Tail Command Examples In Linux/UNIX

Many Linux users use cat command to display the entier file content. It’s ok if you use cat command to display the entire file content but in some cases you will need to print some line or part of a file, in this case you can use tail command. The tail command in UNIX or Linux system is used to print the last N lines from the file on the terminal. Tail command is especially used with log files to read the last few lines to know about the error messages.

In this article I will provide you some tail command examples which are very useful when you want to display certain part at the end of a file.

Syntax:

tail [OPTION]... [FILE]...

Tail command options:

• c : Prints the last N bytes of file; With leading +, prints the characters from the N byte in the file.
• n : Prints last N lines; With leading + prints lines from the Nth line in the file.
• f : Prints the appended lines on the terminal as the file grows.

Linux Tail Command Examples

Tail command is used to display the last few number of lines (By default it display 10 lines) of a certain file.

1. Display last lines (Default 10 Lines) of a file

Follow the below command to display the last line of a file.

# tail /var/log/messages
Apr 26 04:45:36 ip-172-31-28-36 ec2net: [get_meta] Trying to get http://169.254.169.254/latest/meta-data/network/interfaces/macs/0e:53:e9:de:a6:22/local-ipv4s
Apr 26 04:45:36 ip-172-31-28-36 ec2net: [rewrite_aliases] Rewriting aliases of eth0
Apr 26 04:47:26 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 127140ms.
Apr 26 04:49:33 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 121200ms.
Apr 26 04:51:34 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 122160ms.
Apr 26 04:53:37 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 117300ms.
Apr 26 04:55:34 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 120360ms.
Apr 26 04:57:34 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 121280ms.
Apr 26 04:59:36 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 109730ms.
Apr 26 05:01:26 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 129900ms.

Above you can see tail command printed last 10 lines of /var/log/messages files.

2. Print N nubmer of lines of a file

If you want to print N number of lines of a file you can use –n option with tail command instead of the default 10 lines. In my case I am printing 5 lines of a file.

# tail -n 5 /var/log/messages
Apr 26 04:59:36 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 109730ms.
Apr 26 05:01:26 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 129900ms.
Apr 26 05:03:36 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 116700ms.
Apr 26 05:05:32 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 131760ms.
Apr 26 05:07:44 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 128240ms.

3. Display N number of lines opnening multiple files

You can open multiple files using tail command without executing multiple tail command to display multiple files. In my case I am printing last 2 lines of a file.

# tail -n 2 /var/log/messages /var/log/maillog /var/log/yum.log
==> /var/log/messages <== Apr 26 05:09:53 ip-172-31-28-36 ec2net: [rewrite_aliases] Rewriting aliases of eth0 Apr 26 05:12:03 ip-172-31-28-36 dhclient[2121]: XMT: Solicit on eth0, interval 130640ms. ==> /var/log/maillog <== Apr 26 04:34:02 ip-172-31-28-36 sendmail[9380]: v3Q4Y2kN009380: v3Q4Y2kO009380: return to sender: Host unknown (Name server: looklinux: host not found) Apr 26 04:34:02 ip-172-31-28-36 sendmail[9380]: v3Q4Y2kO009380: to=root, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32661, dsn=2.0.0, stat=Sent ==> /var/log/yum.log <==
Apr 11 11:34:16 Updated: php56-5.6.30-1.133.amzn1.x86_64
Apr 11 11:34:16 Installed: php56-gd-5.6.30-1.133.amzn1.x86_64

4. Print the lines from file that is growing dynamically

When you run the tail -f filename command, it prints the last 10 lines and waits for new lines to be added to the file. Whenever the new lines are appended to the file, the tail command also appends the new lines on the standard output. The -f option is useful when debugging applications. In general, the applications writes error messages to log files. You can use the -f option to check for the error messages as and when they appear in the log file.

# tail -f /var/log/httpd/access_log
::1 - - [24/Apr/2017:10:11:21 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:10:11:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:20:29:19 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:23 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"

5. Print the lines from file that is growing dynamically with sleep interval

You can also use –s option with –f to determine the sleep interval, whereas tail -f will keep watching the file and it refresh every 1 second, if you want to control this, then you can use -s option “sleep” and specify the sleep interval.

# tail -f -s 5 /var/log/httpd/access_log
::1 - - [24/Apr/2017:10:11:21 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:10:11:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:20:29:19 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:23 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"

6. Print the lines from multiple files that are growing dynamically

As we seen in example 3, We can open more files using tail command. Even we can view 2 files at the same time growing using -f option as well.

# tail -f /var/log/httpd/access_log /var/log/httpd/error_log
==> /var/log/httpd/access_log <== ::1 - - [24/Apr/2017:10:11:21 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [24/Apr/2017:10:11:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [24/Apr/2017:20:29:19 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:23 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)" ==> /var/log/httpd/error_log <==
[Sun Apr 23 03:31:02.099708 2017] [lbmethod_heartbeat:notice] [pid 14553] AH02282: No slotmem from mod_heartmonitor
[Sun Apr 23 03:31:02.171629 2017] [mpm_prefork:notice] [pid 14553] AH00163: Apache/2.4.25 (Amazon) configured -- resuming normal operations
[Sun Apr 23 03:31:02.171647 2017] [core:notice] [pid 14553] AH00094: Command line: '/usr/sbin/httpd'
[Mon Apr 24 11:42:23.200369 2017] [mpm_prefork:notice] [pid 14553] AH00173: SIGHUP received.  Attempting to restart
AH00557: httpd: apr_sockaddr_info_get() failed for looklinux
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message
[Mon Apr 24 11:42:23.301148 2017] [auth_digest:notice] [pid 14553] AH01757: generating secret for digest authentication ...
[Mon Apr 24 11:42:23.303041 2017] [lbmethod_heartbeat:notice] [pid 14553] AH02282: No slotmem from mod_heartmonitor
[Mon Apr 24 11:42:23.364745 2017] [mpm_prefork:notice] [pid 14553] AH00163: Apache/2.4.25 (Amazon) configured -- resuming normal operations
[Mon Apr 24 11:42:23.364762 2017] [core:notice] [pid 14553] AH00094: Command line: '/usr/sbin/httpd'

If you want to remove header you can use -q option for quiet mode.

# tail -fq /var/log/httpd/access_log /var/log/httpd/error_log
::1 - - [24/Apr/2017:10:11:21 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:10:11:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:20:29:19 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:23 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
[Sun Apr 23 03:31:02.099708 2017] [lbmethod_heartbeat:notice] [pid 14553] AH02282: No slotmem from mod_heartmonitor
[Sun Apr 23 03:31:02.171629 2017] [mpm_prefork:notice] [pid 14553] AH00163: Apache/2.4.25 (Amazon) configured -- resuming normal operations
[Sun Apr 23 03:31:02.171647 2017] [core:notice] [pid 14553] AH00094: Command line: '/usr/sbin/httpd'
[Mon Apr 24 11:42:23.200369 2017] [mpm_prefork:notice] [pid 14553] AH00173: SIGHUP received.  Attempting to restart
AH00557: httpd: apr_sockaddr_info_get() failed for looklinux
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message
[Mon Apr 24 11:42:23.301148 2017] [auth_digest:notice] [pid 14553] AH01757: generating secret for digest authentication ...
[Mon Apr 24 11:42:23.303041 2017] [lbmethod_heartbeat:notice] [pid 14553] AH02282: No slotmem from mod_heartmonitor
[Mon Apr 24 11:42:23.364745 2017] [mpm_prefork:notice] [pid 14553] AH00163: Apache/2.4.25 (Amazon) configured -- resuming normal operations
[Mon Apr 24 11:42:23.364762 2017] [core:notice] [pid 14553] AH00094: Command line: '/usr/sbin/httpd'

7. Print the last N bytes

You can use the –c option to print the last N bytes from the file. The following example prints the last 500 bytes from the file.

# tail -c 500 /var/log/httpd/access_log
my connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"

8. Print lines from the Nth line

You can print lines starting from the Nth line in a file. The following example prints lines from the 5th line.

# tail -n +5 /var/log/httpd/access_log
::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"

9. Print characters from the Nth byte

You can use the leading “+” with –c option to print the characters from the Nth byte. The following example prints the characters from the 79th byte.

# tail -c +79 /var/log/httpd/access_log
4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:10:11:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [24/Apr/2017:20:29:19 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:23 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:24 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:25 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:26 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:27 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:30 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"
::1 - - [25/Apr/2017:23:27:37 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.25 (Amazon) (internal dummy connection)"

I hope this article will be helpful to you. If I have missed anything please share with me using comment section.

Thanks:)