Linux tail Command: A Practical Guide with Examples

The tail command in Linux shows you the last part of a file. It is essential for monitoring log files in real-time and checking the most recent updates to any text file. This guide covers how to use it practically, from the basics to advanced real-time filtering.

Quick Reference: tail Command

• Primary Function: View the last part of a file.
• Default View: Shows the last 10 lines.
• Most Used Option: tail -f (Follows a file in real-time).
• How to Stop Following: Press Ctrl+C.

Basic Syntax of the tail Command

The basic syntax for the tail command is straightforward: tail [options] [file]

If you run the command with no options, it will simply display the last 10 lines of the specified file. tail example.txt

Core tail Command Examples

While the default is 10 lines, you can easily customize this.

How to Show a Specific Number of Lines (The -n Option)

The most common option is -n, which allows you to specify the exact number of lines you want to see.

This command will display the last 5 lines of example.txt: tail -n 5 example.txt

How to Show a Specific Number of Bytes (The -c Option)

If you need to see a specific amount of data rather than a number of lines, you can use the -c flag to specify the number of bytes.

This will show the last 20 bytes of the file: tail -c 20 example.txt

The Most Powerful Feature: Monitoring Logs in Real-Time (tail -f)

The single most valuable feature of tail is the -f (follow) option. This is the primary tool used by system administrators and developers to watch log files as new lines are written.

When you run tail -f, the command displays the end of the file and then "follows" it, printing any new lines to your terminal in real-time.

Practical Example: Tailing a System Log

To monitor the main system log for new activity, you would run:

tail -f /var/log/syslog

Your terminal will display the last few lines and then wait. As new events happen on the system, you will see them appear instantly.

How to Stop tail -f (The Most Important Step!)

This is a critical piece of experience for new users: tail -f will not stop on its own. It is designed to run continuously.

To stop the tail -f process and return to your command prompt, you must press Ctrl+C.

Advanced tail Usage and Practical Scenarios

You can combine tail with other options and commands for more powerful results.

How to Follow Multiple Files at Once

If you need to monitor multiple logs simultaneously, simply list them. tail is smart enough to show you which file is receiving the update.

tail -f /var/log/syslog /var/log/auth.log

When a new line is added to either file, it will be printed with a header, like:

==> /var/log/auth.log <== New authentication log line...

Using tail with Other Commands (Using Pipes |)

tail truly shines when combined with other commands using the "pipe" (|) operator. The pipe takes the output of one command and "pipes" it as the input for the next.

Example: Filtering a Log in Real-Time with grep

This is an advanced, everyday use case. What if you want to monitor a log file, but you only care about lines that contain the word "error"?

You can pipe the real-time output of tail -f directly into grep: tail -f /var/log/syslog | grep "error"

Now, your terminal will remain blank until a new log line containing "error" is written, making it the perfect tool for debugging.

tail vs. head: What's the Difference?

The head command is the direct opposite of tail.

• tail shows the last 10 lines of a file by default.
• head shows the first 10 lines of a file by default.

Both commands are essential for quickly inspecting files without opening a full text editor.

Related Linux Commands You Should Know

tail is part of a family of essential text-processing tools.

• head: The direct opposite, shows the beginning of a file.
• cat: (Short for concatenate) Displays the entire contents of a file.
• less: An interactive pager that lets you scroll up and down through a large file.
• find / search: While tail helps you monitor files, you might also need to find a directory on Linux or search for a specific file by name.