Tail (Unix)
Encyclopedia
tail is a program
on Unix
and Unix-like
systems used to display the last few lines of a text file
or piped data.
is:
tail [options]
By default, tail will print the last 10 lines of its input to the standard output. With command line options the number of lines printed and the printing units (lines, blocks or bytes) may be changed. The following example shows the last 20 lines of filename:
tail -n 20 filename
This example shows the last 15 bytes of all files starting with foo:
tail -c 15 foo*
This example shows all lines of filename from the second line onwards:
tail -n +2 filename
Using an older syntax (still used in older version of Sun Solaris as the -n option is not supported), the last 20 lines and the last 50 bytes of filename can be shown with the following command:
tail -20 filename
tail -50c filename
However this syntax is now obsolete and does not conform with the POSIX 1003.1-2001 standard. Even if still supported in current versions, when used with other options (like -f, see below), these switches could not work at all.
, tail updates the display. This is particularly useful for monitoring log files. The following command will display the last 10 lines of messages and append new lines to the display as new lines are added to messages:
tail -f /var/adm/messages
In cases when the user is following a log file that rotates then it is advisable to use the -F option as it keeps following the log even when it is recreated, renamed, or removed as part of log rotation.
tail -F /var/adm/messages
To interrupt tail while it is monitoring, break-in with Ctrl+C. This command can be run "in the background" with &, see job control.
If you have a command's result to monitor, you can use the watch
command.
Computer program
A computer program is a sequence of instructions written to perform a specified task with a computer. A computer requires programs to function, typically executing the program's instructions in a central processor. The program has an executable form that the computer can use directly to execute...
on Unix
Unix
Unix is a multitasking, multi-user computer operating system originally developed in 1969 by a group of AT&T employees at Bell Labs, including Ken Thompson, Dennis Ritchie, Brian Kernighan, Douglas McIlroy, and Joe Ossanna...
and Unix-like
Unix-like
A Unix-like operating system is one that behaves in a manner similar to a Unix system, while not necessarily conforming to or being certified to any version of the Single UNIX Specification....
systems used to display the last few lines of a text file
Computer file
A computer file is a block of arbitrary information, or resource for storing information, which is available to a computer program and is usually based on some kind of durable storage. A file is durable in the sense that it remains available for programs to use after the current program has finished...
or piped data.
Syntax
The command-syntaxSyntax
In linguistics, syntax is the study of the principles and rules for constructing phrases and sentences in natural languages....
is:
tail [options]
By default, tail will print the last 10 lines of its input to the standard output. With command line options the number of lines printed and the printing units (lines, blocks or bytes) may be changed. The following example shows the last 20 lines of filename:
tail -n 20 filename
This example shows the last 15 bytes of all files starting with foo:
tail -c 15 foo*
This example shows all lines of filename from the second line onwards:
tail -n +2 filename
Using an older syntax (still used in older version of Sun Solaris as the -n option is not supported), the last 20 lines and the last 50 bytes of filename can be shown with the following command:
tail -20 filename
tail -50c filename
However this syntax is now obsolete and does not conform with the POSIX 1003.1-2001 standard. Even if still supported in current versions, when used with other options (like -f, see below), these switches could not work at all.
File monitoring
tail has a special command line option -f (follow) that allows a file to be monitored. Instead of just displaying the last few lines and exiting, tail displays the lines and then monitors the file. As new lines are added to the file by another processProcess (computing)
In computing, a process is an instance of a computer program that is being executed. It contains the program code and its current activity. Depending on the operating system , a process may be made up of multiple threads of execution that execute instructions concurrently.A computer program is a...
, tail updates the display. This is particularly useful for monitoring log files. The following command will display the last 10 lines of messages and append new lines to the display as new lines are added to messages:
tail -f /var/adm/messages
In cases when the user is following a log file that rotates then it is advisable to use the -F option as it keeps following the log even when it is recreated, renamed, or removed as part of log rotation.
tail -F /var/adm/messages
To interrupt tail while it is monitoring, break-in with Ctrl+C. This command can be run "in the background" with &, see job control.
If you have a command's result to monitor, you can use the watch
Watch (Unix)
watch is a GNU command-line tool that runs the specified command repeatedly and displays the output on stdout so you can watch it change over time. By default, the command is run every 2 seconds, although this is adjustable with the -n secs argument...
command.
Variants
- CCZE is tail-like while displaying its output in color
- pctail Like CCZE: Python Colorized TAIL, a colorized tail made in python which tails and colorizes syslog output.
- root-tail displays the output in the X-server root window
- Inotail: the regular tail polls every second to see if new data can be displayed. Inotail uses the LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
kernel's inotifyInotifyinotify is a Linux kernel subsystem that acts to extend filesystems to notice changes to the filesystem, and report those changes to applications. It replaces an earlier facility, dnotify, which had similar goals....
-interface so that it only checks for new data when there really is some. - MultiTailMultitailMultiTail is a program for monitoring multiple log files, in the fashion of the original tail program. The original tail presents the last few lines of a single log file, optionally providing a real-time display of the growing file....
not only displays logfiles in colors, it can also merge, filter, scrollback and split a terminal window in subwindows. It is more or less a combination of tail, sedSedsed is a Unix utility that parses text and implements a programming language which can apply transformations to such text. It reads input line by line , applying the operation which has been specified via the command line , and then outputs the line. It was developed from 1973 to 1974 as a Unix...
, watchWatch (Unix)watch is a GNU command-line tool that runs the specified command repeatedly and displays the output on stdout so you can watch it change over time. By default, the command is run every 2 seconds, although this is adjustable with the -n secs argument...
, CCZE/pctail, grepGrepgrep is a command-line text-search utility originally written for Unix. The name comes from the ed command g/re/p...
, diffDiffIn computing, diff is a file comparison utility that outputs the differences between two files. It is typically used to show the changes between one version of a file and a former version of the same file. Diff displays the changes made per line for text files. Modern implementations also...
, Beeper and others.