Text-Fu · Lesson 9

tail

Learn how to view the end of input and follow files as new content is appended.

The tail command displays the end of a file or input stream. It can also remain active and show data appended to a file, which is useful when observing logs.

Displaying the Last Ten Lines

With no count option, tail prints the last 10 lines of each named file:

$ tail application.log

If the file contains fewer than 10 lines, all available lines are printed. The file itself is not changed.

What does tail application.log display by default?

Choosing a Line or Byte Count

Use -n NUMBER to select a different number of final lines:

$ tail -n 20 application.log

Use -c NUMBER when you need the final bytes instead:

$ tail -c 100 payload.bin

Byte mode can begin in the middle of a text line or encoded character, so line mode is usually clearer for text.

Which command displays the final 20 lines of application.log?

Starting at a Particular Line

A count prefixed with + changes the meaning: tail -n +N starts with line N and prints through the end.

$ tail -n +5 report.txt

This skips the first four lines and begins at line 5. It is useful for removing a known number of header lines from a stream.

Which command prints report.txt starting with line 5?

Following Appended Data

With -f, tail prints the initial ending and remains active, showing data as it is appended:

$ tail -f application.log

Press Ctrl+C to interrupt tail and return to the shell. Following a file only displays new content; it does not guarantee that the application producing the log is healthy or that every relevant event uses that file.

Which command shows the current end of application.log and keeps waiting for appended content?

Following a Rotated Log by Name

Log rotation can rename an old file and create a new file at the original pathname. GNU tail -F is equivalent to following by name while retrying, so it can reopen a file that is replaced or temporarily missing:

$ tail -F application.log

Use -f when following the currently opened file is the desired behavior, and -F when a named log is expected to rotate. These are GNU behaviors; other implementations can differ.

On GNU/Linux, which option is better suited to following application.log across common rename-and-recreate log rotation?

When no file is named, tail reads stdin, so it can select the end of command output. Multiple named files receive identifying headers by default, as with head.

To practice viewing and following file endings, try these hands-on labs:

Linux tail Command: File End Display - Learn the Linux tail command for viewing and monitoring the end of text files, including the -f option for real-time updates.
Viewing Log and Configuration Files in Linux - Practice using tail (along with cat and more) to efficiently view and navigate log and configuration files, which is crucial for system monitoring.
Rapid Threat Detection - Apply your knowledge of tail to quickly extract and analyze recent log entries, simulating rapid threat detection in a cybersecurity context.

Lesson complete

You finished tail

You can now inspect file endings and observe newly appended content with tail.

Display the final ten lines by default.
Select a line or byte count explicitly.
Start output at a numbered line with -n +N.
Follow appended content with -f and stop with Ctrl+C.
Use GNU -F when a named log may be rotated.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Next Lesson

Back to Text-Fu