-time. If some more content is added to the file the content will be displayed with the tail. In this example, we wait new logs for auth.log file.
$ tail -f /var/log/auth.log
We login to the system ubu2 at 07:21:59 and new logs are created and added to the auth.log file. This logs are displayed by tails automatically in real time. Tail tracks the auth.log file for changes.
Filter Lines with tail Command
In some situations we may have a lot of logs to look but searching only some text in the logs. We need some filtering mechanism to look at the end of file. Here we will use external tool grep to filter logs. We will filter only lines those contains text ismail int the last 10 lines of auth.log
$ tail /var/log/auth.log | grep ismail
Specify Interval Value To Follow File with tail Command
Following or tracking is done in real-time. Real-time means whenever some text appended to the end of file this text will be printed by the tail. If there is a lot of input and reading this input is affecting performance of the system we need a more relaxing option. Here we can specify the interval for the following file. Added lines will be printed not real-time. They will be printed in the specified interval. In the following example, we will use 2 seconds as the interval value.
$ tail -s 2 -f /var/log/auth.log
Specify Read Retry Count
While reading an input some times problems will occur which can prevent the reading of files. If a problem-related reading occurs the tail will exit by default. We can change this behavior by setting some retry. These options can be set with a --retry option. In the example, we will read auth.log with retry option.
$ tail --retry -f /var/log/auth.log
Quit From Interactive Mode
Without following a file tail will automatically exit. But if tail follows a file it will work forever. If we want to exit and kill tail CTRL+c shortcut can be used in a console.
CTRL+c
Remove Header Line
Previously we have looked to tailing multiple files. While using multiple files there will be some delimiter used to set the start of the separate file also provide the name of the file. This header line can be removed with -q option.
$ tail -n 5 -q /var/log/auth.log /var/log/syslog /var/log/dpkg.log