Linux tail command

Updated: 04/26/2017 by Computer Hope

About tail

tail outputs the last part, or "tail", of files.


tail prints the last 10 lines of each FILE to standard output. With more than one FILE, it precedes each set of output with a header giving the file name. If no FILE is specified, or if FILE is specified as a dash ("-"), tail reads from standard input.

tail syntax

tail [OPTION]... [FILE]...


In the options listed below, arguments that are mandatory for long options are mandatory for short options as well:

-c, --bytes=K Output the last K bytes; alternatively, use "-c +K" to output bytes starting with the Kth byte of each file.
-f, --follow[={name|descriptor}] Output appended data as the file grows; -f, --follow, and --follow=descriptor are equivalent. If name is specified, the file with filename name will be followed, regardless of its file descriptor.
-F Same as "--follow=name --retry".
-n, --lines=K Output the last K lines, instead of the default of the last 10; alternatively, use "-n +K" to output lines starting with the Kth.
--max-unchanged-stats=N With --follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlink'ed or renamed (this is the usual case of rotated log files).
--pid=PID With -f, terminate operation after process ID PID dies.
-q, --quiet, --silent Never output headers giving file names.
--retry Keep trying to open a file even when it is, or becomes, inaccessible; useful when following by name, i.e., with --follow=name.
-s, --sleep-interval=N With -f, sleep for approximately N seconds (default 1.0) between iterations. With --pid=P, check process P at least once every N seconds.
-v, --verbose Always output headers giving file names.
--help Display a help message, and exit.
--version Display version information, and exit.


If the first character of K (the number of bytes or lines) is a "+", tail prints the beginning with the Kth item from the start of each file; otherwise, tail prints the last K items in the file. K may have a multiplier suffix: b (512), kB (1000), K (1024), MB (1000*1000), M (1024*1024), GB (1000*1000*1000), G (1024*1024*1024), and so on for T (terabyte), P (petabyte), E (exabyte), Z (zettabyte), Y (yottabyte).

With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail'ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descriptor (for example, in a log rotation). Use --follow=name in that case. That causes tail to track the named file in a way that accommodates renaming, removal and creation.

tail examples

tail myfile.txt

Outputs the last 10 lines of the file myfile.txt.

tail myfile.txt -n 100

Outputs the last 100 lines of the file myfile.txt.

tail -f myfile.txt

Outputs the last 10 lines of myfile.txt, and monitors myfile.txt for updates; tail then continues to output any new lines that are added to myfile.txt.

tail -f access.log | grep

This is a useful example of using tail and grep to selectively monitor a log file in real time.

In this command, tail monitors the file access.log. It pipes access.log's final ten lines, and any new lines added, to the grep utility. grep reads the output from tail, and outputs only those lines which contain the IP address

cat — Output the contents of a file.
head — Display the first lines of a file.
more — Display text one screen at a time.
pg — Browse page by page through text files.