tail Command
Beginner Text Processing man(1)Output the last part of files
👁 10 views
📅 Updated: Mar 15, 2026
SYNTAX
tail [OPTION]... [FILE]...
What Does tail Do?
The tail command outputs the last part of files. By default, it prints the last 10 lines. Its most important feature is the -f (follow) mode, which continuously monitors a file for new content — making it indispensable for real-time log monitoring.
tail is a critical tool for system administrators and developers who need to watch log files in real-time, check recent entries, and monitor application output. The -f flag keeps the file open and displays new lines as they are appended.
tail supports outputting a specific number of lines or bytes, starting from a specific line number, and following multiple files simultaneously. It handles log rotation gracefully with the -F flag.
tail is a critical tool for system administrators and developers who need to watch log files in real-time, check recent entries, and monitor application output. The -f flag keeps the file open and displays new lines as they are appended.
tail supports outputting a specific number of lines or bytes, starting from a specific line number, and following multiple files simultaneously. It handles log rotation gracefully with the -F flag.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -n | Output the last N lines (default 10) | tail -n 50 access.log |
| -f | Follow — output appended data as the file grows | tail -f /var/log/syslog |
| -F | Follow with retry (handles log rotation) | tail -F /var/log/nginx/error.log |
| -c | Output the last N bytes | tail -c 1024 error.log |
| -n +N | Output starting from line N | tail -n +2 data.csv |
| -q | Quiet mode — suppress headers when following multiple files | tail -q -f *.log |
| --pid | Terminate tail after process with PID exits | tail -f log.txt --pid=1234 |
Practical Examples
#1 View last 10 lines
Shows the last 10 lines of the authentication log.
$ tail /var/log/auth.log#2 Monitor a log file in real-time
Continuously shows new lines as they are written. Press Ctrl+C to stop.
$ tail -f /var/log/nginx/access.log#3 Follow with log rotation support
Like -f but re-opens the file if it is rotated or recreated. Essential for production servers.
$ tail -F /var/log/syslog#4 Skip CSV header
Outputs everything starting from line 2, effectively removing the header row.
$ tail -n +2 data.csv#5 View last N lines
Shows the last 100 lines of the error log.
$ tail -n 100 error.log#6 Follow multiple files
Monitors multiple log files simultaneously with headers showing which file each line comes from.
$ tail -f /var/log/nginx/*.log
Output:
==> access.log <==
192.168.1.1 - GET /api
==> error.log <==
[error] upstream timeout
#7 Filter real-time logs
Follows the log and filters for error messages in real-time.
$ tail -f /var/log/syslog | grep --line-buffered "error"Tips & Best Practices
Use -F in production: Always use -F instead of -f in production environments where log rotation (logrotate) is active. -F re-opens the file if it is rotated.
multitail for advanced monitoring: For monitoring multiple logs with colors and filtering, consider multitail — it provides a split-screen view of multiple log files.
Buffer flushing with pipes: When piping tail -f through grep, add --line-buffered to grep to prevent output buffering delays.
Frequently Asked Questions
How do I watch a log file in real-time?
Use tail -f /path/to/logfile. For log rotation support, use tail -F. Press Ctrl+C to stop watching.
How do I view the last N lines of a file?
Use tail -n N filename. For example: tail -n 100 /var/log/syslog shows the last 100 lines.
How do I skip the first line (header) of a CSV?
Use tail -n +2 file.csv to output from line 2 onward. This is commonly used to strip CSV headers before processing.
Related Commands
More Text Processing Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →