tail Command in Linux Made Simple

×

You've got an application that's currently running in a production environment, and now some of its behavior isn't what you expected. You do not have enough time to load a 50MB log file into your favorite text editor.

You simply type tail -f /var/log/syslog and watch it live. This one trick has helped save my backside many times during those late-night calls.

The purpose of this tutorial is to help you master the tail command in Linux, go beyond the standard ten lines of output, and use it more effectively as a monitoring tool.

Examples

The tail command reads a file from the bottom and prints the last lines to your terminal. Think of it like opening a notebook from the back page rather than the front. When you are working with log files that grow from top to bottom, the newest entries are always at the end, and that is exactly where tail looks.

On every major Linux distribution including Ubuntu, Rocky Linux, RHEL, and Debian, tail ships as part of the GNU coreutils package. No installation needed. It is available the moment you log in. The most practical use case is watching application logs update in real time, something that gets used constantly on any live server.

tail is the command itself. [OPTIONS] are the flags you pass to change its behavior, like how many lines to show or whether to follow the file. [FILE...] is one or more file paths. You can pass multiple files and tail will print results for each one, labeling each section with the filename by default.

One thing to know upfront: when you run tail filename with no flags at all, you get the last 10 lines. That is the built-in default and it surprises a lot of people the first time they expect to see more.

The most basic use. You have a file and you want to see what is at the bottom of it. No flags needed.

Use -n when 10 lines is not enough context. You are debugging an application crash and need to see the 30 lines leading up to it. On RHEL and Rocky Linux, Apache logs live under /var/log/httpd/ rather than /var/log/apache2/.

This is the flag you will use most on a production server. The -f option keeps the connection open and prints new lines as they are written to the file. Press Ctrl+C to stop.

Combining -n with -f gives you a bigger snapshot before watching starts. Useful when you want context from the last 50 lines before watching new entries.

Pass two files to tail -F and it watches both simultaneously, reconnecting to either file if log rotation replaces them. Each section is labeled with its filename. Handy when a problem spans two services.

Log rotation is common on servers. When logrotate renames syslog to syslog.1 and creates a fresh file, tail -f keeps following the old renamed file. Use -F to track the filename, not the file descriptor. It reconnects automatically when the file is replaced.

Piping tail into grep lets you watch only specific events in a live log. This is how you monitor for errors without reading every line.

Using + before the number tells tail to skip that many lines from the top and print everything after. The plus sign behavior is something most people do not know exists.

When you want a fixed number of bytes from the end of a file rather than a line count, use -c. This comes up when parsing binary files or testing write positions.

When you pass multiple files to tail, it labels each section with the filename. The -q flag removes those headers. Useful when piping combined output elsewhere.

If you are running a backup script and want to watch its log output until it finishes, use --pid with the process ID. The tail -f will exit automatically when that PID is gone.

A lot of people run tail -f on a system log overnight and wonder why it stops updating after midnight. The file was rotated by logrotate and -f is still watching the old renamed file. The terminal looks active but no new lines ever appear.

Log visibility is what separates a reactive sysadmin from a proactive one. When something breaks on a live server, the first question is always: what did the logs say right before it happened? With tail -n 100 you have the answer in under a second. Without it, you are opening a 400MB file in nano and waiting for it to load. That is not just slow, it is the kind of thing that costs you under pressure.

For anyone learning bash scripting and automation, tail combined with grep inside a shell script is a standard pattern for writing lightweight monitoring tools. You don't need a full observability stack to catch a login failure spike or spot a runaway cron job. A few lines of bash using tail -F piped into a filter will get the job done on any distro. See the Linux logging best practices guide for how this fits into a broader log management setup.