Home / Blog / How to Use the tail Command on Linux

How to Use the tail Command on Linux

A terminal window showing a Bash prompt on an Ubuntu-style Linux laptop.
Fatmawati Achmad Zaenuri/Shutterstock

The Linux tail command shows information from the top of a file. It will probably even show updates which are added to a file in real-time. We present you use it.

Did systemd Kill tail?

The tail command exhibits you information from the top of a file. Often, new information is added to the top of a file, so the tail command is a fast and straightforward approach to see the latest additions to a file. It will probably additionally monitor a file and show every new textual content entry to that file as they happen. This makes it an important software to watch log information.

Many trendy Linux distributions have adopted the systemd system and repair supervisor. That is the primary course of executed, it has course of ID 1, and it’s the dad or mum of all different processes. This function was dealt with by the older init system.

Together with this variation got here a brand new format for system log information. Not created in plain textual content, below systemd they’re recorded in a binary format. To learn these log information, you could use the journactl utility. The tail command works with plain textual content codecs. It doesn’t learn binary information. So does this imply the tail command is an answer in quest of an issue? Does it nonetheless have something to supply?

There’s extra to the tail command than displaying updates in real-time. And for that matter, there are nonetheless loads of log information that aren’t system generated and are nonetheless created as plain textual content information. For instance, log information generated by functions haven’t modified their format.

Utilizing tail

Go the identify of a file to tail and it’ll present you the final ten strains from that file. The instance information we’re utilizing comprise lists of sorted phrases. Every line is numbered, so it must be simple to comply with the examples and see what impact the varied choices have.

tail word-list.txt

tail word-list.txt in a terminal window

To see a unique variety of strains, use the -n (variety of strains) possibility:

tail -n 15 word-list.txt

tail -n 15 word-list.txt in a terminal window

Really, you may dispense with the “-n”, and simply use a hyphen “-” and the quantity. Be certain there are not any areas between them. Technically, that is an out of date command type, however it’s nonetheless within the man web page, and it nonetheless works.

tail -12 word-list.txt

tail -12 word-list.txt in a terminal window

Utilizing tail With A number of Recordsdata

You may have tail work with a number of information without delay. Simply move the filenames on the command line:

tail -n Four list-1.txt list-2.txt list-3.txt

tail -n 4 list-1.txt list-2.txt list-3.txt in a terminal window

A small header is proven for every file in order that which file the strains belong to.

Displaying Traces from the Begin of a FIle

The + (rely from the beginning) modifier makes tail show strains from the beginning of a file, starting at a particular line quantity. In case your file could be very lengthy and also you decide a line near the beginning of the file, you’re going to get a number of output despatched to the terminal window. If that’s the case, it is smart to pipe the output from tail into much less.

tail +440 list-1.txt

tail +44 list-1.txt in a terminal window

You may web page by means of the textual content in a managed trend.

Output from tail displayed in less in a terminal window

As a result of there occur to be 20,445 strains on this file, this command is the equal of utilizing the “-6” possibility:

tail +20440 list-1.txt

tail +20440 list-1.txt in a terminal window

Utilizing Bytes With tail

You may inform tail to make use of offsets in bytes as an alternative of strains through the use of the -c (bytes) possibility. This may very well be helpful when you have a file of textual content that was formatted into regular-sized data. Observe {that a} newline character counts as one byte. This command will show the final 93 bytes within the file:

tail -c 93 list-2.txt

tail -c 93 list-2.txt in a terminal window

You may mix the -c (bytes) possibility with the + (rely from the beginning of the file) modifier, and specify an offset in bytes counted from the beginning of the file:

tail -c +351053 list-e.txt

tail -c +351053 list-e.txt in a terminal window

Piping Into tail

Earlier, we piped the output from tail into much less . We will additionally pipe the output from different instructions into tail.

To determine the 5 information or folders with the oldest modification instances, use the -t (kind by modification time) possibility with ls , and pipe the output into tail.

ls -tl | tail -5

ls -lt | tail -5 in a terminal window

The head command lists strains of textual content from the beginning of a file. We will mix this with tail to extract a bit of the file.  Right here, we’re utilizing the head command to extract the primary 200 strains from a file. That is being piped into tail, which is extracting the final ten strains. This provides us strains 191 by means of to line 200. That’s, the final ten strains of the primary 200 strains:

head -n 200 list-1.txt | tail -10

head -n 200 list-1.txt | tail -10 in a terminal window

This command lists the 5 most memory-hungry processes.

ps aux | kind -nk +4 | tail -5

ps aux | sort -nk +4 | tail -5 in a terminal window

Let’s break that down.

The ps command shows details about working processes. The choices used are:

  • a: Checklist all processes, not only for the present consumer.
  • u: Show a user-oriented output.
  • x: Checklist all processes, together with these not working inside a TTY.

The kind command types the output from ps . The choices we’re utilizing with kind are:

  • n:  Type numerically.
  • okay +4: Type on the fourth column.

The tail -5 command shows the final 5 processes from the sorted output. These are the 5 most memory-hungry processes.

Utilizing tail to Monitor Recordsdata in Actual-Time

Monitoring new textual content entries arriving in a file—normally a log file—is straightforward with tail. Go the filename on the command line and use the -f (comply with) possibility.

tail -f geek-1.log

tail -f geek-1.log in a terminal window

As every new log entry is added to the log file, tail updates its show within the terminal window.

Output from tail -f geek-1.log in a terminal window

You may refine the output to incorporate solely strains of explicit relevance or curiosity. Right here, we’re utilizing grep to solely present strains that embody the phrase “common”:

tail -f geek-1.log | grep common

tail -f geek-1.log | grep average in a terminal window

To comply with the adjustments to 2 or extra information, move the filenames on the command line:

tail -f -n 5 geek-1.log geek-2.log

tail -f -n 5 geek-1.log geek-2.log in a terminal window

Every entry is tagged with a header that exhibits which file the textual content got here from.

Output from tail -f -n 5 geek-1.log geek-2.log

The show is up to date every time a brand new entry arrives in a adopted file. To specify the replace interval, use the -s (sleep interval) possibility. This tells tail to attend plenty of seconds, 5 on this instance,  between file checks.

tail -f -s 5 geek-1.log

tail -f -s 5 geek-1.log in a terminal window

Admittedly, you may’t inform by taking a look at a screenshot, however the updates to the file are occurring as soon as each two seconds. The brand new file entries are being displayed within the terminal window as soon as each 5 seconds.

Output from tail -f -s 5 geek-1.log

If you end up following the textual content additions to multiple file, you may suppress the headers that point out which log file the textual content comes from. Use the -q (quiet) possibility to do that:

tail -f -q geek-1.log geek-2.log

tail -f -q geek-1.log geek-2.log in a terminal window

The output from the information is displayed in a seamless mix of textual content. There is no such thing as a indication which log file every entry got here from.

Output from tail -f -q geek-1.log geek-2.log in a terminal window

tail Nonetheless Has Worth

Though entry to the system log information is now supplied by journalctl, tail nonetheless has lots to supply. That is very true when it’s used along with different instructions, by piping into or out of tail.

systemd may need modified the panorama, however there’s nonetheless a spot for conventional utilities that conform to the Unix philosophy of doing one factor and doing it effectively.

About Dave McKay

Check Also

How to Move Music and Videos Between Google Home Devices

Bored with utilizing your cellphone to switch music from one Google House machine to a …

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.