Linux Tail Command

The tail command displays the last part (10 lines by default) of one or more files or piped data. It can be also used to monitor the file changes in real time.

One of the most common uses of the tail command is to watch and analyze logs and other files that change over time, usually combined with other tools like grep .

In this tutorial, we will show you how to use the Linux tail command through practical examples and detailed explanations of the most common tail options.

Tail Command Syntax #

Before going into how to use the tail command, let’s start by reviewing the basic syntax.

The tail command expressions take the following form:

tail [OPTION]... [FILE]...

• OPTION - tail options . We will go over the most common options in the next sections.
• FILE - Zero or more input file names. If no FILE is specified, or when FILE is -, tail will read the standard input.

How to Use the Tail Command #

In its simplest form when used without any option, the tail command will display the last 10 lines.

tail filename.txt

How to Display a Specific Number of Lines #

Use the -n (--lines) option to specify the number of lines to be shown:

tail -n <NUMBER> filename.txt

You can also omit the letter n and use just the hyphen (-) and the number (with no space between them).

To display the last 50 lines of a file named filename.txt you would use:

tail -n 50 filename.txt

The following example will display the same result as the above commands:

tail -50 filename.txt

How to Display a Specific Number of Bytes #

To show a specific number of bytes use the -c (--bytes) option.

tail -c <NUMBER> filename.txt

For example to display the last 500 bytes of data from the file named filename.txt you would use:

tail -c 500 filename.txt

You can also use a multiplier suffix after the number to specify the number of bytes to be shown. b multiplies it by 512, kB multiplies it by 1000, K multiplies it by 1024, MB multiplies it by 1000000, M multiplies it by 1048576, and so on.

The following command will display the last two kilobytes (2048) of the file filename.txt:

tail -c 2k filename.txt

How to Watch a File for Changes #

To monitor a file for changes use the -f (--follow) option:

tail -f filename.txt

This option is particularly useful for monitoring log files. For example, to display the last 10 lines of the /var/log/nginx/error.log file, and monitor the file for updates you would use:

tail -f /var/log/nginx/error.log

To interrupt the tail command while it is watching a file, press Ctrl+C.

To keep monitoring the file when it is recreated, use the -F option.

tail -F filename.txt

This option is useful in situations when the tail command is following a log file that rotates. When used with -F option the tail command will reopen the file the as soon as it became available again.

How to Display Multiple Files #

If multiple files are provided as input to the tail command, it will display the last ten lines from each file.

tail filename1.txt filename2.txt

You can use the same options as when displaying a single file.

This example shows the last 20 lines of the files filename1.txt and filename2.txt:

tail -n 20 filename1.txt filename2.txt

How to Use Tail with Other Commands #

The tail command can be used in combination with other commands by redirecting the standard output from/to other utilities using pipes.

For example to monitor the apache access log file and only display those lines that contain the IP address 192.168.42.12 you would use:

tail -f /var/log/apache2/access.log | grep 192.168.42.12

The following ps command will display the top ten running processes sorted by CPU usage:

ps aux | sort -nk +3 | tail -5

Conclusion #

By now you should have a good understanding of how to use the Linux tail command. It is complementary to the head command which prints the first lines of a file to the to the terminal.