As Linux customers, we regularly work with long-running background Linux processes, that are referred to as daemons or companies. A few of the widespread examples of the companies are Safe Shell (sshd), Community Supervisor (networkd), Quantity Supervisor (LVM), Cron, and the listing goes on.
Many instances we have to monitor the logs of those companies to debug the system points. Nonetheless, one of many major challenges is that these companies generate a number of logs and more often than not going by these logs makes it cumbersome, that is the place we will use the tail command.
tail command is a command-line utility, much like the head command that reads a file and prints the final 10 traces (content material) of a number of recordsdata to straightforward output.
On this sensible information, we are going to be taught in regards to the tail command. By the tip of this information, Linux command-line customers will be capable of use the tail command successfully.
tail Command Syntax
The syntax of the tail command is much like different Linux instructions:
$ tail [OPTIONS] [FILE-1] [FILE-2] ...
1. Print Final 10 Strains Of File in Linux
By default, the tail command prints the final 10 traces of the given file as proven.
$ tail /var/log/safe Apr 2 14:17:24 TecMint sshd[201178]: Disconnected from consumer tecmint 192.168.0.162 port 59774 Apr 2 14:17:24 TecMint sshd[201165]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 14:29:12 TecMint sshd[201366]: Accepted password for tecmint from 192.168.0.162 port 56378 ssh2 Apr 2 14:29:12 TecMint systemd[201371]: pam_unix(systemd-user:session): session opened for consumer tecmint(uid=1002) by (uid=0) Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session opened for consumer tecmint(uid=1002) by (uid=0) Apr 2 14:29:12 TecMint sshd[201382]: Obtained disconnect from 192.168.0.162 port 56378:11: disconnected by consumer Apr 2 14:29:12 TecMint sshd[201382]: Disconnected from consumer tecmint 192.168.0.162 port 56378 Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
Right here, we will see that the above command exhibits the final ten traces from the /var/log/safe file.
2. Print Final N Strains of File in Linux
Within the final instance, the command prints the final 10 traces of the given file. Nonetheless, we will use the -n possibility which permits us to restrict the variety of traces to be printed on the display screen as proven.
$ tail -n 3 /var/log/safe Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
On this instance, we will see that now the command exhibits the final three traces solely as an alternative of the ten traces.
3. Ignore First N Strains of a File in Linux
Right here, we will use the plus (+) image with the -n possibility, which permits us to regulate the place to begin from the given file.
To grasp this, let’s use the +5 worth to start out the output from the fifth line:
$ tail -n +5 /var/log/safe Apr 2 14:17:24 TecMint sshd[201178]: Disconnected from consumer tecmint 192.168.0.162 port 59774 Apr 2 14:17:24 TecMint sshd[201165]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 14:29:12 TecMint sshd[201366]: Accepted password for tecmint from 192.168.0.162 port 56378 ssh2 Apr 2 14:29:12 TecMint systemd[201371]: pam_unix(systemd-user:session): session opened for consumer tecmint(uid=1002) by (uid=0) Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session opened for consumer tecmint(uid=1002) by (uid=0) Apr 2 14:29:12 TecMint sshd[201382]: Obtained disconnect from 192.168.0.162 port 56378:11: disconnected by consumer Apr 2 14:29:12 TecMint sshd[201382]: Disconnected from consumer tecmint 192.168.0.162 port 56378 Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
4. Present Final N Characters of the File
Much like traces, we will additionally use the command to show the final N characters of the file utilizing the -c possibility as proven under:
$ tail -c 7 /var/log/safe (uid=0)
On this instance, we will see that the command exhibits the final seven ASCII characters of the given file.
5. Take away First N Characters of File
Equally, we will use the plus image (+) with the -c choice to skip the primary N character. So let’s skip the primary line of the file utilizing the under command:
$ tail -c +5 /var/log/safe Apr 2 03:02:59 TecMint sudo[162801]: root : TTY=pts/2 ; PWD=/root ; USER=root ; COMMAND=/bin/dnf set up R Apr 2 03:02:59 TecMint sudo[162801]: pam_unix(sudo:session): session opened for consumer root(uid=0) by root(uid=0) Apr 2 03:03:02 TecMint sudo[162801]: pam_unix(sudo:session): session closed for consumer root Apr 2 03:11:17 TecMint groupadd[163602]: group added to /and so on/group: identify=avahi, GID=70 Apr 2 03:11:18 TecMint groupadd[163602]: group added to /and so on/gshadow: identify=avahi Apr 2 03:11:18 TecMint groupadd[163602]: new group: identify=avahi, GID=70 Apr 2 03:11:19 TecMint useradd[163610]: new consumer: identify=avahi, UID=70, GID=70, residence=/var/run/avahi-daemon, shell=/sbin/nologin, from=none Apr 2 03:13:41 TecMint groupadd[163704]: group added to /and so on/group: identify=colord, GID=986 Apr 2 03:13:41 TecMint groupadd[163704]: group added to /and so on/gshadow: identify=colord
Right here, we will see that the command exhibits all of the traces besides the primary line.
6. Present File Title in Header
We are able to instruct the tail command to show the present file identify as a show header, which turns out to be useful whereas working with a number of recordsdata.
So, let’s use the -v choice to allow the show header:
$ tail -n 3 -v /var/log/safe ==>/var/log/safe <== Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
Within the above output, ==> /var/log/safe <== represents the show header.
7. Present File Title as Header in A number of Information
Identical to another file-processing command, we will additionally use a number of recordsdata with the tail command. In such circumstances, the show header will get used to separate the file contents.
$ tail -n 3 -v /var/log/safe /var/log/secure-20230402 ==> /var/log/safe <== Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0) ==> /var/log/secure-20230402 <== Mar 31 03:50:53 TecMint groupadd[156163]: new group: identify=docker, GID=987 Mar 31 04:46:11 TecMint sshd[159403]: Accepted password for root from 192.168.0.162 port 46480 ssh2 Mar 31 04:46:11 TecMint sshd[159403]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
Within the above output, we will see the show header for every file.
8. The way to Disable Show Header in File
Within the earlier instance, we noticed that the command allows the show header whereas working with a number of recordsdata. Nonetheless, we will suppress this default conduct utilizing the -q possibility.
$ tail -q -n 3 /var/log/safe /var/log/secure-20230402 Apr 2 14:29:12 TecMint sshd[201366]: pam_unix(sshd:session): session closed for consumer tecmint Apr 2 15:12:55 TecMint sshd[202049]: Accepted password for root from 192.168.0.162 port 53334 ssh2 Apr 2 15:12:55 TecMint sshd[202049]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0) Mar 31 03:50:53 TecMint groupadd[156163]: new group: identify=docker, GID=987 Mar 31 04:46:11 TecMint sshd[159403]: Accepted password for root from 192.168.0.162 port 46480 ssh2 Mar 31 04:46:11 TecMint sshd[159403]: pam_unix(sshd:session): session opened for consumer root(uid=0) by (uid=0)
Right here, we will see that now the command shows the file contents one after one other with none show header.
9. The way to Watch a File for Modifications
To date we noticed that the tail command exits as soon as it processes the required variety of traces or characters. Nonetheless, typically we wish to view the newly generated logs as properly.
In such circumstances, we will use the -f possibility with the command, which permits us to watch the file for adjustments in a real-time.
To grasp this, first, let’s execute the under command within the first terminal:
$ tail -f /var/log/messages Apr 2 15:13:28 TecMint NetworkManager[741]: [1680462808.8441] coverage: set-hostname: present hostname was modified exterior NetworkManager: 'TecMint' Apr 2 15:13:28 TecMint systemd[1]: Beginning Community Supervisor Script Dispatcher Service... Apr 2 15:13:28 TecMint systemd[1]: Began Community Supervisor Script Dispatcher Service. Apr 2 15:13:37 TecMint arpwatch[11001]: rename arp.dat -> arp.dat-: Operation not permitted Apr 2 15:13:38 TecMint systemd[1]: NetworkManager-dispatcher.service: Deactivated efficiently. Apr 2 15:13:58 TecMint systemd[1]: systemd-hostnamed.service: Deactivated efficiently. Apr 2 15:18:03 TecMint systemd[1]: Beginning dnf makecache... Apr 2 15:18:03 TecMint dnf[202235]: Metadata cache refreshed not too long ago. Apr 2 15:18:03 TecMint systemd[1]: dnf-makecache.service: Deactivated efficiently. Apr 2 15:18:03 TecMint systemd[1]: Completed dnf makecache.
Right here, we will see that the command is ready infinitely after displaying the final ten traces:
Subsequent, let’s open one other terminal and append some textual content to the numbers-2.txt file:
$ echo "View Logs in Actual-Time" >> /var/log/messages
Now, let’s change to the primary terminal to view the newly added textual content:
$ tail -f /var/log/messages Apr 2 15:13:28 TecMint NetworkManager[741]: [1680462808.8441] coverage: set-hostname: present hostname was modified exterior NetworkManager: 'TecMint' Apr 2 15:13:28 TecMint systemd[1]: Beginning Community Supervisor Script Dispatcher Service... Apr 2 15:13:28 TecMint systemd[1]: Began Community Supervisor Script Dispatcher Service. Apr 2 15:13:37 TecMint arpwatch[11001]: rename arp.dat -> arp.dat-: Operation not permitted Apr 2 15:13:38 TecMint systemd[1]: NetworkManager-dispatcher.service: Deactivated efficiently. Apr 2 15:13:58 TecMint systemd[1]: systemd-hostnamed.service: Deactivated efficiently. Apr 2 15:18:03 TecMint systemd[1]: Beginning dnf makecache... Apr 2 15:18:03 TecMint dnf[202235]: Metadata cache refreshed not too long ago. Apr 2 15:18:03 TecMint systemd[1]: dnf-makecache.service: Deactivated efficiently. Apr 2 15:18:03 TecMint systemd[1]: Completed dnf makecache. View Logs in Actual-Time
Right here, we will see that the tail command exhibits the newly added textual content.
Are you aware of another greatest instance of the tail command in Linux? Tell us your views within the feedback under.
If You Respect What We Do Right here On TecMint, You Ought to Contemplate:
TecMint is the quickest rising and most trusted neighborhood web site for any form of Linux Articles, Guides and Books on the internet. Tens of millions of individuals go to TecMint! to look or browse the hundreds of printed articles out there FREELY to all.
If you happen to like what you’re studying, please contemplate shopping for us a espresso ( or 2 ) as a token of appreciation.
We’re grateful to your by no means ending help.
