How to Use the Tail Command
Updated by Phil Zona
In this guide, you’ll learn how to use the
tail command. Using
tail is a simple way to show the ends of files, for example, when analyzing logs and other text files that change over time. It may also be combined with other tools for selective, real-time monitoring. When performing administrative tasks on your Linode,
tail is one of the most useful tools available.
tailcommand, followed by the file you’d like to view:
This will print the last ten lines of the
/var/log/auth.logfile to your terminal output.
To change the number of lines displayed, use the
tail -n 50 /var/log/auth.log
In this example, the last 50 lines will be shown, but you can modify this number to show as many or as few lines as you need.
To show a real-time, streaming output of a changing file, use the
tail -f /var/log/auth.log
This will print the end of the file to your screen, and update it as the file changes. For example, you can use this option with
/var/log/auth.log(on Debian and Ubuntu systems) to show your access log in real time. This will run as a foreground process, so to cancel it, press CTRL+C.
Tail can even be combined with other tools like
grepto filter the results:
tail /var/log/auth.log | grep 198.51.100.1
This command would search the last ten lines of your access log and only display those that contain the IP address
198.51.100.1. You can also apply options to
tailin order to show more or less lines, view the filtered results in real time, and more.
These are just the basics of how to use
tail. It is an incredibly useful tool with many more options than we’ve listed here. To learn more advanced techniques, please check out our full guide on the tail command.
This guide is published under a CC BY-ND 4.0 license.