Linux Tail Command

The tail command shows the final section (10 lines by default) of one or more files or piped data. It may be additionally used to monitor the file changes in real-time.

One of the most typical applications of the tail command is to observe and analyze logs and other files that change over time, generally paired with additional tools like grep.
This tutorial will teach you how to use the Linux tail command with practical examples and extensive explanations of the most frequent tail parameters.

Tail Command Syntax

Before delving into how to utilize the tail command, let’s start by examining the fundamental syntax.

The tail command expressions assume the following form:

tail [OPTION]... [FILE]...

OPTION - tail options. We will go through the most frequent possibilities in the following sections.
FILE - Zero or more input file names. If no FILE is supplied, or when FILE is -, tail will read the standard input.

How to Use the Tail Command

In its simplest form, the tail command will show the previous 10 lines when used without any argument.

tail filename.txt

How to Display a Specific Number of Lines

Use the -n (—lines) option to select the number of lines to be shown:

tail -n <NUMBER> filename.txt

You may alternatively skip the letter n and use simply the hyphen (-) and the number (with no space between them) (with no space between them).

To show the last 50 lines of a file called filename.txt, you would use:

tail -n 50 filename.txt

The following example will produce the same result as the above commands:

tail -50 filename.txt 

How to Display a Specific Number of Bytes

Use the -c (—bytes) option to display specified bytes.

tail -c <NUMBER> filename.txt 

For example, to show the last 500 bytes of data from the file called filename.txt, you would use:

tail -c 500 filename.txt

You may also add a multiplier suffix after the number to define the number of bytes to be presented. b multiplies it by 512, kB multiplies it by 1000, K multiplies it by 1024, MB multiplies it by 1000000, M multiplies it by 1048576, and so on.

The following program will show the last two kilobytes (2048) of the file filename.txt:

tail -c 2k filename.txt 

How to Watch a File for Changes

To watch a file for changes, use the -f (—follow) option:

tail -f filename.txt 

This feature is very handy for monitoring log files. For example, to show the latest 10 lines of the /var/log/nginx/error.log file, and monitor the file for changes you would use:

tail -f /var/log/nginx/error.log 

To interrupt the tail command while viewing a file, use Ctrl+C.

To monitor the file when it is regenerated, use the -F option.

tail -F filename.txt 

This option is helpful in instances where the tail command is tracking a log file that rotates. When used with the -F option, the tail command will reopen the file when it becomes accessible again.

How to Display Multiple Files

If many files are supplied as input to the tail command, it will show the latest 10 lines from each file.

tail filename1.txt filename2.txt 

You may use the same parameters as to when showing a single file.

This sample displays the last 20 lines of the files filename1.txt and filename2.txt:

tail -n 20 filename1.txt filename2.txt

How to Use Tail with Other Commands

The tail command may be used in tandem with other commands by diverting the standard output from/to other utilities via pipes.

For example, to monitor the apache access log file and only show those lines that include the IP address 192.168.42.12, you would use:

tail -f /var/log/apache2/access.log | grep 192.168.42.12 

The following ps command will list the top 10 running processes ordered by CPU usage:

ps aux | sort -nk +3 | tail -5 

Conclusion

By now, you should have a decent knowledge of how to utilize the Linux tail command. It is supplementary to the head command, which publishes the first lines to the terminal.