How to Use the tail Command on Linux

Use the tail [phone] Command on Linux

The Linux tail command displays data from the end of a file. It can even show updates being added to a file in real time. We show you how to use it.

Did Systemd kill Tail?

The tail command shows you data from the end of a file. New data is usually added to the end of a file, so the tail command is a quick and easy way to see the most recent additions to a file. You can also monitor a file and display each new text entry in that file as they occur. This makes it a great tool for monitoring log files.

Many modern Linux distributions have adopted the systemd systems and services manager. This is the first process executed, has process ID 1, and is the parent of all other processes. This function used to be handled by the previous init system.

Along with this change came a new format for system log files. They are no longer created in plain text, in systemd they are recorded in binary format. To read these log files, you must use the journactl utility. The tail command works with plain text formats. Does not read binary files. So does this mean that the tail command is a solution in search of a problem? Do you still have something to offer?

The tail command is more than just showing real-time updates. And in fact, there are still many log files that are not generated by the system and are still created as plain text files. For example, log files generated by applications have not changed their format.

Using queue in Linux

Pass a file name to tail and it will show you the last ten lines of that file. The example files we are using contain ordered lists of words. Each line is numbered, so it should be easy to follow the examples and see what effect different options have.

To view a different number of lines, use the -n (number of lines) option:
You can actually do without the “-n” and just use a hyphen “-” and the number. Make sure there are no spaces between them. Technically this is a deprecated command form, but it’s still on the man page and still works.

Using tail with multiple files

You can have the queue work with multiple files at once. Simply pass the file names on the command line:
A small header is displayed for each file so you know which file the lines belong to.

Show lines from the beginning of a file

The + (count from start) modifier causes tail lines to be displayed from the start of a file, starting at a specific line number. If your file is very long and you choose a line near the beginning of the file, you will receive a large number of results sent to the terminal window. If that’s the case, it makes sense to pipe the queue output to less.

You can skim the text in a controlled manner.

Because there are 20,445 lines in this file, this command is equivalent to using the “-6” option:

Using tailed bytes

You can tell tail to use offsets in bytes instead of lines using the -c (bytes) option. This might be useful if you have a text file formatted in normal-sized records. Note that one newline character counts as one byte. This command will display the last 93 bytes of the file:

You can combine the -c (bytes) option with the + (count from start of file) switch and specify an offset in bytes counted from the start of the file:

Pipe to tail

Previously, we piped the output of tail to less . We can also pipe the output of other commands to tail.

To identify the five files or folders with the oldest modification times, use the -t (sort by modification time) option with ls and pipe the output to tail.

The head command lists lines of text from the beginning of a file. We can combine this with tail to extract a section of the file. Here, we use the head command to extract the first 200 lines of a file. This is piped to tail, which extracts the last ten lines. This gives us lines 191 to line 200. That is, the last ten lines of the first 200 lines:

This command lists the five processes that consume the most memory.

Let’s analyze that.

• The ps command displays information about running processes. The options used are:
• a: List all processes, not just those of the current user.
• u: Displays user-facing output.
• x — Lists all processes, including those not running within a TTY.
• The sort command sorts the output of ps . The options we are using with sort are:
• n: Sort numerically.
• k +4: Sort in the fourth column.
• The tail -5 command displays the last five processes in the sorted output. These are the five processes that consume the most memory.

Using tail to track files in real time

Tracking new text entries that arrive in a file (usually a log file) is easy with tail. Pass the file name on the command line and use the -f (follow) option.

As each new log entry is added to the log file, tail updates its display in the terminal window.
You can refine the result to include only lines of particular relevance or interest. Here, we use grep to display only lines that include the word “average”:

• To track changes to two or more files, pass the file names on the command line:
• Each entry is tagged with a header that shows which file the text comes from.
• The screen updates every time a new entry arrives in a tracked file. To specify the update period, use the -s (sleep period) option. This tells tail to wait a few seconds, five in this example, between file checks.
• Admittedly, you can’t tell by looking at a screenshot, but file updates happen once every two seconds. New file entries are displayed in the terminal window once every five seconds.
• When you track text additions to more than one file, you can suppress the headers that indicate which log file the text comes from. Use the -q (silence) option to do this:
• The result of the files is displayed in a perfect combination of text. There is no indication which log file each entry comes from.

The tail still has value

Although access to system log files is now provided by journalctl, tail still has a lot to offer. This is especially true when used in conjunction with other commands, piping in or out of the queue.

Systemd may have changed the landscape, but there is still a place for traditional utilities that fit the Unix philosophy of doing one thing and doing it well.

Source Url:
https://medium.com/@rc9338288/how-to-use-the-tail-command-on-linux-1547f9a4193f