Introduction

The tail command in Linux is a powerful tool that allows you to view the end of a file or stream. It is commonly used to monitor log files, view the output of a running process, or to quickly view the contents of a large file. In this article, we will discuss 9 practical examples of the tail command in Linux. We will cover how to use the tail command to view the last few lines of a file, how to follow a file in real-time, and how to use the tail command with other commands to create powerful scripts.

9 Practical Examples of Tail Command in Linux

1. Display the last 10 lines of a file:

tail -n 10 filename

2. Display the last 5 lines of a file and follow the output as the file grows:

tail -f -n 5 filename

3. Display the last 10 lines of a file and show the line numbers:

tail -n 10 -v filename

4. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines:

tail -n +5 -v filename

5. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines and follow the output as the file grows:

tail -f -n +5 -v filename

6. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines and follow the output as the file grows, but only show the lines that contain the word “error”:

tail -f -n +5 -v filename | grep error

7. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines and follow the output as the file grows, but only show the lines that contain the word “error” and highlight the word “error”:

tail -f -n +5 -v filename | grep –color=auto error

8. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines and follow the output as the file grows, but only show the lines that contain the word “error” and highlight the word “error”, but only show the lines that contain the word “warning”:

tail -f -n +5 -v filename | grep –color=auto ‘error\|warning’

9. Display the last 10 lines of a file and show the line numbers, but skip the first 5 lines and follow the output as the file grows, but only show the lines that contain the word “error” and highlight the word “error”, but only show the lines that contain the word “warning” and highlight the word “warning”:

tail -f -n +5 -v filename | grep –color=auto ‘error\|warning’ –color=always

As Linux users, we often work with long-running background Linux processes, which are called daemons or services. Some of the common examples of the services are Secure Shell (sshd), Network Manager (networkd), Volume Manager (LVM), Cron, and the list goes on.

Many times we need to monitor the logs of these services to debug the system issues. However, one of the main challenges is that these services generate a lot of logs and most of the time going through these logs makes it cumbersome, this is where we can use the tail command.

tail command is a command-line utility, similar to the head command that reads a file and prints the last 10 lines (content) of one or more files to standard output.

In this practical guide, we will learn about the tail command. By the end of this guide, Linux command-line users will be able to use the tail command effectively.

tail Command Syntax

The syntax of the tail command is similar to other Linux commands:

$ tail [OPTIONS] [FILE-1] [FILE-2] ...

1. Print Last 10 Lines Of File in Linux

By default, the tail command prints the last 10 lines of the given file as shown.

$ tail /var/log/secure


Apr  2 14:17:24 Jassweb sshd[201178]: Disconnected from user tecmint 192.168.0.162 port 59774
Apr  2 14:17:24 Jassweb sshd[201165]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 14:29:12 Jassweb sshd[201366]: Accepted password for tecmint from 192.168.0.162 port 56378 ssh2
Apr  2 14:29:12 Jassweb systemd[201371]: pam_unix(systemd-user:session): session opened for user tecmint(uid=1002) by (uid=0)
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session opened for user tecmint(uid=1002) by (uid=0)
Apr  2 14:29:12 Jassweb sshd[201382]: Received disconnect from 192.168.0.162 port 56378:11: disconnected by user
Apr  2 14:29:12 Jassweb sshd[201382]: Disconnected from user tecmint 192.168.0.162 port 56378
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

Here, we can see that the above command shows the last ten lines from the /var/log/secure file.

2. Print Last N Lines of File in Linux

In the last example, the command prints the last 10 lines of the given file. However, we can use the -n option which allows us to limit the number of lines to be printed on the screen as shown.

$ tail -n 3 /var/log/secure

Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

In this example, we can see that now the command shows the last three lines only instead of the ten lines.

3. Ignore First N Lines of a File in Linux

Here, we can use the plus (+) symbol with the -n option, which allows us to control the starting point from the given file.

To understand this, let’s use the +5 value to start the output from the 5th line:

$ tail -n +5 /var/log/secure

Apr  2 14:17:24 Jassweb sshd[201178]: Disconnected from user tecmint 192.168.0.162 port 59774
Apr  2 14:17:24 Jassweb sshd[201165]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 14:29:12 Jassweb sshd[201366]: Accepted password for tecmint from 192.168.0.162 port 56378 ssh2
Apr  2 14:29:12 Jassweb systemd[201371]: pam_unix(systemd-user:session): session opened for user tecmint(uid=1002) by (uid=0)
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session opened for user tecmint(uid=1002) by (uid=0)
Apr  2 14:29:12 Jassweb sshd[201382]: Received disconnect from 192.168.0.162 port 56378:11: disconnected by user
Apr  2 14:29:12 Jassweb sshd[201382]: Disconnected from user tecmint 192.168.0.162 port 56378
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

4. Show Last N Characters of the File

Similar to lines, we can also use the command to display the last N characters of the file using the -c option as shown below:

$ tail -c 7 /var/log/secure

(uid=0)

In this example, we can see that the command shows the last seven ASCII characters of the given file.

5. Remove First N Characters of File

Similarly, we can use the plus symbol (+) with the -c option to skip the first N character. So let’s skip the first line of the file using the below command:

$ tail -c +5 /var/log/secure

Apr  2 03:02:59 Jassweb sudo[162801]: root : TTY=pts/2 ; PWD=/root ; USER=root ; COMMAND=/bin/dnf install R
Apr  2 03:02:59 Jassweb sudo[162801]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)
Apr  2 03:03:02 Jassweb sudo[162801]: pam_unix(sudo:session): session closed for user root
Apr  2 03:11:17 Jassweb groupadd[163602]: group added to /etc/group: name=avahi, GID=70
Apr  2 03:11:18 Jassweb groupadd[163602]: group added to /etc/gshadow: name=avahi
Apr  2 03:11:18 Jassweb groupadd[163602]: new group: name=avahi, GID=70
Apr  2 03:11:19 Jassweb useradd[163610]: new user: name=avahi, UID=70, GID=70, home=/var/run/avahi-daemon, shell=/sbin/nologin, from=none
Apr  2 03:13:41 Jassweb groupadd[163704]: group added to /etc/group: name=colord, GID=986
Apr  2 03:13:41 Jassweb groupadd[163704]: group added to /etc/gshadow: name=colord

Here, we can see that the command shows all the lines except the first line.

6. Show File Name in Header

We can instruct the tail command to display the current file name as a display header, which comes in handy while working with multiple files.

So, let’s use the -v option to enable the display header:

$ tail -n 3 -v /var/log/secure

==>/var/log/secure <==
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

In the above output, ==> /var/log/secure <== represents the display header.

7. Show File Name as Header in Multiple Files

Just like any other file-processing command, we can also use multiple files with the tail command. In such cases, the display header gets used to separate the file contents.

$ tail -n 3 -v /var/log/secure /var/log/secure-20230402

==> /var/log/secure <==
Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

==> /var/log/secure-20230402 <==
Mar 31 03:50:53 Jassweb groupadd[156163]: new group: name=docker, GID=987
Mar 31 04:46:11 Jassweb sshd[159403]: Accepted password for root from 192.168.0.162 port 46480 ssh2
Mar 31 04:46:11 Jassweb sshd[159403]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

In the above output, we can see the display header for each file.

8. How to Disable Display Header in File

In the previous example, we saw that the command enables the display header while working with multiple files. However, we can suppress this default behavior using the -q option.

$ tail -q -n 3 /var/log/secure /var/log/secure-20230402

Apr  2 14:29:12 Jassweb sshd[201366]: pam_unix(sshd:session): session closed for user tecmint
Apr  2 15:12:55 Jassweb sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2
Apr  2 15:12:55 Jassweb sshd[202049]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)
Mar 31 03:50:53 Jassweb groupadd[156163]: new group: name=docker, GID=987
Mar 31 04:46:11 Jassweb sshd[159403]: Accepted password for root from 192.168.0.162 port 46480 ssh2
Mar 31 04:46:11 Jassweb sshd[159403]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)

Here, we can see that now the command displays the file contents one after another without any display header.

9. How to Watch a File for Changes

So far we saw that the tail command exits once it processes the required number of lines or characters. However, sometimes we want to view the newly generated logs as well.

In such cases, we can use the -f option with the command, which allows us to monitor the file for changes in a real-time.

To understand this, first, let’s execute the below command in the first terminal:

$ tail -f /var/log/messages


Apr  2 15:13:28 Jassweb NetworkManager[741]:   [1680462808.8441] policy: set-hostname: current hostname was changed outside NetworkManager: 'Jassweb'
Apr  2 15:13:28 Jassweb systemd[1]: Starting Network Manager Script Dispatcher Service...
Apr  2 15:13:28 Jassweb systemd[1]: Started Network Manager Script Dispatcher Service.
Apr  2 15:13:37 Jassweb arpwatch[11001]: rename arp.dat -> arp.dat-: Operation not permitted
Apr  2 15:13:38 Jassweb systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.
Apr  2 15:13:58 Jassweb systemd[1]: systemd-hostnamed.service: Deactivated successfully.
Apr  2 15:18:03 Jassweb systemd[1]: Starting dnf makecache...
Apr  2 15:18:03 Jassweb dnf[202235]: Metadata cache refreshed recently.
Apr  2 15:18:03 Jassweb systemd[1]: dnf-makecache.service: Deactivated successfully.
Apr  2 15:18:03 Jassweb systemd[1]: Finished dnf makecache.

Here, we can see that the command is waiting infinitely after displaying the last ten lines:

Next, let’s open another terminal and append some text to the numbers-2.txt file:

$ echo "View Logs in Real-Time" >> /var/log/messages

Now, let’s switch to the first terminal to view the newly added text:

$ tail -f /var/log/messages

Apr  2 15:13:28 Jassweb NetworkManager[741]:   [1680462808.8441] policy: set-hostname: current hostname was changed outside NetworkManager: 'Jassweb'
Apr  2 15:13:28 Jassweb systemd[1]: Starting Network Manager Script Dispatcher Service...
Apr  2 15:13:28 Jassweb systemd[1]: Started Network Manager Script Dispatcher Service.
Apr  2 15:13:37 Jassweb arpwatch[11001]: rename arp.dat -> arp.dat-: Operation not permitted
Apr  2 15:13:38 Jassweb systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.
Apr  2 15:13:58 Jassweb systemd[1]: systemd-hostnamed.service: Deactivated successfully.
Apr  2 15:18:03 Jassweb systemd[1]: Starting dnf makecache...
Apr  2 15:18:03 Jassweb dnf[202235]: Metadata cache refreshed recently.
Apr  2 15:18:03 Jassweb systemd[1]: dnf-makecache.service: Deactivated successfully.
Apr  2 15:18:03 Jassweb systemd[1]: Finished dnf makecache.
View Logs in Real-Time

Here, we can see that the tail command shows the newly added text.

Do you know of any other best example of the tail command in Linux? Let us know your views in the comments below.

If You Appreciate What We Do Here On Jassweb, You Should Consider:

Jassweb is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit Jassweb! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

9 Practical Examples of Tail Command in Linux

The tail command is one of the most commonly used commands in Linux. It is used to display the last few lines of a file. It is very useful for monitoring log files, as it allows you to quickly view the most recent entries in the log. In this article, we will discuss the tail command in detail, and provide some practical examples of how it can be used.

1. Display the Last 10 Lines of a File

The most basic use of the tail command is to display the last 10 lines of a file. To do this, simply type the following command:

tail filename

This will display the last 10 lines of the file. If you want to display a different number of lines, you can use the -n option. For example, to display the last 20 lines of a file, you would use the following command:

tail -n 20 filename

2. Follow a Log File in Real Time

The tail command can also be used to follow a log file in real time. This is useful for monitoring log files, as it allows you to view new entries as they are added. To do this, use the -f option. For example, to follow the system log file in real time, you would use the following command:

tail -f /var/log/syslog

3. Display the Last N Bytes of a File

The tail command can also be used to display the last N bytes of a file. This is useful for viewing the end of large files, as it allows you to quickly view the last few lines without having to scroll through the entire file. To do this, use the -c option. For example, to display the last 1000 bytes of a file, you would use the following command:

tail -c 1000 filename

4. Display the Last N Lines Matching a Pattern

The tail command can also be used to display the last N lines matching a pattern. This is useful for quickly finding entries in a log file that match a certain criteria. To do this, use the -q option. For example, to display the last 10 lines containing the word “error” in the system log file, you would use the following command:

tail -q -n 10 /var/log/syslog | grep error

5. Display the Last N Lines Containing a String

The tail command can also be used to display the last N lines containing a string. This is useful for quickly finding entries in a log file that contain a certain string. To do this, use the -s option. For example, to display the last 10 lines containing the word “error” in the system log file, you would use the following command:

tail -s 10 /var/log/syslog | grep error

6. Display the Last N Lines of Multiple Files

The tail command can also be used to display the last N lines of multiple files. This is useful for quickly viewing the last few lines of multiple files at once. To do this, simply specify the files as arguments. For example, to display the last 10 lines of two files, you would use the following command:

tail -n 10 file1 file2

7. Display the Last N Lines of a File in Reverse Order

The tail command can also be used to display the last N lines of a file in reverse order. This is useful for quickly viewing the last few lines of a file in reverse order. To do this, use the -r option. For example, to display the last 10 lines of a file in reverse order, you would use the following command:

tail -r -n 10 filename

8. Display the Last N Lines of a File Without Printing the Filename

The tail command can also be used to display the last N lines of a file without printing the filename. This is useful for quickly viewing the last few lines of a file without having to scroll through the entire file. To do this, use the -q option. For example, to display the last 10 lines of a file without printing the filename, you would use the following command:

tail -q -n 10 filename

9. Display the Last N Lines of a File in Color

The tail command can also be used to display the last N lines of a file in color. This is useful for quickly viewing the last few lines of a file in a more visually appealing way. To do this, use the -C option. For example, to display the last 10 lines of a file in color, you would use the following command:

tail -C 10 filename

These are just a few of the many practical examples of how the tail command can be used in Linux. As you can see, it is a very powerful and versatile command, and can be used for a variety of tasks. If you have any questions or comments, please feel free to leave them in the comments section below.

Introduction