Read in 4 minutes
Linux Tail Command
The tail command displays the last part (10 lines by default) of one or more files or piped data. It can be also used to monitor the file changes in real time.
One of the most common use of the tail command is to watch and analyze logs and other files that change over time, usually combined with other tools like grep.
In this tutorial, we will show you how to use the Linux tail command through practical examples and detailed explanations of the most common tail options.
Tail Command Syntax
Before going into how to use the tail command, let’s start by reviewing the basic syntax.
The tail command expressions take the following form:
tail [OPTION]... [FILE]...
OPTION- tail options. We will go over the most common options in the next sections.
FILE- Zero or more input file names. If no FILE is specified, or when FILE is
-, tail will read the standard input.
How to Use the Tail Command
In it’s simplest form when used without any option, tail will display the last 10 lines.
How to Display a Specific Number of Lines
--lines) option to specify the number of lines to be shown:
tail -n <NUMBER> filename.txt
You can also omit the letter
n and use just the hyphen (
-) and the number (with no space between them).
To display the last 50 lines of a file named
filename.txt you would use:
tail -n 50 filename.txt
The following example will display the same result as the above commands:
tail -50 filename.txt
How to Display a Specific Number of Bytes
To show a specific number of bytes pass the
tail -c <NUMBER> filename.txt
For example to display the last 500 bytes of data from the file named
filename.txt you would use:
tail -c 500 filename.txt
You can also use a multiplier suffix after the number to specify the number of bytes to be shown.
b multiplies it by 512,
kB multiplies it by 1000,
K multiplies it by 1024,
MB multiplies it by 1000000,
M multiplies it by 1048576, and so on.
The following command will display the last two kilobytes (2048) of the file
tail -c 2k filename.txt
How to Watch a File for Changes
To monitor a file for changes use the
tail -f filename.txt
This option is particularly useful for monitoring log files. For example to display the last 10 lines of the
/var/log/nginx/error.log file, and monitor the file for updates you would use:
tail -f /var/log/nginx/error.log
To interrupt the tail command while it is watching a file, press
To keep monitoring the file when it is recreated use the
tail -F filename.txt
This option is useful in situations when the tail command is following a log file that rotates. When used with
-F option the tail command will reopen the file the as soon as it became available again.
How to Display Multiple Files
If multiple files are provided as input to the tail command, it will display the last ten lines from each file.
tail filename1.txt filename2.txt
You can use the same options as when displaying a single file.
This example shows the last 20 lines of the files
tail -c 20 filename1.txt filename2.txt
How to Use Tail with Other Commands
The tail command can be used in combination with other commands by redirecting the standard output from/to other utilities using pipes.
For example to monitor the apache access log file and only display those lines that contain the IP address
192.168.42.12 you would use:
tail -f /var/log/apache2/access.log | grep 192.168.42.12
The following command will display the top ten running processes sorted by CPU usage:
ps aux | sort -nk +3 | tail -5
By now you should have a good understanding of how to use the Linux tail command.