Linux tail command

Linux tail command is used to display the last ten lines of one or more files. Its main purpose is to read the error message. By default, it displays the last ten lines of a file. Additionally, it is used to monitor the file changes in real-time. It is a complementary command of the head command.

Introduction to tail

By default, the tail command shows the file contents. The display starts at a line, 512-byte block, or block location inside the input. Numbers that include a leading plus symbol are associated with the start of the input, e.g., "-c +2" begins the display on the second input byte. Numbers that include a leading minus or no explicit symbol are associated with the completion of the input, e.g., "-n 2" shows the last two input lines. "-n 10" or the last ten input lines are the default beginning location.

The tail command copies the specified file to the stdout start at a designated location. The stdin is copied if the file is not specified. Copying starts at the +number position measured from the start or -number from the completion of the input. The number is measured in bytes, 1K blocks, or lines, according to the b, c, or l appended flags. -101 is the default.

Further, the r flag leads the tail command to display lines from the completion of the file reversely. The f flag leads the tail command to keep watching and displaying further data as it shows after printing to the completion.

Syntax:

Implementations

The tail version grouped in GNU coreutils was specified by Jim Meyering, Ian Lance Taylor, David MacKenzie, and Paul Rubin. The command is available as an isolated package for Microsoft Windows as an element of the UnxUtils set of native Win32 ports of general GNU Unix-like utilities. The version of FreeDOS was integrated by M. Aitchison. Also, the tail command is a component of the MSX-DOS2 Tools of ASCII for MSX-DOS2.

CCZE is also tail-like when showing its result in color. pctail is the same as CCZE. It's a colorized tail specified in Python, which colorizes and tails the syslog result. Inotail is a detracted inotify kernel interface implementation. The early tail implementation polled every time to check if new data could be shown. Inotail used the inotify interface of the Linux kernel introduced in the 2.6.13 version in August 2015 so that it checks only for new data.

MultiTail does not just show logfiles in many colors; it can also filter, scrollback, merge, and split a terminal screen into subwindows. It's less or more a combination of Beeper, diff, grep, CCZE/pctail, watch, sed, tail, and others.

File monitoring

The tail command has two unique line options -F and -f that permits a file to be managed. Rather than just showing some last lines and closing, the tail command shows the lines and audits the file. The tail command can update the display because new lines are included in the file by other processes.

Particularly, it is helpful for auditing log files. Older versions of the tail command, by default, poll the file every time, but it supports inotify infrastructure specified in the 2.6.13 version of Linux kernel in August 2005, which only monitors the file if it is notified modifications by the kernel.

Default behavior

The default use of the tail command displays the last ten lines of the files. Create a file 'num.txt' having numbers 1 to 15 (each number in a new line).

Let's open it by executing the tail command without any arguments as follows:

Consider the below output:

From the above output, we can see the last ten lines of the 'num.txt' are displayed.

Options of tail

--block=number, -b number: number 512-byte block is the location.
--bytes=number, -c number: number byte is the location.
-f: This option leads the tail command not to stop if the file's end is reached, but instead of waiting for other data to be added to the input. The option is avoided when stdin is a pipe, but not when it's a FIFO.
-F: This option signifies the -f flag, but the tail command will also find if the followed file has been rotated or renamed. The file is sealed and re-opened if the tail command finds that the filename is read from includes the numbers of a new inode.

The tail command will keep searching and will show the file from the start when and if it's created, if the followed file doesn't become available, or if it's removed. The -F option is similar to the -f option when reading from stdin instead of a file.

--lines=number, -n number: number line is the location.
-q: The -q option is used to suppress header printing if two or more files are being monitored.
-r: The -r option leads the input to be shown by the line in reverse order. This option additionally modifies the meaning of the -n, -b, and -c options. If the -r option is named, these options define the total number of the 512-byte blocks, lines, or bytes to show rather than the bytes, blocks, or lines from the start or completion of the input through which to start the display. For -r, the default is to show every input.

All files are preceded by the header composed of the "==> XXX <==" string, in which XXX is the file name unless the -q option is specified if more than one file is specified.

Display the specific number of Lines

The '-n' option displays the specified number of lines. To specify the number of lines, execute the command as follows:

It will display the specified number of lines from the last. Consider the below example:

The above command will display the last five lines of the file 'num.txt'. We can also omit the letter 'n' instead, and we can use the hyphen (-) and the number without any space. Consider the below output:

As we can see from the above output, the last five lines of 'num.txt' are displayed.

Display the specified number of bytes

The '-c' option displays the specified number of bytes from the last. To display the specified number of bytes, execute the command as follows:

It will display the specified number of bytes. Consider below example:

The above command will display the file content up to 6 bytes from last. Consider the below output:

From the above output, the last six bytes of the file 'num.txt' are displayed.

We can also use the suffix with the number such as b, kb, k, MB, and more to specify the number of bytes. These suffixes multiplied the specified number as:

b: multiplies it by 512.

kb: multiplies it by 1000.

k: multiplies it by 1024.

MB: multiplies it by 1000000.

Track a file for changes

To track a file for changes, the '-f' option is used. Here, '-f' stands for the following. It is useful for monitoring log files. Execute the below command:

The above command will monitor the file 'num.txt'. To exit from monitoring, press "CTRL+C" keys. Consider the below output:

Display multiple files

We can display multiple files from last at once by executing the tail command. To display the multiple files, provide the file names as input. It will display the last ten lines of specified files.

For example, we have another file 'alphabet.txt' that contains every character of the alphabet in a new line. To display both files 'num.txt' and 'alphabet.txt,' execute the command as follows:

The above command will display the last ten lines of the specified files. Consider the below output:

As from the above output, we can see that the last ten lines of the specified files are displayed at once.

Tail with other commands

The tail command can be used with other commands. It can be piped to other commands to filter the output. Consider the below command:

From the above command, we have piped the tail command with the ls command. It will only display six files or folders modified the longest time ago. Consider the below output: