10+ useful tail command’s switches with example – Unix/Linux
The tail command
By default, the tail command prints the last 10 lines from the file which is given followed by the tail command. In the case of more than one file with tail command displays separate output with a header identifying the file name. Tail command has a lot of useful and also very helpful switches.
Useful switches with example:
“I’ve copied the ‘/etc/passwd’ and ‘/etc/shadow’ files to pass.txt and sha.txt respectively to demonstrate examples.”
1. tail : The tail command alone
Which displays the last 10 line by-default.
Example:
# tail pass.txt cpanelphppgadmin:x:32004:32004::/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/cpanel/bin/noshell ...................... ...................... tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell
2. tail : More than one file
Displays separate output with a header identifying the file name.
Example:
# tail pass.txt sha.txt ==> pass.txt <== cpanelphppgadmin:x:32004:32004::/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/cpanel/bin/noshell ...................... ...................... tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell ==> sha.txt <== cpanelphppgadmin:*:16073:::::: ...................... ...................... tomcat:!!:16074:::::: crybit:$6$xbycY1hCeTldon5.$.J6ZtPA77351rLQdo23tKi4o5cTrjlJOOzkZJs11AeMqeGlsnTdLzuo2x7HtOzf0JigQ42AlrfTRzj5Bdcl/D.:16085:0:99999:7:::
3. tail -n : Displays last “n” lines from the text file
Example:
# tail -n3 pass.txt cpses:x:496:497::/var/cpanel/cpses:/sbin/nologin tomcat:x:495:99:Apache Tomcat:/home/tomcat:/bin/nologin crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell
4. -c, –bytes=K
Output the last K bytes; alternatively, use -c +K to output bytes starting with the Kth of each file.
Example:
# tail -c 100 pass.txt pache Tomcat:/home/tomcat:/bin/nologin crybit:x:503:504::/home/crybit:/usr/local/cpanel/bin/noshell
5. -f, –follow[={name|descriptor}]
Output appended data as the file grows; -f, –follow, and –follow=descriptor are equivalent
6. -F same as –follow=name –retry
7. –max-unchanged-stats=N
with –follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated log files). With inotify, this option is rarely useful.
8. –pid=PID
With -f, terminate after process ID, PID dies
9. -q, –quiet, –silent
never output headers giving file names
10. –retry
Keep trying to open a file even when it is or becomes inaccessible; useful when following by name, i.e., with –follow=name
11. -s, –sleep-interval=N
With -f, sleep for approximately N seconds (default 1.0) between iterations.
12. –version
Displays the version.
13. –help
Displays the help messages.
The “-f” switch is very useful for analyzing the log files dynamically.
Examples: Watching apache error log dynamically.
# tail -f /usr/local/apache/logs/error_log Or # tailf /usr/local/apache/logs/error_log
Linux Tail Command Options With Examples
The linux tail command does something like its name. It displays the last few lines of a file. It is mostly used for viewing log file updates as these updates are appended to the log files. This article explains tail command with most common options.
Tail Command Options
The tail command accepts input from STDIN. By default, the tail command displays last ten lines. So at STDIN, if you enter more than 10 lines, only last 10 lines will be displayed. In the following example, I will input numbers in descending order from 12 and after inputting 1, I will ctrl+d (i.e. end of file marker)
$ tail
12
11
10
9
8
7
6
5
4
3
2
1
10
9
8
7
6
5
4
3
2
1
With a file name as argument, it displays last 10 lines for that file.
$ tail file1.txt
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
If multiple files are given as argument, it precedes each with a header displaying the name of the file.
$ tail file1.txt file2.txt
==> file1.txt <==
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic==> file2.txt <==
smi.conf
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d
If you do not want to print the headers, you can use quiet mode with -q or –quiet or –silent option.
$ tail -q file1.txt file2.txt
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
smi.conf
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d
And if you always want to print headers, even when only one file name is provided as argument, you can use -v or –verbose option
$ tail -v file1.txt
==> file1.txt <==
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
Print last K number of lines
When you want to change the default behavior and change the last number of lines from 10 to something else, -n option is used
$ tail -n3 file1.txt
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
You can use -3 directly to print last 3 lines
$ tail -3 file1.txt
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
Print last K bytes
For printing the last K bytes of the file, use -c or –bytes=K option
$ tail -c 30 file2.txt
udoers.d
sysctl.conf
sysctl.d
This prints last 30 bytes of the file. Alternatively, you can use -c +K to output bytes starting with the Kth of each file.
$ tail -c +300 file1.txt
nfig-2.6.38-8-generic
grub
initrd.img-2.6.38-12-generic
initrd.img-2.6.38-13-generic
initrd.img-2.6.38-8-generic
memtest86+.bin
memtest86+_multiboot.bin
System.map-2.6.38-12-generic
System.map-2.6.38-13-generic
System.map-2.6.38-8-generic
vmcoreinfo-2.6.38-12-generic
vmcoreinfo-2.6.38-13-generic
vmcoreinfo-2.6.38-8-generic
vmlinuz-2.6.38-12-generic
vmlinuz-2.6.38-13-generic
vmlinuz-2.6.38-8-generic
View a growing file
When viewing some log file, if you want to check some changes being made at the end of the file, i.e. if you want to output appended data as the file grows, you will use -f or –follow option. For the illustration of this option, let us display the last 3 lines with follow option
$ tail -n3 -f file2.txt
sudoers.d
sysctl.conf
sysctl.d
You will not get the prompt back and it will wait for the appended data. Now in the other terminal, let us append some line in the file
$ echo “hello” >> file2.txt
It will appear on the previous terminal as
$ tail -n3 -f file2.txt
sudoers.d
sysctl.conf
sysctl.d
hello
You can adjust the sleep interval between the iterations, i.e. it will check after the provided number of seconds for the append updates with -s or –sleep-interval=N (default is 1) seconds.
$ tail -n 3 -f -s 4 file2.txt
sysctl.conf
sysctl.d
hello
The follow option does not exit by itself. But you can tell the command to terminate after some process with Process ID PID dies with –pid=PID option.
$ tail -f file2.txt –pid=4309
snmp
sound
speech-dispatcher
ssh
ssl
sudoers
sudoers.d
sysctl.conf
sysctl.d
hello
The command will exit as soon as the process with PID 4309 dies.
Linux Tail Command Version
$ tail –version
tail (GNU coreutils) 8.13
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later .
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Tail Command Examples in Unix / Linux Tutorials
tail [options] [files]
The tail command options are:
- c : Prints the last N bytes of file; With leading +, prints the characters from the N byte in the file.
- n : Prints last N lines; With leading + prints lines from the Nth line in the file.
- f : Prints the appended lines on the terminal as the file grows.
Tail Command Examples
Create the following file in your linux or unix operating system for practising the examples:
> cat example.txt virtual storage oracle virtual instance mysql backup dedicated hosting server cloud servers
1. Display last 10 lines
By default, the tail command prints the last 10 lines from the file.
> tail example.txt
2. Display last N lines
Use the -n option to print the last n lines from the file. The following example prints the last 2 lines from the file:
> tail -n2 example.txt dedicated hosting server cloud servers
3. Print lines from the Nth line
You can print lines starting from the Nth line in a file. The following example prints lines from the 2nd line.
> tail -n+2 example.txt oracle virtual instance mysql backup dedicated hosting server cloud servers
4. Print the last n bytes.
use the -c option to print the last N bytes from the file. The following example prints the last 8 bytes from the file.
> tail -c8 example.txt servers
5. Print characters from the Nth byte.
Use the leading “+” with -c option to print the characters from the Nth byte. The following example prints the characters from the 79th byte.
> tail -c+79 example.txt cloud servers
6. Print last lines from dynamically changing file.
The -f option print the lines from file that is growing dynamically. When you run the tail -f filename command, it prints the last 10 lines and waits for new lines to be added to the file. Whenever the new lines are appended to the file, the tail command also appends the new lines on the standard output. The -f option is useful when debugging applications. In general, the applications writes error messages to log files. You can use the -f option to check for the error messages as and when they appear in the log file.
> tail -f logfile
Network and Security Professional 