‘GNU tail’ is a small utility which prints (by default) the last 10 lines of any file. This an amazing piece of software not only allows you to see the last part of a file but also enables you to monitor a file’s changes without opening the file.
‘tail’ can be used alone or can be combined with other commands like ‘grep’, ‘ls’ etc.
To use ‘tail’, let’s first create a text file. You can create the file by issuing following command in terminal;
touch my_file
Now open my_file with your favorite text editor (nano in my case) and write some lines. For this article, I have written the following 15 lines;
this is the 1st line this is the 2nd line this is the 3rd line this is the 4th line this is the 5th line this is the 6th line this is the 7th line this is the 8th line this is the 9th line this is the 10th line this is the 11th line this is the 12th line this is the 13th line this is the 14th line this is the 15th line
Now issue the following command in terminal;
tail my_file
It will print the last 10 lines which would be the “this is the 6th line” through “this is the 15th line”.
You can control the number of lines which ‘tail’ will print. You can either increase or decrease the number of lines. For example, if you want ‘tail’ to show only last 3 lines, you can do this by issuing the following command;
tail -n 3 my_file
Now it will print only last 3 lines. You can use any number of lines instead of 3. Or you can use a plus sign like;
tail -n+7 my_file
‘tail’ will start printing from 7th line to the end of the file.
You can view the desired file with respect to size. Issue the following command in terminal;
tail -c 14 my_file
And it will show the output of last 14 bytes. In my case, the output was;
the 15th line
‘tail’ not only displays the static output of a file but it can also monitor the file for changes. A ‘-f’ option is used with ‘tail’ and it starts acting like a monitoring tool which not only displays the last few lines but also constantly updates the output as the file changes. Here is a very popular example;
tail -f /var/log/message
‘tail’ will print the last 10 lines of ‘message’ file. If you now plug-in you USB stick, you will notice that the change in ‘message’ file will instantly be reported by ‘tail’. To release the cursor press Ctrl+c.
There are many other useful options which you can use with ‘tail’ like;
tail -q my_file # never output headers
tail -v my_file # always outputs headers
You can combine ‘tail’ with other utilities like ‘ls’, ‘grep’, ‘head’ etc.
You can combine ‘tail’ with ‘grep’ to get lines with some specific ‘word’.
tail -n 5 my_file | grep 14
It will print only those lines out of last 5 which contains the word ’14’. In my case the output was:
this is 14th line # ’14’ will be highlighted
‘tail’ can also be combined with ‘ls’ to get the list of last few files/folders. For example, if you issue the following command;
ls -l | tail -n 2
It will give a long listing of files/folders but will show the last 2 entries of the working directory.
These are just two examples of combining ‘tail’ with other utilities. There are countless examples of combination of ‘tail’ and other softwares.
‘GNU tail’ is a very handy tool. It can output any amount of data depending upon the options used. It makes the work of an ordinary user much easer and helps him/her find information in files more efficiently. To become an expert in Linux, this is a mandatory utility over which a user must have complete mastery. Hopefully, this tutorial gets you started chasing your tail!
tail -f is imho one of the best “low level” debugging tools available.
I use it a lot on logfiles and stuff like that.
Yes, I use tail to watch log files too, but to use it properly, one should use “tail –follow=name” – so that when log rotation occurs, tail won’t be “stuck” with old “dead”/non-updated file, but with new one after rotation (by default, tail follows by descriptor).
It’s best used with ccze (or other log colorizer) – that makes spotting warning/errors a snap (by color).
Agreed