Daily Linux: A Practical Guide to the tail Command for Efficiently Viewing File End Content

1. Command Introduction and Principles

tail is a command-line tool used to display the end content of files, particularly suitable for viewing log files and real-time monitoring of file changes. Its name comes from “tail,” complementing the head command.

1.1 Working Principle

  1. Reverse reading: Reads content starting from the end of the file, efficiently handling large files

  2. File descriptor tracking: Uses inotify or periodic polling to detect file changes

  3. Real-time monitoring: Keeps the file open through the file descriptor to read new content

  4. Intelligent buffering: Maintains read position information to avoid re-reading the same content

1.2 Core Features

  1. Displays the last 10 lines by default

  2. Supports real-time monitoring of file changes (using the -f option)

  3. Can display by line count or byte count

  4. Supports monitoring multiple files

  5. Efficiently handles log rotation

2. Basic Syntax

tail [options] [file...]

Common Options

  • -n, –lines=[+]NUM Display the last NUM lines (+NUM means display from line NUM)

  • -c, –bytes=[+]NUM Display the last NUM bytes (+NUM means display from byte NUM)

  • -f, –follow[={name|descriptor}] Real-time tracking of file changes (default is descriptor)

  • -F Equivalent to –follow=name –retry

  • –retry Retry when the file is unavailable

  • -q, –quiet, –silent Do not display file name header (when multiple files)

  • -v, –verbose Always display file name header

  • –pid=PID Used with -f, terminates tail after the PID process ends

  • -s, –sleep-interval=N Used with -f, sets the monitoring interval (default is 1.0 seconds)

  • -z, –zero-terminated Use NUL characters as line separators

3. Classic Use Cases

3.1 Viewing the End of a File

# View the last 10 lines of a file (default)tail logfile.log# View the last 20 lines of a filetail -n 20 application.log# View the last 1KB of contenttail -c 1024 data.log

3.2 Real-time Monitoring of Log Files

# Real-time monitoring of system message logs tail -f /var/log/messages# Monitor multiple log filestail -f /var/log/nginx/access.log /var/log/nginx/error.log# Monitoring with intervaltail -f -s 2 app.log  # Check every 2 seconds

3.3 Displaying from a Specific Position

# Display from line 100 to the end of the filetail -n +100 data.txt# Display from 1KB to the end of the filetail -c +1024 large_file.bin

4. Combining with Other Tools

4.1 Combining with head

# View lines 11-20 of a file (first get the first 20 lines, then get the last 10)head -n 20 filename.txt | tail -n 10# View the middle part of a filetail -n +50 large_file.csv | head -n 20

4.2 Combining with grep

# Real-time monitoring and filtering error logstail -f /var/log/app.log | grep -i "error"# View the last occurrence of a specific patterntail -n 1000 logfile.log | grep "exception" | tail -n 10

4.3 Combining with awk/sed

# Extract specific columns and monitor tail -f access.log | awk '{print $1, $7}'# Format outputtail -n 50 data.csv | sed 's/,/ | /g'

4.4 Combining with sort/uniq

# Analyze recently accessed IPstail -n 1000 access.log | awk '{print $1}' | sort | uniq -c | sort -nr# Count error types tail -n 2000 app.log | grep "ERROR" | awk '{print $5}' | sort | uniq -c

5. Advanced Use Cases

5.1 Intelligent Log Monitoring

# Monitor logs and highlight matching patterns tail -f app.log | grep --color=always -E "ERROR|WARNING"# Monitor and save matching content to a file tail -f app.log | tee /dev/tty | grep "CRITICAL" >> critical_errors.log

5.2 Handling Log Rotation

# Use -F option to handle log rotationtail -F /var/log/app.log# Equivalent to tail -f --retry /var/log/app.log

5.3 Process-related Monitoring

# Monitor logs until the related process ends tail -f --pid=$(pgrep -f "myapp") /var/log/myapp.log# Continue monitoring after service restart tail -F --pid=1234 app.log

5.4 Multi-file Aggregated Monitoring

# Monitor the entire log directorytail -f /var/log/*.log# Display the latest log entries sorted by time tail -q -n 1 /var/log/*.log | sort -k4

6. Common Errors and Avoidance Strategies

Error 1: Insufficient Permissions

# When permissions are insufficientsudo tail /var/log/secure.log

Error 2: Real-time Monitoring Interrupted

# Monitoring is interrupted when the log file is moved or deleted tail -f /var/log/app.log  # If app.log is rotated, monitoring stops# Solution: Use -F optiontail -F /var/log/app.log  # Will automatically reopen the file

Error 3: Binary File Display Issues

# Binary files display garbled in the terminaltail binary_file# Solution: Use appropriate tools tail -c 100 binary_file | hexdump -C# Or use file command to check typefile binary_file

Error 4: Performance Issues with -f

# Monitoring too fast generates high IOtail -f high_volume_log.log# Solution: Increase monitoring intervaltail -f -s 5 high_volume_log.log  # 5 seconds interval# Or use buffering tail -f high_volume_log.log | buffer

Error 5: Pipeline Data Processing

# Buffering issues in pipelines tail -f logfile.log | grep "pattern"  # May have delays# Solution: Use unbuffered mode tail -f logfile.log | stdbuf -o0 grep "pattern"# Or use awk tail -f logfile.log | awk '/pattern/ {print}'

7. Practical Tips and Examples

7.1 System Administration Tasks

# Real-time monitoring of system logs sudo tail -f /var/log/messages# Monitor authentication logs sudo tail -f /var/log/secure# View recent system startup information sudo tail -n 50 /var/log/boot.log-20251015

7.2 Service Monitoring and Debugging

# Monitor web server access logs tail -f /var/log/nginx/access.log# Monitor database logs tail -f /var/log/mysql/error.log# Monitor application performance tail -f app.log | grep "response_time"

7.3 Development Debugging

# Monitor application debug output tail -f /tmp/debug.log# View recent exceptions tail -n 100 app.log | grep -A5 -B5 "Exception"# Monitor API calls tail -f api.log | jq '.'  # If logs are in JSON format

7.4 Data Analysis and Reporting

# Generate recent error reports tail -n 1000 app.log | grep "ERROR" | awk -F']' '{print $2}' | sort | uniq -c# Monitor real-time metrics tail -f metrics.log | awk '{sum+=$3; count++} END {print "Average:", sum/count}'# Extract logs for a specific time period tail -n 10000 access.log | awk '$4" "$5 >= "[15/Jan/2024:10:00:00" && $4" "$5 < "[15/Jan/2024:11:00:00"'

8. Advanced Usage Examples

# Complex monitoring pipeline tail -F /var/log/cluster/*.log | 
 grep -v "heartbeat" | 
 awk '/ERROR/ {print strftime("%Y-%m-%d %H:%M:%S"), $0}' | 
 tee -a error_monitor.log
# Monitoring with alerts tail -f app.log | while read line; do if echo "$line" | grep -q "CRITICAL"; then echo "ALERT: $line" | mail -s "Application Critical Error" [email protected]; fi; done

9. Conclusion

Core Advantages

  • Real-time monitoring capability: Powerful -f and -F options support real-time log monitoring

  • Efficient performance: Excellent performance when reverse reading large files

  • Flexible output control: Supports various output methods such as line count and byte count

  • Robust error handling: –retry option handles file unavailability

Applicable Scenarios

  • Real-time log monitoring and analysis

  • System and service debugging

  • Troubleshooting and problem diagnosis

  • Data stream monitoring and processing

  • Automated monitoring scripts

Best Practice Recommendations

  • Always use -F instead of -f: More reliable for handling log rotation

  • Clearly specify range: Use -n or -c to specify exact line or byte counts

  • Set reasonable monitoring intervals: Use -s to reduce IO pressure for high-traffic logs

  • Combine with filtering tools: Achieve intelligent monitoring with grep, awk, etc.

  • Use -q when handling multiple files: Reduce unnecessary file name output

By mastering the tail command, you can establish an efficient log monitoring and analysis workflow, especially in modern distributed systems and microservices architectures, where real-time log monitoring becomes particularly important.

#Linux commands #tail command #log monitoring command #data analysis command

[If there are any omissions, please correct them!]

Related posts

  1. Comprehensive Guide to Linux Commands from A to Z – 2023 Edition
  2. Common Linux Commands: ln, cp, rm, find
  3. Creating a Windows Bootable USB Drive in a Linux Environment
  4. Comprehensive Driver for W25QXX Suitable for General MCUs and Linux Systems
  5. Linux File Permissions: Can You Understand These ‘Hidden Risks’?
  6. Kernel Update Brief: What Changes Does Linux 6.17 Bring?
  7. A Comprehensive Guide to Linux Inodes
  8. Some People Deserve to Be in the Spotlight
  9. Douyin Command Tutorial: Learn How to Open Douyin Commands in 1 Minute
  10. How to Open Douyin Commands: A Method to Access Any Douyin Command and Douyin Lite Command
  11. 40 Animated Images! Understand 3D Printing Principles in Seconds!
  12. Patent Drafting: A Single Word Difference Leads to a 510,000 Yuan Compensation Demand Withdrawn in 12 Days
  13. Understanding High Memory Usage in Linux Systems
  14. Linux TCP/IP Tuning Practices: Boosting Network Performance by Over 200%
  15. Essential for Python Data Analysis: Practical Guide to the Pandas Library and Authoritative Textbooks
  16. Introduction to Linux and Basic Commands
  17. Do You Need to Memorize Linux Commands?
  18. Quick Reference Guide to Common Linux Commands
  19. Daily Linux Command: Ifconfig

Leave a Comment