Chapter 24: Bash View End (tail)
What does tail actually do? (super simple first)
tail = shows the last part of a file (or from pipe/input).
By default:
- Shows the last 10 lines of a file
- Very fast – doesn’t read the whole file, just jumps to the end
Think of it as the opposite of head (which shows the beginning).
Most common real uses:
- See the latest logs without opening huge files
- Watch a log file live as new lines are added (-f)
- Check the last error in a long log
- Get the last few lines of a report/script output
1. Basic usage (try these now!)
First, let’s create a test file with many lines:
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
cat > server.log << 'EOF' 2026-02-25 14:30:01 INFO Starting server 2026-02-25 14:30:02 INFO Loading config 2026-02-25 14:30:05 DEBUG Connecting to DB 2026-02-25 14:30:10 WARNING Slow query detected 2026-02-25 14:30:15 ERROR Failed to authenticate user arman 2026-02-25 14:30:20 INFO User arman logged in from Hyderabad 2026-02-25 14:30:25 INFO Serving request /api/users 2026-02-25 14:30:30 DEBUG Cache hit 2026-02-25 14:30:35 INFO Response sent 200 OK 2026-02-25 14:30:40 ERROR Database timeout 2026-02-25 14:30:45 WARNING High memory usage 2026-02-25 14:30:50 INFO Server still running EOF |
Now basic commands:
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# Show last 10 lines (default) tail server.log # Show only last 5 lines tail -n 5 server.log # or tail -5 server.log # short way # Show last 3 lines tail -n 3 server.log |
2. The MOST used option → -f (follow / live tail)
This is why sysadmins love tail:
Bash
|
0 1 2 3 4 5 6 |
tail -f server.log |
- Shows last 10 lines immediately
- Then waits and prints new lines in real-time as they are added
- Like watching live CCTV of your log file
- Press Ctrl+C to stop
Real example you see every day:
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 |
# Watch nginx access log live tail -f /var/log/nginx/access.log # Watch errors only (combine with grep) tail -f /var/log/syslog | grep -i error # Watch your script output while developing python myscript.py | tail -f |
3. Very common options (you’ll use these 95% of time)
| Option | What it does | Example command | Real use case |
|---|---|---|---|
| -n N or -N | Show last N lines | tail -n 20 error.log | Last 20 errors |
| -f | Follow – keep showing new lines | tail -f app.log | Live monitoring |
| -q | Quiet – no header when multiple files | tail -q -n 5 *.log | Clean multi-file output |
| -v | Verbose – show filename header | tail -v -n 3 *.txt | When checking many files |
| +N | Start from line N to end | tail -n +50 bigfile.txt | Skip first 49 lines |
| -c N | Show last N characters/bytes | tail -c 100 short.txt | Last part of small file |
| –pid=PID | Stop when process PID dies (with -f) | tail -f –pid=$$ log.txt | Smart scripts |
4. Real-world examples you will use daily
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
# See last login attempt (auth log) tail -n 10 /var/log/auth.log # Last 50 lines of kernel messages dmesg | tail -n 50 # Last error in journalctl (systemd logs) journalctl -u nginx.service -n 20 # Last 3 backup files created ls -lt backup_* | tail -n 3 # Live tail + only show errors (very common combo) tail -f /var/log/app.log | grep --color=auto -i -E "error|fail|exception" # Get last field of last line (e.g. last IP in access log) tail -1 access.log | awk '{print $1}' # Tail multiple files at once tail -n 5 report1.txt report2.txt report3.txt # or with quiet tail -q -n 5 *.csv |
5. Combining tail with other commands (power moves)
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# Last 10 modified files ls -lt | head -n 11 | tail -n 10 # skip the "total" line # Last 5 unique IPs from log tail -n 1000 access.log | awk '{print $1}' | sort | uniq | tail -n 5 # Watch temperature / sensor live (if you have sensors) watch -n 2 "sensors | tail -n 5" # Get last line only (very common) tail -1 status.txt |
6. Quick cheat-sheet table
| Goal | Command example | Notes |
|---|---|---|
| Last 10 lines (default) | tail filename.log | Everyday use |
| Last N lines | tail -n 50 error.log or tail -50 error.log | Most common |
| Live monitoring | tail -f /var/log/nginx/access.log | Watch live |
| Last N characters | tail -c 200 short.txt | Small files |
| Skip first lines (start from N) | tail -n +100 bigfile.txt | Skip header |
| Only last line | tail -1 file.txt | Quick last status |
| Multiple files quiet | tail -q -n 5 *.log | No headers |
| Stop follow when process dies | tail -f –pid=$(pgrep myapp) app.log | Smart scripts |
| Tail + grep live errors | tail -f log.txt |
grep -i error |
7. Pro tips from daily use
- tail -f is your best friend when debugging servers/apps
- Use tail -f | grep instead of opening huge logs in editor
- tail -n +1 = show whole file (but useless – use cat)
- For very huge files (GBs) – tail is instant (doesn’t read beginning)
- In scripts: tail -n 1 to get exit code/message from last command
- Press Ctrl+C to stop -f, or *Ctrl+* (SIGQUIT) if stuck
Now open your terminal and try these 3 right now:
Bash
|
0 1 2 3 4 5 6 7 8 |
tail -n 5 server.log tail -f server.log # add a new line in another terminal: echo "New error" >> server.log tail -n +8 server.log # start from line 8 |
Tell me what you see! Or ask:
- “How to tail last 100 lines and stop after 30 seconds?”
- “Best way to tail multiple services at once?”
- “tail vs less – when to use which for logs?”
We’ll build exact commands together! 😄
