How to Use the Linux Command tail and Its 3 Options

by

The Linux Command tail is a useful tool frequently employed in log file analysis, real-time monitoring, and more. In this post, we’ll explain the basics of using the tail command as well as some advanced options.

What is the Linux Command tail?

The tail command is a Linux command that outputs the end part of a file. It is primarily used when you need to quickly check the latest information in log files or review the last portion of any file. By default, the tail command outputs the last 10 lines of a file. However, with various options, you can adjust the number of lines displayed or monitor the file in real-time.

Basic Usage of the tail Command

The most basic usage of the tail command is as follows:

tail filename
ShellScript

For example, if you want to see the last 10 lines of a file named system.log, you would enter:

tail system.log
ShellScript

Executing this command will display the last 10 lines of the system.log file in the terminal.

Key Options

The tail command comes with several options that allow you to output a file in various ways depending on your needs. Below are some of the most commonly used options.

The -n Option: Specifying the Number of Lines to Output

By default, tail outputs the last 10 lines of a file, but the -n option lets you specify a different number of lines to display. For instance, if you want to view the last 5 lines, you would use:

tail -n 5 /var/log/syslog
ShellScript

This command will display the last 5 lines of the syslog file.

Figure 1. Linux Command tail: Specifying the Number of Lines with the -n Option
Figure 1. Linux Command tail: Specifying the Number of Lines with the -n Option

The -f Option: Real-Time File Monitoring

One of the most useful features of the tail command is the -f option. This option allows you to monitor the end of a file in real-time. As the log file updates, you can keep viewing the new entries without having to rerun the command.

tail -f system.log
ShellScript

Executing this command displays the last 10 lines of the system.log file, and as new content is added to the file, it will be shown in real-time. This feature is particularly useful for monitoring server logs in real-time. I tested it by outputting the last 5 lines and then monitored the log in real-time, observing how new entries were added.

Figure 2. Linux Command tail: Real-Time File Monitoring with the -f Option
Figure 2. Linux Command tail: Real-Time File Monitoring with the -f Option

The –retry Option: Waiting Until a File is Created

The --retry option allows the tail command to wait until a file is created, if it does not already exist, before starting the output. This is useful if you anticipate that a log file will be created later and want to start monitoring it immediately.

tail -f --retry system.log
ShellScript

When this command is executed, if the system.log file does not exist, the command will wait until the file is created, and then start real-time monitoring. I tested this by creating an a.log file and adding strings to it. The command notified me when the a.log file appeared and began monitoring its contents.

Figure 3. Linux Command tail: Waiting Until a File is Created with the --retry Option
Figure 3. Linux Command tail: Waiting Until a File is Created with the –retry Option

Hidden Feature of tail: Viewing Multiple Files Simultaneously

The tail command can also monitor multiple files at once. If you want to view several files simultaneously, simply list the file names separated by spaces.

tail -f system.log application.log
ShellScript

This command will allow you to monitor both system.log and application.log in real-time, showing updates as they occur in each file. This feature is especially useful when you need to track multiple log files simultaneously.

I tested this with the a.log file and /var/log/syslog. The command first displays the last 10 lines of each file along with their filenames.

Figure 4. Linux Command tail: Monitoring Multiple Files Simultaneously 1
Figure 4. Linux Command tail: Monitoring Multiple Files Simultaneously 1

As new entries are added to the files, the command displays which file the new log entry belongs to, and if another file updates, the command shows the filename again before displaying the new content.

Figure 5. Linux Command tail: Monitoring Multiple Files Simultaneously 2
Figure 5. Linux Command tail: Monitoring Multiple Files Simultaneously 2

Precautions When Using the tail Command

The tail command is simple and useful, but there are a few precautions to be aware of.

  • Stopping Real-Time Monitoring: When using the -f option for real-time monitoring, you must press Ctrl + C to stop monitoring before closing the terminal. If you don’t, the terminal will remain occupied by the tail command, preventing you from performing other tasks.
  • Handling Large Files: The tail command can consume significant system resources when dealing with large files, especially during real-time monitoring if a log file grows rapidly. Be mindful of this to avoid potential system slowdowns.
  • Permission Issues: When monitoring log files, you may need read permissions for the files. If you don’t have the necessary permissions, you won’t be able to use the tail command on those files, so it may be necessary to use the sudo command alongside tail.

Summary

The Linux Command tail is an extremely useful tool for quickly checking the last portion of a file or monitoring logs in real-time. By mastering basic usage as well as various options, you can manage files more efficiently.

Options like -f for real-time monitoring and -n for adjusting the number of output lines are essential to learn. Additionally, the ability to monitor multiple files simultaneously is a significant advantage. However, be mindful of system resource usage and file access permissions when using the command.

Now, leverage the power of the tail command to work more effectively in your Linux environment!

References

Leave a Comment