How to Use the Tail Command in Linux?
If you are managing or troubleshooting a Linux system as a developer or a sysadmin, monitoring logs and file activity is important. The tail command is one of the easiest and most powerful tools for this task. You can quickly see the end of a file, follow it as it updates in real time, and filter for the essential content.
Whether you’re debugging problems in the system logs or watching for live output from an application, tail provides an easy way to (live) access only the most recent information. This will make it easier to identify an error, understand what a process is doing, or start a script that automates alerts or a reaction based on a log entry.
In this tutorial you will learn how to use the tail command in Linux with examples and various options. Ranging from basic tail command usage to advanced usage such as filtering with grep or piping output to automation scripts, this tutorial covers everything you need to get started monitoring logs like an expert.
Basic tail Command Syntax
The general syntax of the tail command is:
tail [options] [file]
[options]: Optional flags that change how tail behaves.
[file]: The target file to view. If omitted, tail reads from standard input (STDIN).
You can also use tail in pipelines to connect with other Linux utilities for more advanced processing.
Commonly Used tail Command Options
Here’s a quick reference of frequently used tail command options:
Option Description -n Show the last n lines of a file. -f Continuously monitor a file for new content (follow mode). -c Output the last n bytes of a file. -q Quiet mode: suppresses file name headers. -v Verbose mode: always show file name headers. --pid Stop monitoring when a specific process ID ends. -s Sleep for n seconds between updates (used with -f). --retry Keep retrying to open a file if it’s inaccessible. --max-unchanged-stats Stop after n unchanged reads (used with -f).
Practical Examples of Using the tail Command
View the Last Few Lines of a Log File
To see the last 10 lines of a system log file (default behavior):
sudo tail /var/log/syslog
View the Last n Lines of a File
To view the last 20 lines:
sudo tail -n 20 /var/log/syslog
View the Last n Bytes of a File
To display the last 100 bytes:
sudo tail -c 100 /var/log/syslog
Monitor Multiple Log Files in Real-Time
sudo tail -f /var/log/syslog /var/log/auth.log
Set a Custom Sleep Interval Between Checks
sudo tail -f -s 2 /var/log/auth.log
Stop Tail After a Specific Process Ends
sudo tail -f --pid=1234 /var/log/syslog
Limit Monitoring if File Stays Unchanged
sudo tail -f --max-unchanged-stats=10 /var/log/syslog
Advanced tail Command Examples
Skip Initial Lines Using a Positive Number
sudo tail -n +10 /var/log/syslog
Filter Output with grep
sudo tail -f /var/log/syslog | grep 'MAC'
Display Headers for Multiple Files
sudo tail -f -v /var/log/syslog /var/log/auth.log
Retry Opening Unavailable Files
sudo tail -f --retry /var/log/syslog
Automate Log Monitoring with a Script
You can automate log scanning with tail and a Bash script. Create a script like check_log.sh
#!/bin/bash
if tail -n 100 /var/log/syslog | grep -q 'error'; then
echo "Error found in log file"
fi
Make it executable:
chmod +x check_log.sh
Run it:
sudo bash check_log.sh
This script checks the last 100 lines for the word error and prints a message if found — ideal for automation and cron jobs.
Combine tail with Other Commands
With awk to Extract Specific Fields:
sudo tail -n 10 /var/log/syslog | awk '{print $2}'
With sort to Organize Output:
sudo tail -n 15 /var/log/syslog | sort
With xargs to Delete Files Listed in a Script:
sudo tail -n 5 backup.sh | xargs rm
With head to Show a Specific Line Range:
sudo tail -n 50 /var/log/syslog | head -n 10
Real-Time Log Monitoring with tail -f
Monitor System Logs Live
sudo tail -f /var/log/syslog
Press Ctrl + C to stop monitoring.
Monitor Web Server Logs in Real-Time
sudo tail -f /var/log/nginx/access.log
This is especially helpful for developers tracking API hits or server errors as they happen.
Conclusion
The tail command is one of the most flexible utilities within the Linux toolbox for both developers and system administrators. It quickly helps to monitor live changes to files, and view the latest log activity without bombarding you with data.
Regardless of whether you are debugging problems, monitoring log files for important events, or scripting alerts, tail easily adapts to a variety of use cases. It works well with multiple external commands such as grep, awk and xargs, and can become a building block for prospective, more advanced workflows.
Now that you have deep dives into tail in the previous section, you can use tail with confidence to observe logs and other files as they change in real-time, filter for key events, and to help automate system diagnostics in your Linux environment.
