Linux tail Command Tutorial With Examples
Linux have a lot of tools to display file content.
tail etc. are some of them. They have different features and usage areas. Tail is mainly developed and used to display end of file. We will look different features and usage examples of tail command
tail [OPTION]... [FILE]...
$ tail --help
We will start simply tailing a file. We will use one of the log file which resides in
/var/log directory. We will tail
auth.log file which provides authentication related logs. Tail command by default prints last 10 lines of the provided file and quit.
$ tail /var/log/auth.log
Specify Count Of Lines To Display
In previous example we have not provided any option or parameter to specify the number of lines to display from end of file. So tail only display last 10 lines by default. But we can specify the count of lines with
-n option. In this example we will show last 25 lines of the
$ tail -n 25 /var/log/auth.log
Specify Count Of Bytes To Display
Up to now in the examples we have specified the line count but there is another type of metric to display file tails. We can specify the count of bytes to display from end of the file. We will use
-c parameter to specify byte count. In this example we will show only 200 bytes from end of
$ tail -c 200 /var/log/auth.log
As we can the the output is very less because each character is counted as one byte.
Display Multiple Files
In some situations we may need to display multiple files in a single
tail command. There is all ready this feature in tail command. Just add other files at the end of the tail command. In this example we will list files
$ tail -n 25 /var/log/auth.log /var/log/syslog /var/log/dpkg.log
As we can see each file content is separated with delimiters and file name like below.
==> /var/log/syslog <==
Display Newly Added Lines or Follow
One of the most used feature of the tail command is following files. This feature is generally used for log files for debugging and troubleshooting. With this option tail will not quit after printing file end. It will wait for more content which will added to the file in real time. If some more content is added to the file the content will be displayed with tail. In this example we wait new logs for
$ tail -f /var/log/auth.log
We login to the system
ubu2 at 07:21:59 and new logs are created and added to the
auth.log file. This logs are displayed by tails automatically in real time. Tail tracks the
auth.log file for changes.
In some situations we may have a lot of logs to look but searching only some text in the logs. We need some filtering mechanism to look at the end of file. Here we will use external tool
grep to filter logs. We will filter only lines those contains text
ismail int the last 10 lines of
$ tail /var/log/auth.log | grep ismail
Specify Sleep Time While Following
Following or tracking is done is real time. Real time means whenever some text appended to the end of file this text will printed by tail. If there are a lot of input and reading this input is effecting performance of the system we need more relaxing option. Here we can specify the interval for following file. Added lines will be printed not real time. They will be printed in specified interval. In the following example we will use 2 seconds as interval value.
$ tail -s 2 -f /var/log/auth.log
Specify Try To Read Count
While reading an input some times problems will occur which can prevent reading of files. If a problem related reading occurs the tail will exit by default. We can change this behavior by setting some retry. This options can be set with
retry option. In the example we will read
auth.log with retry option.
$ tail --retry -f /var/log/auth.log
Quit From Interactive Tail
Without following a file tail will automatically exit. But if tail follows a file it will work for forever. If we want to exit and kill tail
CTRL+c shortcut can be used in a console.
Remove Header Line
Previously we have looked to tailing multiple files. While using multiple files there will be some delimiter used to set start of the separate file also provides the name of the file. This header line can be removed with
$ tail -n 5 -q /var/log/auth.log /var/log/syslog /var/log/dpkg.log