tail

The tail command displays the end of a file or input stream. It can also remain active and show data appended to a file, which is useful when observing logs.

Displaying the Last Ten Lines

With no count option, tail prints the last 10 lines of each named file:

$ tail application.log

If the file contains fewer than 10 lines, all available lines are printed. The file itself is not changed.

CheckWhat does tail application.log display by default?

Up to the initial 10 lines of the file. Every line added after the command starts. Up to the final 10 lines of the file.

Choosing a Line or Byte Count

Use -n NUMBER to select a different number of final lines:

$ tail -n 20 application.log

Use -c NUMBER when you need the final bytes instead:

$ tail -c 100 payload.bin

Byte mode can begin in the middle of a text line or encoded character, so line mode is usually clearer for text.

CheckWhich command displays the final 20 lines of application.log?

tail -n 20 application.log head -n 20 application.log tail -c 20 application.log

Starting at a Particular Line

A count prefixed with + changes the meaning: tail -n +N starts with line N and prints through the end.

$ tail -n +5 report.txt

This skips the first four lines and begins at line 5. It is useful for removing a known number of header lines from a stream.

CheckWhich command prints report.txt starting with line 5?

tail -n +5 report.txt tail -n 5 report.txt head -n +5 report.txt

Following Appended Data

With -f, tail prints the initial ending and remains active, showing data as it is appended:

$ tail -f application.log

Press Ctrl+C to interrupt tail and return to the shell. Following a file only displays new content; it does not guarantee that the application producing the log is healthy or that every relevant event uses that file.

CheckWhich command shows the current end of application.log and keeps waiting for appended content?

tail -f application.log tail -n 0 application.log less application.log

Following a Rotated Log by Name

Log rotation can rename an old file and create a new file at the original pathname. GNU tail -F is equivalent to following by name while retrying, so it can reopen a file that is replaced or temporarily missing:

$ tail -F application.log

Use -f when following the currently opened file is the desired behavior, and -F when a named log is expected to rotate. These are GNU behaviors; other implementations can differ.

CheckOn GNU/Linux, which option is better suited to following application.log across common rename-and-recreate log rotation?

-n -c -F

When no file is named, tail reads stdin, so it can select the end of command output. Multiple named files receive identifying headers by default, as with head.

To practice viewing and following file endings, try these hands-on labs:

1. Linux tail Command: File End Display - Learn the Linux tail command for viewing and monitoring the end of text files, including the -f option for real-time updates.
2. Viewing Log and Configuration Files in Linux - Practice using tail (along with cat and more) to efficiently view and navigate log and configuration files, which is crucial for system monitoring.
3. Rapid Threat Detection - Apply your knowledge of tail to quickly extract and analyze recent log entries, simulating rapid threat detection in a cybersecurity context.

Summary

You can now inspect file endings and observe newly appended content with tail.

1. Display the final ten lines by default.
2. Select a line or byte count explicitly.
3. Start output at a numbered line with -n +N.
4. Follow appended content with -f and stop with Ctrl+C.
5. Use GNU -F when a named log may be rotated.