tail Command Cheat Sheet

tail displays the last part of a file. It is the go-to tool for monitoring log files in real-time.

Synopsis

tail [OPTION]... [FILE]...

Basic Usage

Last 10 Lines (Default)

tail /var/log/syslog

Last N Lines (-n)

tail -n 50 /var/log/syslog

Last N Bytes (-c)

tail -c 100 /var/log/syslog

Real-Time Monitoring (-f)

Follow the file as it grows (append-only).

tail -f /var/log/nginx/access.log

Follow by Filename (--retry)

If the file might be rotated (deleted and recreated) while you are watching, use -F (which implies --follow=name --retry).

tail -F /var/log/nginx/access.log

Advanced Options

Filter by PID (--pid)

Stop following when a specific process dies. Useful for scripts.

tail -f logfile.log --pid=1234

Multiple Files

Watch multiple logs at once. tail prints a header for each.

tail -f /var/log/syslog /var/log/auth.log

Suppress Headers (-q)

When watching multiple files, don't print file name headers.

tail -qf *.log

Piping

Display the last 5 items of a sorted list.

ls -t | tail -n 5

Notes

• head vs tail: head for the beginning, tail for the end.
• less: less +F file.log acts like tail -f but allows you to interrupt and scroll back up.