Linux Tail Command: 10 Detailed Examples

Introduction

The tail command in Linux is used to display the last part of a file or piped data. It is particularly useful for viewing log files, monitoring real-time updates, or extracting recent data. By default, tail displays the last 10 lines of a file, but it can be customized with various options. This guide provides 10 practical examples of using tail with detailed explanations.

Basic Syntax

tail [options] [file...]

Common options include:

Option	Description
`-n N`	Displays the last N lines.
`-c N`	Displays the last N bytes.
`-f`	Follows the file, showing updates in real-time.
`-q`	Quiet mode; suppresses headers for multiple files.
`-v`	Verbose mode; shows file names as headers.

10 Examples of Using Tail

Example 1: Display Last 10 Lines of a File

View the last 10 lines of a log file, e.g., /var/log/syslog.

tail /var/log/syslog

Use Case: Check recent system activities in logs.

Example 2: Display a Specific Number of Lines

Show the last 20 lines of a file using the -n option.

tail -n 20 /var/log/syslog

Use Case: Review more lines for detailed debugging.

Example 3: Monitor a File in Real-Time

Use -f to follow a file as it grows, ideal for live logs.

tail -f /var/log/apache2/access.log

Use Case: Monitor web server access in real-time. Press Ctrl+C to stop.

Example 4: Display Last N Bytes

Show the last 100 bytes of a file using -c.

tail -c 100 /var/log/messages

Use Case: Useful for binary files or when line counts are irrelevant.

Example 5: View Multiple Files

Display the last 10 lines of multiple files, with headers for clarity.

tail -v /var/log/syslog /var/log/auth.log

Output Example:

==> /var/log/syslog <==
[10 lines of syslog]
==> /var/log/auth.log <==
[10 lines of auth.log]

Use Case: Compare recent entries across multiple logs.

Example 6: Suppress Headers for Multiple Files

Use -q to avoid file name headers when tailing multiple files.

tail -q /var/log/syslog /var/log/auth.log

Use Case: Cleaner output when combining logs for analysis.

Example 7: Combine with Other Commands

Pipe tail output to grep to filter specific lines.

tail -n 50 /var/log/syslog | grep "error"

Use Case: Find recent errors in a log file.

Example 8: Display Lines from a Specific Position

Use +N to start displaying from the Nth line of the file.

tail -n +100 /var/log/syslog

Use Case: Skip the first 99 lines and show the rest, useful for large files.

Example 9: Monitor with a Delay

Use --sleep-interval with -f to control the polling interval (in seconds).

tail -f --sleep-interval=2 /var/log/syslog

Use Case: Reduce CPU usage when monitoring logs with less frequent updates.

Example 10: Tail and Save to a File

Redirect the output of tail to a new file for analysis.

tail -n 100 /var/log/syslog > recent_syslog.txt

Use Case: Save recent log entries for sharing or offline analysis.

Advanced Tips

Combine with watch: Periodically run tail to refresh output.
```
watch -n 5 tail -n 10 /var/log/syslog
```
Updates every 5 seconds with the last 10 lines.
Stop Following After Inactivity: Use --max-unchanged-stats with -f.
```
tail -f --max-unchanged-stats=5 /var/log/syslog
```
Stops after 5 checks with no file changes.
Handle Rotated Logs: Use --follow=name to follow a file by name, not descriptor.
```
tail -f --follow=name /var/log/syslog
```
Continues tailing even if the file is rotated.

Conclusion

The tail command is a versatile tool for viewing and monitoring file content, especially logs. These examples demonstrate its flexibility, from basic line extraction to real-time monitoring and advanced filtering. Experiment with these commands to enhance your Linux workflow.