tail Cheatsheet
Basic Syntax
Core tail command forms.
| Command | Description |
|---|---|
tail FILE |
Show the last 10 lines of a file |
tail -n 20 FILE |
Show the last 20 lines |
tail -f FILE |
Follow a file as new lines are appended |
tail -c 200 FILE |
Show the last 200 bytes |
command | tail |
Show the end of piped output |
Show the Last Lines
Common line-based usage patterns.
| Command | Description |
|---|---|
tail /var/log/syslog |
Show the last 10 lines of a system log |
tail -n 50 /var/log/nginx/access.log |
Show the last 50 log lines |
tail -5 file.txt |
Short form for the last 5 lines |
tail -n 1 file.txt |
Show only the last line |
tail -n +5 file.txt |
Start printing from line 5 |
Follow Logs in Real Time
Monitor changing files without reopening them.
| Command | Description |
|---|---|
tail -f /var/log/auth.log |
Follow a log file live |
tail -n 100 -f app.log |
Show recent lines, then keep following |
tail -F /var/log/nginx/error.log |
Follow by filename and survive log rotation |
sudo tail -f /var/log/secure |
Follow a root-owned log file |
tail -f --pid=1234 app.log |
Stop following when PID 1234 exits |
Bytes and Starting Positions
Switch from lines to byte counts or start offsets.
| Command | Description |
|---|---|
tail -c 500 file.bin |
Show the last 500 bytes |
tail -c 2K file.log |
Show the last 2 KiB |
tail -n +2 file.csv |
Skip the first line, useful for headers |
tail -n +20 file.txt |
Print from line 20 to the end |
tail -c +101 file.txt |
Print starting from byte 101 |
Multiple Files
Inspect or follow more than one file at a time.
| Command | Description |
|---|---|
tail file1.log file2.log |
Show the last 10 lines from each file |
tail -n 20 file1.log file2.log |
Show the last 20 lines from each file |
tail -f /var/log/syslog /var/log/auth.log |
Follow multiple log files live |
tail -q file1 file2 |
Suppress file headers |
tail -v file1 file2 |
Always show file headers |
Pipelines and Combos
Use tail with other text-processing tools.
| Command | Description |
|---|---|
dmesg | tail -n 20 |
Show the most recent kernel messages |
ps aux | sort -nk 3 | tail -5 |
Show processes with the highest CPU usage |
grep ERROR app.log | tail -n 20 |
Show the latest matching error lines |
tail -n +20 file.txt | head -n 11 |
Extract lines 20 through 30 |
journalctl -u nginx | tail -n 50 |
Show the latest service log lines |
Troubleshooting
Quick checks for common tail confusion.
| Issue | Check |
|---|---|
No new output appears with -f |
Confirm the file is still being written to and you are watching the correct path |
| Output stops after log rotation | Use tail -F to follow the filename instead of the old file descriptor |
Permission denied |
Check file ownership and run with the correct user or sudo if needed |
| Need only one field or last value | Combine tail with awk or cut after confirming the file format |
Wrong starting line with +N |
Remember tail -n +N starts printing at line N, not after it |
Related Guides
Use these guides for full logging and text-processing workflows.
| Guide | Description |
|---|---|
| tail Command in Linux | Full tail guide with examples |
| head Command in Linux | Show the first lines of files |
| less Command in Linux | Scroll, search, and follow file output |
| grep Command in Linux | Filter matching log lines |
| linux wc Command | Count lines and bytes in files |
AI Assistant
