Tail command in Linux

10+ useful tail command’s switches with example – Unix/Linux

The tail command
By default, the tail command prints the last 10 lines from the file which is given followed by the tail command. In the case of more than one file with tail command displays separate output with a header identifying the file name. Tail command has a lot of useful and also very helpful switches.

Useful switches with example:
“I’ve copied the ‘/etc/passwd’ and ‘/etc/shadow’ files to pass.txt and sha.txt respectively to demonstrate examples.”

1. tail : The tail command alone
Which displays the last 10 line by-default.
Example:

# tail pass.txt
cpanelphppgadmin:x:32004:32004::/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/cpanel/bin/noshell
......................
......................
tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin
crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell

2. tail : More than one file
Displays separate output with a header identifying the file name.
Example:

# tail pass.txt sha.txt
==> pass.txt <== 
cpanelphppgadmin:x:32004:32004::/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/cpanel/bin/noshell 
...................... 
...................... 
tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin 
crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell 
==> sha.txt <==
cpanelphppgadmin:*:16073::::::
......................
......................
tomcat:!!:16074::::::
crybit:$6$xbycY1hCeTldon5.$.J6ZtPA77351rLQdo23tKi4o5cTrjlJOOzkZJs11AeMqeGlsnTdLzuo2x7HtOzf0JigQ42AlrfTRzj5Bdcl/D.:16085:0:99999:7:::

3. tail -n : Displays last “n” lines from the text file
Example:

# tail -n3 pass.txt
cpses:x:496:497::/var/cpanel/cpses:/sbin/nologin
tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin
crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell

4. -c, –bytes=K
Output the last K bytes; alternatively, use -c +K to output bytes starting with the Kth of each file.
Example:

# tail -c 100  pass.txt
pache Tomcat:/home/tomcat:/bin/nologin
crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell

5. -f, –follow[={name|descriptor}]
Output appended data as the file grows; -f, –follow, and –follow=descriptor are equivalent

6. -F same as –follow=name –retry

7. –max-unchanged-stats=N
with –follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated log files). With inotify, this option is rarely useful.

8. –pid=PID
With -f, terminate after process ID, PID dies

9. -q, –quiet, –silent
never output headers giving file names

10. –retry
Keep trying to open a file even when it is or becomes inaccessible; useful when following by name, i.e., with –follow=name

11. -s, –sleep-interval=N
With -f, sleep for approximately N seconds (default 1.0) between iterations.

12. –version
Displays the version.

13. –help
Displays the help messages.

The “-f” switch is very useful for analyzing the log files dynamically.
Examples: Watching apache error log dynamically.

# tail -f /usr/local/apache/logs/error_log
Or
# tailf /usr/local/apache/logs/error_log

Linux Tail Command Options With Examples

The linux tail command does something like its name. It displays the last few lines of a file. It is mostly used for viewing log file updates as these updates are appended to the log files. This article explains tail command with most common options.

Tail Command Options

The tail command accepts input from STDIN. By default, the tail command displays last ten lines. So at STDIN, if you enter more than 10 lines, only last 10 lines will be displayed. In the following example, I will input numbers in descending order from 12 and after inputting 1, I will ctrl+d (i.e. end of file marker)

$ tail
12
11
10
9
8
7
6
5
4
3
2
1
10
9
8
7
6
5
4
3
2
1

With a file name as argument, it displays last 10 lines for that file.

$ tail file1.txt
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

If multiple files are given as argument, it precedes each with a header displaying the name of the file.

$ tail file1.txt file2.txt
==> file1.txt <==
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

==> file2.txt <==
smi.conf
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d

If you do not want to print the headers, you can use quiet mode with -q or –quiet or –silent option.

$ tail -q file1.txt file2.txt
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
smi.conf
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d

And if you always want to print headers, even when only one file name is provided as argument, you can use -v or –verbose option

$ tail -v file1.txt
==> file1.txt <==
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

Print last K number of lines

When you want to change the default behavior and change the last number of lines from 10 to something else, -n option is used

$ tail -n3 file1.txt
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

You can use -3 directly to print last 3 lines

$ tail -3 file1.txt
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

Print last K bytes

For printing the last K bytes of the file, use -c or –bytes=K option

$ tail -c 30 file2.txt
udoers.d
sysctl.conf
sysctl.d

This prints last 30 bytes of the file. Alternatively, you can use -c +K to output bytes starting with the Kth of each file.

$ tail -c +300 file1.txt
nfig-2.6.38-8-generic
grub
initrd.img-2.6.38-12-generic
initrd.img-2.6.38-13-generic
initrd.img-2.6.38-8-generic
memtest86+.bin
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic

View a growing file

When viewing some log file, if you want to check some changes being made at the end of the file, i.e. if you want to output appended data as the file grows, you will use -f or –follow option. For the illustration of this option, let us display the last 3 lines with follow option

$ tail -n3 -f file2.txt
sudoers.d
sysctl.conf
sysctl.d

You will not get the prompt back and it will wait for the appended data. Now in the other terminal, let us append some line in the file

$ echo “hello” >> file2.txt

It will appear on the previous terminal as

$ tail -n3 -f file2.txt
sudoers.d
sysctl.conf
sysctl.d
hello

You can adjust the sleep interval between the iterations, i.e. it will check after the provided number of seconds for the append updates with -s or –sleep-interval=N (default is 1) seconds.

$ tail -n 3 -f -s 4 file2.txt
sysctl.conf
sysctl.d
hello

The follow option does not exit by itself. But you can tell the command to terminate after some process with Process ID PID dies with –pid=PID option.

$ tail -f file2.txt –pid=4309
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d
hello

The command will exit as soon as the process with PID 4309 dies.

Linux Tail Command Version

$ tail –version
tail (GNU coreutils) 8.13
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later .
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Tail Command Examples in Unix / Linux Tutorials

The tail command in unix or linux system is used to print the last N lines from the file on the terminal. Tail command is especially used with log files to read the last few lines to know about the error messages. The syntax of tail command is

tail [options] [files]

The tail command options are:

  • c : Prints the last N bytes of file; With leading +, prints the characters from the N byte in the file.
  • n : Prints last N lines; With leading + prints lines from the Nth line in the file.
  • f : Prints the appended lines on the terminal as the file grows.

Tail Command Examples
Create the following file in your linux or unix operating system for practising the examples:

> cat example.txt
virtual storage
oracle virtual instance
mysql backup
dedicated hosting server
cloud servers

1. Display last 10 lines

By default, the tail command prints the last 10 lines from the file.

> tail example.txt

2. Display last N lines

Use the -n option to print the last n lines from the file. The following example prints the last 2 lines from the file:

> tail -n2 example.txt
dedicated hosting server
cloud servers

3. Print lines from the Nth line

You can print lines starting from the Nth line in a file. The following example prints lines from the 2nd line.

> tail -n+2 example.txt
oracle virtual instance
mysql backup
dedicated hosting server
cloud servers

4. Print the last n bytes.

use the -c option to print the last N bytes from the file. The following example prints the last 8 bytes from the file.

> tail -c8 example.txt
servers

5. Print characters from the Nth byte.

Use the leading “+” with -c option to print the characters from the Nth byte. The following example prints the characters from the 79th byte.

> tail -c+79 example.txt
cloud servers

6. Print last lines from dynamically changing file.

The -f option print the lines from file that is growing dynamically. When you run the tail -f filename command, it prints the last 10 lines and waits for new lines to be added to the file. Whenever the new lines are appended to the file, the tail command also appends the new lines on the standard output. The -f option is useful when debugging applications. In general, the applications writes error messages to log files. You can use the -f option to check for the error messages as and when they appear in the log file.

> tail -f logfile

		
Advertisements

Posted on June 16, 2015, in Linux (Ubuntu/CentOS). Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: