How to Use the Tail Command in Linux?

Introduction

If you are managing or troubleshooting a Linux system as a developer or a sysadmin, monitoring logs and file activity is important. The tail command is one of the easiest and most powerful tools for this task. You can quickly see the end of a file, follow it as it updates in real time, and filter for the essential content.

Whether you’re debugging problems in the system logs or watching for live output from an application, tail provides an easy way to (live) access only the most recent information. This will make it easier to identify an error, understand what a process is doing, or start a script that automates alerts or a reaction based on a log entry.

In this tutorial you will learn how to use the tail command in Linux with examples and various options. Ranging from basic tail command usage to advanced usage such as filtering with grep or piping output to automation scripts, this tutorial covers everything you need to get started monitoring logs like an expert.

What Does the Tail Command Do?

The tail command in Linux displays the last part of a file – by default, the last 10 lines. It’s most commonly used to check recent log entries or monitor a file in real time as new lines are added, using the -f (follow) option.

Basic tail Command Syntax

The general syntax of the tail command is:

tail [options] [file]

[options]: Optional flags that change how tail behaves.

[file]: The target file to view. If omitted, tail reads from standard input (STDIN).
You can also use tail in pipelines to connect with other Linux utilities for more advanced processing.

Commonly Used tail Command Options

Here’s a quick reference of frequently used tail command options:

Option		Description
-n		Show the last n lines of a file.
-f		Continuously monitor a file for new content (follow mode).
-c		Output the last n bytes of a file.
-q		Quiet mode: suppresses file name headers.
-v		Verbose mode: always show file name headers.
--pid		Stop monitoring when a specific process ID ends.
-s		Sleep for n seconds between updates (used with -f).
--retry		Keep retrying to open a file if it’s inaccessible.
--max-unchanged-stats	Stop after n unchanged reads (used with -f).

Practical Examples of Using the tail Command

View the Last Few Lines of a Log File

To see the last 10 lines of a system log file (default behavior):

sudo tail /var/log/syslog

View the Last n Lines of a File

To view the last 20 lines:

sudo tail -n 20 /var/log/syslog

View the Last n Bytes of a File

To display the last 100 bytes:

sudo tail -c 100 /var/log/syslog

Monitor Multiple Log Files in Real-Time

sudo tail -f /var/log/syslog /var/log/auth.log

Set a Custom Sleep Interval Between Checks

sudo tail -f -s 2 /var/log/auth.log

Stop Tail After a Specific Process Ends

sudo tail -f --pid=1234 /var/log/syslog

Limit Monitoring if File Stays Unchanged

sudo tail -f --max-unchanged-stats=10 /var/log/syslog

Advanced tail Command Examples

Skip Initial Lines Using a Positive Number

sudo tail -n +10 /var/log/syslog

Filter Output with grep

sudo tail -f /var/log/syslog | grep 'MAC'

Display Headers for Multiple Files

sudo tail -f -v /var/log/syslog /var/log/auth.log

Retry Opening Unavailable Files

sudo tail -f --retry /var/log/syslog

Automate Log Monitoring with a Script

You can automate log scanning with tail and a Bash script. Create a script like check_log.sh

#!/bin/bash
if tail -n 100 /var/log/syslog | grep -q 'error'; then
    echo "Error found in log file"
fi

Make it executable:

chmod +x check_log.sh

Run it:

sudo bash check_log.sh

This script checks the last 100 lines for the word error and prints a message if found — ideal for automation and cron jobs.

Combine tail with Other Commands

With awk to Extract Specific Fields:

sudo tail -n 10 /var/log/syslog | awk '{print $2}'

With sort to Organize Output:

sudo tail -n 15 /var/log/syslog | sort

With xargs to Delete Files Listed in a Script:

sudo tail -n 5 backup.sh | xargs rm

With head to Show a Specific Line Range:

sudo tail -n 50 /var/log/syslog | head -n 10

Real-Time Log Monitoring with tail -f

Monitor System Logs Live

sudo tail -f /var/log/syslog

Press Ctrl + C to stop monitoring.

Monitor Web Server Logs in Real-Time

sudo tail -f /var/log/nginx/access.log

This is especially helpful for developers tracking API hits or server errors as they happen.

Conclusion

The tail command is one of the most flexible utilities within the Linux toolbox for both developers and system administrators. It quickly helps to monitor live changes to files, and view the latest log activity without bombarding you with data.

Regardless of whether you are debugging problems, monitoring log files for important events, or scripting alerts, tail easily adapts to a variety of use cases. It works well with multiple external commands such as grep, awk and xargs, and can become a building block for prospective, more advanced workflows.

Now that you have deep dives into tail in the previous section, you can use tail with confidence to observe logs and other files as they change in real-time, filter for key events, and to help automate system diagnostics in your Linux environment.

FAQs

How do I use the tail command in Linux?

Run tail filename to view the last 10 lines by default, or add options like -n (number of lines) or -f (follow mode) to customize the output. It works the same way across most Linux distributions and shells.

How do I monitor logs in real time with tail -f?

Use tail -f filename to continuously display new lines as they’re added to a file – ideal for watching logs live. Press Ctrl + C to stop. You can also set a custom check interval with -s, e.g., tail -f -s 2 filename.

Does the tail command work the same on Ubuntu and Unix?

Yes. tail is part of GNU coreutils and behaves identically across Ubuntu, Debian, most Linux distributions, and Unix-based systems like macOS.

How do I view tail logs for a specific application?

Point tail at the application’s log file directly, e.g., tail -f /var/log/nginx/access.log for web server logs or tail -f /var/log/syslog for system logs. Combine with grep to filter for specific events.

What are the most common tail command options in Linux?

The most frequently used options are -n (show last n lines), -f (follow mode for real-time monitoring), -c (show last n bytes), and --pid (stop monitoring when a process ends).