tail command in Linux with Examples

---

Name

tail - display the tail end of a text file or piped data

Synopsis

tail [OPTION]... [FILE]...

Options

-c, --bytes=[+]NUM
   output  the last NUM bytes; or use -c +NUM to output starting with byte NUM of each file.

-f, --follow[={name|descriptor}]
   output appended data as the file grows; 
   an absent option argument means 'descriptor'

-F
   same as --follow=name --retry

-n, --lines=[+]NUM
   output the last NUM lines, instead of the last 10 lines; or use -n +NUM to output starting with line NUM

--max-unchanged-stats=N
   with --follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated  log files); with inotify, this option is rarely useful

--pid=PID
   with -f, terminate after process ID, PID dies

-q, --quiet, --silent
   never output headers giving file names

--retry
   keep trying to open a file if it is inaccessible

-s, --sleep-interval=N
   with -f, sleep for approximately N seconds (default 1.0) between iterations; with inotify and --pid=P, check process P at least once every N seconds

-v, --verbose
   always output headers giving file names

-z, --zero-terminated
   line delimiter is NUL, not newline

--help
   display this help and exit

--version
   output version information and exit

Description

tail command is a command-line utility, which prints the last 10 lines of the specified files. It is the complementary of head command. If more than one file name is provided then data from each file is preceded by its file name.

GNU tail command can output any amount of data (some other versions of tail cannot). It also has no -r option (print in reverse), since reversing a file is really a different job from printing the end of a file; BSD tail (which is the one with ‘-r’) can only reverse files that are at most as large as its buffer, which is typically 32 KiB. A more reliable and versatile way to reverse files is the GNU ‘tac’ command.

We can change the number of lines the tail command prints by using the -n command line option. Not only number of lines, you can also restrict the tail command output to a specific number of bytes. This can be done using the -c command line option.

tail command has two special command line option -f and -F (follow) that allows a file to be monitored. Instead of just displaying the last few lines and exiting, tail displays the lines and then monitors the file. As new lines are added to the file by another process, tail updates the display.

One of the most common uses of the tail command is to watch and analyze logs and other files that change over time, usually combined with other tools like grep.

Examples

Let us consider two files having name test1.txt and test2.txt

$ cat test1.txt
a) 1122
b) 2233
c) 3344
d) 4455
e) 5566
f) 6677
g) 7788
h) 8899
i) 9910
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617

$ cat test2.txt 
a) a.k. shukla
b) anat hari
c) barun kumar
d) jai sharma
e) sumit singh
f) jamun singh
g) naman kumar
h) mosin khan
i) rahul kumar
j) ajay narayan
k) ram naresh
l) ashu choudhary
m) pandit ramphal
n) gagan choubey
o) utar purn
p) kovid puram   

1. Passing only file name in the argument will display only the last 10 lines of the file.

$ tail test2.txt 
g) naman kumar
h) mosin khan
i) rahul kumar
j) ajay narayan
k) ram naresh
l) ashu choudhary
m) pandit ramphal
n) gagan choubey
o) utar purn
p) kovid puram

2. we can also pass more than one file name in the argument, This will output the last ten lines of each file to standard output with a header indicating which file is being shown.

$ tail test1.txt test2.txt 
==> test1.txt <==
g) 7788
h) 8899
i) 9910
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617
==> test2.txt <==
g) naman kumar
h) mosin khan
i) rahul kumar
j) ajay narayan
k) ram naresh
l) ashu choudhary
m) pandit ramphal
n) gagan choubey
o) utar purn
p) kovid puram

3. Here in the above example files are seperated by header i.e the filename, to suppress the header line pass the -q option. This can be useful to combine files.

$ tail -q test1.txt test2.txt
g) 7788
h) 8899
i) 9910
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617g) naman kumar
h) mosin khan
i) rahul kumar
j) ajay narayan
k) ram naresh
l) ashu choudhary
m) pandit ramphal
n) gagan choubey
o) utar purn
p) kovid puram

4. To set the number of lines to show with tail pass the -n option followed by the number of lines to show.

$ tail -n 4 test2.txt 
m) pandit ramphal
n) gagan choubey
o) utar purn
p) kovid puram

It should be noted that when we use the "tail -n NUM [Filename]" command, then we must specify the integer i.e NUM, otherwise it will result in to an error.

5. tail command also comes with an ‘+’ option which is not present in the head command. With this option tail command prints the data starting from specified line number of the file instead of end. For command: tail +n file_name, data will start printing from line number ‘n’ till the end of the file specified.

$ tail -n +10 test1.txt 
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617

6. We can limit the number of bytes shown with tail pass the -c option. Instead of limiting by number of lines this will limit by the number of bytes passed to the -c option.

In the following example the output is limited to 64 bytes.

$ tail -c 64 test1.txt
i) 9910
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617

It is mandatory to write -c followed by positive or negative num depends upon the requirement. If NUMis prefixed with a ‘+’, start printing with byte NUM from the start of each file, instead of from the end and by -num, it display the last num bytes from the file specified. Without positive or negative sign before num, command will display the last num bytes from the file specified.

$ tail -c +32 test1.txt 
e) 5566
f) 6677
g) 7788
h) 8899
i) 9910
j) 1011
k) 1112
l) 1213
m) 1314
n) 1415
o) 1516
p) 1617
$ tail -c -32 test1.txt 
m) 1314
n) 1415
o) 1516
p) 1617

7. Unlike the default behaviour which is to end after printing certain number of lines, the -f option “which stands for follow” will keep the stream going. It will start printing extra lines on to console added to the file after it is opened. This command will keep the file open to display updated changes to console until the user breaks the command.

$ tail -f Rajat/python/multilingual/geckodriver.log 
1598103648031	mozrunner::runner	INFO	Running command: "/usr/bin/firefox" "-marionette" "-foreground" "-no-remote" "-profile" "/tmp/rust_mozprofileAayBA1"
console.error: SearchCache: "_readCacheFile: Error reading cache file:" (new Error("", "(unknown module)"))
1598103652231	Marionette	INFO	Listening on port 37703
1598103652264	Marionette	WARN	TLS certificate errors will be ignored for this session
1598103693247	Marionette	INFO	Stopped listening on port 37703
1598103701508	mozrunner::runner	INFO	Running command: "/usr/bin/firefox" "-marionette" "-foreground" "-no-remote" "-profile" "/tmp/rust_mozprofileYnKg16"
console.error: SearchCache: "_readCacheFile: Error reading cache file:" (new Error("", "(unknown module)"))
1598103705689	Marionette	INFO	Listening on port 41203
1598103705730	Marionette	WARN	TLS certificate errors will be ignored for this session
1598103744249	Marionette	INFO	Stopped listening on port 41203

8. We have other option -s which should always be used with -f” will determine the sleep interval, whereas tail -f will keep watching the file, the refresh rate is each 1 second, if you wish to control this, then you will have to use the -s option “sleep” and specify the sleep interval.

$ tail -f -s 5 Rajat/python/multilingual/geckodriver.log 
1598103648031	mozrunner::runner	INFO	Running command: "/usr/bin/firefox" "-marionette" "-foreground" "-no-remote" "-profile" "/tmp/rust_mozprofileAayBA1"
console.error: SearchCache: "_readCacheFile: Error reading cache file:" (new Error("", "(unknown module)"))
1598103652231	Marionette	INFO	Listening on port 37703
1598103652264	Marionette	WARN	TLS certificate errors will be ignored for this session
1598103693247	Marionette	INFO	Stopped listening on port 37703
1598103701508	mozrunner::runner	INFO	Running command: "/usr/bin/firefox" "-marionette" "-foreground" "-no-remote" "-profile" "/tmp/rust_mozprofileYnKg16"
console.error: SearchCache: "_readCacheFile: Error reading cache file:" (new Error("", "(unknown module)"))
1598103705689	Marionette	INFO	Listening on port 41203
1598103705730	Marionette	WARN	TLS certificate errors will be ignored for this session
1598103744249	Marionette	INFO	Stopped listening on port 41203

9. With -f option use --pid=PID option to terminate the tail command after the process ID, PID dies. We can see below the status of apache2 process. tail -f command shows the error.log file generated by apache2 process (pid=1235). The moment the apache2 process dies, the tail command terminates. The last line of the error.log file indicates that as soon as the processes dies, the tail command terminates.

$ ps axf|grep apache2
1266 pts/19   S+     0:00          |       \_ grep --color=auto apache2
1235 ?        Ss     0:00 /usr/sbin/apache2 -k start
1238 ?        S      0:00  \_ /usr/sbin/apache2 -k start
1239 ?        S      0:00  \_ /usr/sbin/apache2 -k start
1240 ?        S      0:00  \_ /usr/sbin/apache2 -k start
1241 ?        S      0:00  \_ /usr/sbin/apache2 -k start
1242 ?        S      0:00  \_ /usr/sbin/apache2 -k start
$ tail --pid=1235 -f error.log
[Sat Apr 10 09:38:02.060749 2021] [mpm_prefork:notice] [pid 1973] AH00163: Apache/2.4.18 (Ubuntu) SVN/1.9.3 OpenSSL/1.0.2g mod_perl/2.0.9 Perl/v5.22.1 configured -- resuming normal operations
[Sat Apr 10 09:38:02.060776 2021] [core:notice] [pid 1973] AH00094: Command line: '/usr/sbin/apache2'
[Sat Apr 10 19:46:47.009522 2021] [mpm_prefork:notice] [pid 1973] AH00169: caught SIGTERM, shutting down
[Sat Apr 10 19:58:20.338631 2021] [so:warn] [pid 477] AH01574: module dav_module is already loaded, skipping
[Sat Apr 10 19:58:20.373774 2021] [mpm_prefork:notice] [pid 478] AH00163: Apache/2.4.18 (Ubuntu) SVN/1.9.3 OpenSSL/1.0.2g mod_perl/2.0.9 Perl/v5.22.1 configured -- resuming normal operations
[Sat Apr 10 19:58:20.373815 2021] [core:notice] [pid 478] AH00094: Command line: '/usr/sbin/apache2'
[Sat Apr 10 20:02:44.070736 2021] [mpm_prefork:notice] [pid 478] AH00169: caught SIGTERM, shutting down
[Sat Apr 10 20:03:25.578843 2021] [so:warn] [pid 1234] AH01574: module dav_module is already loaded, skipping
[Sat Apr 10 20:03:25.611424 2021] [mpm_prefork:notice] [pid 1235] AH00163: Apache/2.4.18 (Ubuntu) SVN/1.9.3 OpenSSL/1.0.2g mod_perl/2.0.9 Perl/v5.22.1 configured -- resuming normal operations
[Sat Apr 10 20:03:25.611462 2021] [core:notice] [pid 1235] AH00094: Command line: '/usr/sbin/apache2'
[Sat Apr 10 20:05:19.987792 2021] [mpm_prefork:notice] [pid 1235] AH00169: caught SIGTERM, shutting down