tail Command Cheatsheet
The tail command outputs the last part of files. It is an essential tool for viewing and monitoring logs in real time. By default, it displays the last 10 lines of a file.
Common Usage
| Command | Description |
|---|---|
tail [FILE] | Displays the last 10 lines of the specified file. |
tail -n [NUMBER] [FILE] | Displays the last `[NUMBER]` of lines of a file. For example, `tail -n 50 /var/log/syslog` shows the last 50 lines. |
tail -f [FILE] | **Follow mode.** Continuously displays new lines as they are appended to the file. This is extremely useful for monitoring log files in real time. You can exit with `Ctrl+C`. |
tail -q [FILE1] [FILE2] | With multiple files, the `-q` flag suppresses the printing of filenames before each output. |
Using `tail` in a Pipeline
`tail` is often used with pipes (`|`) to monitor a file and then process the output with another command.
# Monitor a log file and filter for the word "ERROR"
tail -f /var/log/nginx/error.log | grep --line-buffered "ERROR"The `--line-buffered` option for `grep` is crucial here. It forces `grep` to output each line as soon as it's processed, which is necessary for real-time monitoring with `tail -f`.