tail — Linux basic command

Linux / Basic Linux commands / tail.html

A command that outputs only the end part (the last few lines) of a file or tracks it in real time.

Basic Information

What is this command?

tail is a command that outputs only a specified number of lines (default 10 lines) from the end of a file. Using the -f option, it outputs in real time whenever new content is added to the file, making it essential for log monitoring.

While head shows the beginning of a file, tail shows the end. Using both tools together allows you to quickly understand a file's structure.

What problem does it solve?

• Checks the end of a long log file.
• Monitors logs being recorded in real time.
• Checks recent logs when an error occurs.
• Checks the results at the end of a file.

Key Features

Default 10-line output

Outputs the last 10 lines of a file.

• Use Case: When you need to quickly check recent records.
• Result: You can view the content at the end of the file.
• Limitation: If the file has fewer than 10 lines, the entire content is output.

Real-time tracking (-f)

Outputs in real time when new content is added to the file.

• Use Case: When monitoring log files in real time.
• Result: New logs are automatically displayed as they are recorded.
• Limitation: Tracking may stop if the file is deleted and recreated.

Line count specification (-n)

Specifies the number of lines to output using the -n option.

• Use Case: When you need to check a specific number of lines.
• Result: Outputs the specified number of lines.
• Limitation: Specifying 0 or a negative number will cause an error.

Simultaneous tracking of multiple files

Tracks the ends of multiple files simultaneously.

• Use Case: When monitoring multiple service logs on one screen.
• Result: New content from all files is displayed in order.
• Limitation: With many files, the screen can become cluttered.

Installation and Execution

Verify pre-installation

It is included by default in all Linux distributions.

which tail
tail --version

Installation (lightweight environments)

It is usually already installed.

sudo apt install coreutils   # Debian/Ubuntu

Practical Usage Examples

Basic output

Checks the last 10 lines of a file.

# Output last 10 lines
tail /var/log/syslog

# Multiple files
tail file1.txt file2.txt

# With a pipe
ps aux | tail -5

Line count specification

Outputs the desired number of lines.

# Only the last 5 lines
tail -n 5 /var/log/syslog

# Only the last 20 lines
tail -20 /var/log/syslog

# Last 100 recent logs
tail -100 /var/log/nginx/error.log

Real-time log monitoring

Views content being added to a file in real time.

# Real-time tracking
tail -f /var/log/syslog

# Track multiple logs simultaneously
tail -f /var/log/nginx/access.log /var/log/nginx/error.log

# Track from a specific line count
tail -n 20 -f /var/log/syslog