tail Cheatsheet

By Dejan Panovski •Updated on • Download PDF

Quick reference for viewing the end of files, following logs, and using tail with lines, bytes, and pipelines in Linux

The `tail` command shows the end of files and can keep watching them as new lines arrive. This cheatsheet covers the most common line, byte, follow, and log-monitoring patterns you will use in daily Linux work.

Basic Syntax

Core tail command forms.

CommandDescription
tail FILEShow the last 10 lines of a file
tail -n 20 FILEShow the last 20 lines
tail -f FILEFollow a file as new lines are appended
tail -c 200 FILEShow the last 200 bytes
command | tailShow the end of piped output

Show the Last Lines

Common line-based usage patterns.

CommandDescription
tail /var/log/syslogShow the last 10 lines of a system log
tail -n 50 /var/log/nginx/access.logShow the last 50 log lines
tail -5 file.txtShort form for the last 5 lines
tail -n 1 file.txtShow only the last line
tail -n +5 file.txtStart printing from line 5

Follow Logs in Real Time

Monitor changing files without reopening them.

CommandDescription
tail -f /var/log/auth.logFollow a log file live
tail -n 100 -f app.logShow recent lines, then keep following
tail -F /var/log/nginx/error.logFollow by filename and survive log rotation
sudo tail -f /var/log/secureFollow a root-owned log file
tail -f --pid=1234 app.logStop following when PID 1234 exits

Bytes and Starting Positions

Switch from lines to byte counts or start offsets.

CommandDescription
tail -c 500 file.binShow the last 500 bytes
tail -c 2K file.logShow the last 2 KiB
tail -n +2 file.csvSkip the first line, useful for headers
tail -n +20 file.txtPrint from line 20 to the end
tail -c +101 file.txtPrint starting from byte 101

Multiple Files

Inspect or follow more than one file at a time.

CommandDescription
tail file1.log file2.logShow the last 10 lines from each file
tail -n 20 file1.log file2.logShow the last 20 lines from each file
tail -f /var/log/syslog /var/log/auth.logFollow multiple log files live
tail -q file1 file2Suppress file headers
tail -v file1 file2Always show file headers

Pipelines and Combos

Use tail with other text-processing tools.

CommandDescription
dmesg | tail -n 20Show the most recent kernel messages
ps aux | sort -nk 3 | tail -5Show processes with the highest CPU usage
grep ERROR app.log | tail -n 20Show the latest matching error lines
tail -n +20 file.txt | head -n 11Extract lines 20 through 30
journalctl -u nginx | tail -n 50Show the latest service log lines

Troubleshooting

Quick checks for common tail confusion.

IssueCheck
No new output appears with -fConfirm the file is still being written to and you are watching the correct path
Output stops after log rotationUse tail -F to follow the filename instead of the old file descriptor
Permission deniedCheck file ownership and run with the correct user or sudo if needed
Need only one field or last valueCombine tail with awk or cut after confirming the file format
Wrong starting line with +NRemember tail -n +N starts printing at line N, not after it

Use these guides for full logging and text-processing workflows.

GuideDescription
tail Command in LinuxFull tail guide with examples
head Command in LinuxShow the first lines of files
less Command in LinuxScroll, search, and follow file output
grep Command in LinuxFilter matching log lines
linux wc CommandCount lines and bytes in files