This article will show you how to use the tail command to automatically view data that is appended to a file. This is particularly useful when you want to view the progress of some process from a log file. For example, if you want to see when the Apache server has finished loading, instead of doing a cat on the log file every few seconds you can use the tail command to constantly monitor the log file and output any updates to it.
Table of Contents
Understanding the ‘tail’ Command
tail command is a powerful yet simple utility found in Unix-like operating systems, designed primarily to display the last part of files to the terminal. By default,
tail prints the last 10 lines of each file it is given to standard output. This functionality is crucial for quickly accessing recent entries in log files or any file where new data is appended over time.
The basic syntax of the
tail command is as follows:
tail [OPTION]... [FILE]...
This command structure allows users to specify options to modify the behavior of
tail and to list one or more files whose contents the user wishes to view.
--follow: This option is used to output appended data as the file grows. It’s the most commonly used option for real-time monitoring.
--lines=[number]: This option allows users to specify the number of lines from the end of the file that they want to display. For example,
tail -n 5 file.txtdisplays the last 5 lines of
-F: This option is similar to
-f, but it also tries to keep the file open if it is inaccessible for a period or if the file is rotated. This is particularly useful for monitoring log files that are periodically rotated.
How to Use ‘tail’ for Real-Time Monitoring
Real-time file monitoring with
tail is an essential skill for system administrators, developers, and IT professionals. It allows them to watch the growth of files in real-time, which is particularly useful for log files, system updates, and any process that writes output over time.
Monitoring a Single File
To monitor updates to a file in real-time, use the
-f option with
tail. For example, to monitor a log file named
application.log, you would use the following command:
tail -f application.log
This command will display the last 10 lines of
application.log and then output appended data as the file grows.
Monitoring Multiple Files
tail can also monitor multiple files at once. When used with multiple files,
tail includes a header with the file name before the output of each file. For example, to monitor two log files simultaneously, you can use:
tail -f system.log application.log
Adjusting the Number of Displayed Lines
If you need to see more or fewer lines initially, you can use the
-n option. For instance, to display the last 20 lines of a file, you would use:
tail -n 20 -f application.log
This command shows the last 20 lines of
application.log and continues to display new lines as they are added.
tail -F for Robust Monitoring
In situations where files may be rotated or recreated, such as with log rotation, the
-F option becomes useful. This option behaves like
-f but will continue to monitor the file even if it is renamed or recreated:
tail -F application.log
This ensures continuous monitoring through file rotations, making it invaluable for long-term log file analysis.
By mastering these
tail command options, users can effectively monitor file updates in real-time, making it easier to track changes, debug issues, and stay informed about the status of processes and applications.
Advanced Usage of ‘tail’ for File Monitoring
While the basic usage of
tail is sufficient for many common tasks, combining it with other commands and employing advanced options can significantly enhance its utility for file monitoring.
One of the most powerful combinations for monitoring specific entries in real-time is using
tail -f with
grep. This approach filters the output to show only lines that match a particular pattern. For instance, to monitor an access log for entries related to a specific IP address, you could use:
tail -f access.log | grep '192.168.1.1'
This command will continuously monitor
access.log and display only the lines that contain the IP address
tail for Automated Monitoring
tail can be incorporated into shell scripts to automate monitoring tasks. For example, a script could use
tail -f to monitor a log file and trigger an alert or execute a command when certain text appears. This is particularly useful for automated error detection or for triggering notifications based on log file entries.
tail -f /var/log/application.log | while read line; do
echo "$line" | grep "ERROR" && echo "Error detected: $line" | mail -s "Error Alert" firstname.lastname@example.org
This script monitors
application.log for lines containing “ERROR”. When such a line is found, it sends an email alert to
email@example.com with the error details.
What does the ‘tail’ command do in Linux?
The ‘tail’ command in Linux displays the end of a text file or piped data. By default, it shows the last 10 lines of the specified files.
How can I continuously monitor a file with ‘tail’?
tail -f followed by the file name to continuously monitor its updates in real time. This command keeps the file open and displays new content as it’s added.
Can ‘tail’ show more than 10 lines by default?
Yes, by using the
-n option followed by a number, you can specify the exact number of lines
tail should display. For example,
tail -n 20 file.txt shows the last 20 lines.
Is it possible to monitor multiple files at once with ‘tail’?
Yes, you can monitor multiple files in real time by specifying more than one file with the
tail -f command, separating each file name with a space.
How does ‘tail -F’ differ from ‘tail -f’?
tail -F is similar to
tail -f, but it also attempts to reopen a file if it is inaccessible or gets rotated, ensuring continuous monitoring even if the file is recreated.