Readers like you help support How-To Geek. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.

Quick Links

Key Takeaways

  • The tail command in Linux displays data from the end of a file, making it useful for monitoring log files and showing recent additions.
  • The introduction of systemd in some Linux distributions changed the format of system log files to a binary format, but many application-generated log files still use plain text format.
  • In addition to displaying updates in real-time, tail can also be used to display a specific number of lines, work with multiple files, display lines from the start of a file, use byte offsets, and be combined with other commands through piping.

The Linux tail command displays data from the end of a file. It can even display updates that are added to a file in real-time. We show you how to use it.

Did systemd Kill tail?

The tail command shows you data from the end of a file. Usually, new data is added to the end of a file, so the tail command is a quick and easy way to see the most recent additions to a file. It can also monitor a file and display each new text entry to that file as they occur. This makes it a great tool to monitor log files.

Many modern Linux distributions have adopted the systemd system and service manager. This is the first process executed, it has process ID 1, and it is the parent of all other processes. This role used to be handled by the older init system.

Along with this change came a new format for system log files. No longer created in plain text, under systemd they are recorded in a binary format. To read these log files, you must use the journactl utility. The tail command works with plain text formats. It does not read binary files. So does this mean the tail command is a solution in search of a problem? Does it still have anything to offer?

There's more to the tail command than showing updates in real-time. And for that matter, there are still plenty of log files that are not system generated and are still created as plain text files. For example, log files generated by applications haven't changed their format.

Using tail on Linux

Pass the name of a file to tail and it will show you the last ten lines from that file. The example files we're using contain lists of sorted words. Each line is numbered, so it should be easy to follow the examples and see what effect the various options have.

tail word-list.txt

tail word-list.txt in a terminal window

To see a different number of lines, use the -n (number of lines) option:

tail -n 15 word-list.txt

tail -n 15 word-list.txt in a terminal window

Actually, you can dispense with the "-n", and just use a hyphen "-" and the number. Make sure there are no spaces between them. Technically, this is an obsolete command form, but it is still in the man page, and it still works.

tail -12 word-list.txt

tail -12 word-list.txt in a terminal window

Using tail With Multiple Files

You can have tail work with multiple files at once. Just pass the filenames on the command line:

tail -n 4 list-1.txt list-2.txt list-3.txt

tail -n 4 list-1.txt list-2.txt list-3.txt in a terminal window

A small header is shown for each file so that you know which file the lines belong to.

Displaying Lines from the Start of a FIle

The + (count from the start) modifier makes tail display lines from the start of a file, beginning at a specific line number. If your file is very long and you pick a line close to the start of the file, you're going to get a lot of output sent to the terminal window. If that's the case, it makes sense to pipe the output from tail into less.

tail +440 list-1.txt

tail +44 list-1.txt in a terminal window

You can page through the text in a controlled fashion.

Output from tail displayed in less in a terminal window

Because there happen to be 20,445 lines in this file, this command is the equivalent of using the "-6" option:

tail +20440 list-1.txt

tail +20440 list-1.txt in a terminal window

Using Bytes With tail

You can tell tail to use offsets in bytes instead of lines by using the -c (bytes) option. This could be useful if you have a file of text that was formatted into regular-sized records. Note that a newline character counts as one byte. This command will display the last 93 bytes in the file:

tail -c 93 list-2.txt

tail -c 93 list-2.txt in a terminal window

You can combine the -c (bytes) option with the + (count from the start of the file) modifier, and specify an offset in bytes counted from the start of the file:

tail -c +351053 list-e.txt

tail -c +351053 list-e.txt in a terminal window

Piping Into tail

Earlier, we piped the output from tail into less . We can also pipe the output from other commands into tail.

To identify the five files or folders with the oldest modification times, use the -t (sort by modification time) option with ls , and pipe the output into tail.

ls -tl | tail -5

ls -lt | tail -5 in a terminal window

The head command lists lines of text from the start of a file. We can combine this with tail to extract a section of the file. Here, we're using the head command to extract the first 200 lines from a file. This is being piped into tail, which is extracting the last ten lines. This gives us lines 191 through to line 200. That is, the last ten lines of the first 200 lines:

head -n 200 list-1.txt | tail -10

head -n 200 list-1.txt | tail -10 in a terminal window

This command lists the five most memory-hungry processes.

ps aux | sort -nk +4 | tail -5

ps aux | sort -nk +4 | tail -5 in a terminal window

Let's break that down.

The ps command displays information about running processes. The options used are:

  • a: List all processes, not just for the current user.
  • u: Display a user-oriented output.
  • x: List all processes, including those not running inside a TTY.

The sort command sorts the output from ps . The options we're using with sort are:

  • n: Sort numerically.
  • k +4: Sort on the fourth column.

The tail -5 command displays the last five processes from the sorted output. These are the five most memory-hungry processes.

Using tail to Track Files in Real-Time

Tracking new text entries arriving in a file — usually a log file — is easy with tail. Pass the filename on the command line and use the -f (follow) option.

tail -f geek-1.log

tail -f geek-1.log in a terminal window

As each new log entry is added to the log file, tail updates its display in the terminal window.

Output from tail -f geek-1.log in a terminal window

You can refine the output to include only lines of particular relevance or interest. Here, we're using grep to only show lines that include the word "average":

tail -f geek-1.log | grep average

tail -f geek-1.log | grep average in a terminal window

To follow the changes to two or more files, pass the filenames on the command line:

tail -f -n 5 geek-1.log geek-2.log

tail -f -n 5 geek-1.log geek-2.log in a terminal window

Each entry is tagged with a header that shows which file the text came from.

Output from tail -f -n 5 geek-1.log geek-2.log 

The display is updated each time a new entry arrives in a followed file. To specify the update period, use the -s (sleep period) option. This tells tail to wait a number of seconds, five in this example, between file checks.

tail -f -s 5 geek-1.log

tail -f -s 5 geek-1.log in a terminal window

Admittedly, you can't tell by looking at a screenshot, but the updates to the file are happening once every two seconds. The new file entries are being displayed in the terminal window once every five seconds.

Output from tail -f -s 5 geek-1.log

When you are following the text additions to more than one file, you can suppress the headers that indicate which log file the text comes from. Use the -q (quiet) option to do this:

tail -f -q geek-1.log geek-2.log

tail -f -q geek-1.log geek-2.log in a terminal window

The output from the files is displayed in a seamless blend of text. There is no indication which log file each entry came from.

Output from tail -f -q geek-1.log geek-2.log in a terminal window

tail Still Has Value

Although access to the system log files is now provided by journalctl, tail still has plenty to offer. This is especially true when it is used in conjunction with other commands, by piping into or out of tail.

systemd might have changed the landscape, but there's still a place for traditional utilities that conform to the Unix philosophy of doing one thing and doing it well.

Linux Commands

Files

tar · pv · cat · tac · chmod · grep · diff · sed · ar · man · pushd · popd · fsck · testdisk · seq · fd · pandoc · cd · $PATH · awk · join · jq · fold · uniq · journalctl · tail · stat · ls · fstab · echo · less · chgrp · chown · rev · look · strings · type · rename · zip · unzip · mount · umount · install · fdisk · mkfs · rm · rmdir · rsync · df · gpg · vi · nano · mkdir · du · ln · patch · convert · rclone · shred · srm · scp · gzip · chattr · cut · find · umask · wc · tr

Processes

alias · screen · top · nice · renice · progress · strace · systemd · tmux · chsh · history · at · batch · free · which · dmesg · chfn · usermod · ps · chroot · xargs · tty · pinky · lsof · vmstat · timeout · wall · yes · kill · sleep · sudo · su · time · groupadd · usermod · groups · lshw · shutdown · reboot · halt · poweroff · passwd · lscpu · crontab · date · bg · fg · pidof · nohup · pmap

Networking

netstat · ping · traceroute · ip · ss · whois · fail2ban · bmon · dig · finger · nmap · ftp · curl · wget · who · whoami · w · iptables · ssh-keygen · ufw · arping · firewalld