tail

What it does

tail prints the end of one or more files — by default the last 10 lines. Its most famous use is tail -f, which keeps the file open and prints new lines as they're written, making it the standard way to watch a log file in real time.

Beginner examples

• tail file.txt — print the last 10 lines
• tail -n 20 file.txt — print the last 20 lines
• tail -f app.log — follow the file live, printing new lines as they arrive
• tail -n +1 file.txt — print the entire file starting from line 1 (equivalent to cat)

tail -n 30 /var/log/syslog

Advanced examples

• Follow a log that might get rotated by logrotate, reopening automatically: tail -F app.log
• Watch multiple logs at once, with headers identifying each: tail -f access.log error.log
• Stop following once a specific process exits: tail --pid=$(pgrep myapp) -f app.log
• Print starting from an arbitrary line to the end: tail -n +250 huge_file.txt
• Combine with grep to watch for specific events live: tail -f app.log | grep --line-buffered ERROR

tail -f app.log | grep --line-buffered "ERROR"

Common mistakes

• Using tail -f on a log file managed by logrotate and wondering why updates stop after rotation — -F handles that case, -f doesn't reliably.
• Forgetting the + in tail -n +5, which means "starting at line 5"; tail -n 5 means "the last 5 lines" instead — very different behavior.
• Piping tail -f into another command without --line-buffered (for grep) or equivalent, which can cause output to appear in large delayed chunks instead of live.
• Not stopping a tail -f session left running in an unattended terminal or script, wasting a process indefinitely.

Tips

• Ctrl+C stops tail -f; it doesn't stop on its own since it's designed to run indefinitely.
• Use tail -f file | grep --line-buffered pattern when you want to watch for specific events in a live log without losing real-time output.
• For quickly checking "did anything log after I did X," tail -n 100 file.log right after the action is often faster than starting a live follow session.

Best practices

• Prefer tail -F over -f for long-running log-watching in production, since it survives log rotation without needing to be restarted.
• Combine tail -f with grep --line-buffered (or awk's equivalent) rather than plain grep when filtering live streams, so output isn't buffered and delayed.
• Use --pid=PID when scripting a wait-for-log-line pattern, so the tail process exits cleanly instead of running forever if the target process dies.

Real-world use cases

• Watching an application's log output live while reproducing a bug or deploying a change: tail -f app.log.
• Debugging a service startup by following its log until a "ready" message appears.
• Quickly checking the most recent entries in a crash log after an incident: tail -n 200 /var/log/syslog.

Common interview questions

• How do you watch a log file update in real time? tail -f logfile.log, which keeps the file open and prints new lines as they're appended.
• What's the difference between tail -f and tail -F? -f follows the open file descriptor and can miss updates after log rotation; -F follows the filename and reopens the file if it's rotated or recreated.
• How would you print a file starting at line 100 to the end? tail -n +100 file.txt — note the leading +, which means "from this line onward" rather than "the last N lines."