tail Command in Linux: View the End of Files and Follow Logs

When troubleshooting a server issue or tracking down a bug, you often need to see just the last few lines of a log file without opening the entire thing. The tail command does exactly that: it prints the last part of a file (10 lines by default) and can follow new lines as they are appended in real time.

tail is one of the most commonly used commands for monitoring logs and analyzing output that changes over time, usually combined with tools like grep .

This guide covers the most useful tail options with practical examples you can run on your own system.

Tail Command Syntax #

The general syntax of the tail command is:

tail [OPTION]... [FILE]...

• OPTION - tail options . We will go over the most common options in the next sections.
• FILE - Zero or more input file names. If no FILE is specified, or when FILE is -, tail will read the standard input.

How to Use the Tail Command #

In its simplest form, when used without any option, tail displays the last 10 lines of a file:

tail /var/log/syslog

Apr  7 08:15:01 server CRON[1423]: (root) CMD (command -v debian-sa1)
Apr  7 08:17:01 server CRON[1430]: (root) CMD (cd / && run-parts)
Apr  7 08:20:22 server systemd[1]: Starting Daily apt activities...
Apr  7 08:20:24 server systemd[1]: Started Daily apt activities.
Apr  7 08:25:01 server CRON[1445]: (root) CMD (command -v debian-sa1)
Apr  7 08:30:01 server CRON[1452]: (root) CMD (command -v debian-sa1)
Apr  7 08:32:11 server sshd[1460]: Accepted publickey for admin
Apr  7 08:35:01 server CRON[1478]: (root) CMD (command -v debian-sa1)
Apr  7 08:40:01 server CRON[1485]: (root) CMD (command -v debian-sa1)
Apr  7 08:45:01 server CRON[1492]: (root) CMD (command -v debian-sa1)

Only the last 10 lines are shown, no matter how large the file is.

How to Display a Specific Number of Lines #

Use the -n (--lines) option to specify the number of lines to be shown:

tail -n 50 /var/log/syslog

This prints the last 50 lines from /var/log/syslog. You can also omit the letter n and use just the hyphen and the number (with no space between them):

tail -50 /var/log/syslog

Both forms produce the same result.

Starting from a Specific Line #

If you prefix the number with +, tail prints everything from that line onward instead of counting from the end. For example, to skip the first 4 lines of a file and print the rest:

tail -n +5 /etc/passwd

This is useful when a file has a header row you want to strip, such as CSV files or structured log output.

How to Display a Specific Number of Bytes #

Use the -c (--bytes) option to show a specific number of bytes instead of lines:

tail -c 500 /var/log/auth.log

This displays the last 500 bytes from the file. You can also use a multiplier suffix: b (512), K (1024), M (1048576), and so on. For example, to display the last two kibibytes (2048 bytes):

tail -c 2K /var/log/auth.log

How to Watch a File for Changes #

The -f (--follow) option tells tail to keep the file open and print new lines as they are appended:

tail -f /var/log/nginx/error.log

This is the most common way to watch a log file in real time. You can combine -f with -n to control how many existing lines are shown before following begins:

tail -n 50 -f /var/log/syslog

This prints the last 50 lines and then continues waiting for new output. Press Ctrl+C to stop following.

Following Rotated Log Files #

Log files managed by logrotate are periodically renamed and replaced. The basic -f option follows the file descriptor of the original file, so after a rotation it usually keeps watching the old file instead of the new one created at the same path. Use -F (equivalent to --follow=name --retry) to follow by filename instead:

tail -F /var/log/nginx/access.log

With -F, tail detects that the original file has been moved and reopens the new file at the same path.

Stopping When a Process Exits #

When following a log file that a specific process writes to, you can tell tail to stop automatically when that process ends:

tail -f --pid=1234 /var/log/myapp.log

Replace 1234 with the actual PID. Once the process terminates, tail exits on its own.

How to Display Multiple Files #

When you pass multiple files, tail displays the last ten lines from each one, separated by a header showing the filename:

tail /var/log/syslog /var/log/auth.log

==> /var/log/syslog <==
Apr  7 08:40:01 server CRON[1485]: (root) CMD (command -v debian-sa1)
Apr  7 08:45:01 server CRON[1492]: (root) CMD (command -v debian-sa1)
...

==> /var/log/auth.log <==
Apr  7 08:32:11 server sshd[1460]: Accepted publickey for admin
Apr  7 08:33:05 server sudo:   admin : TTY=pts/0 ; COMMAND=/usr/bin/apt update
...

All the same options work with multiple files. For example, to show the last 20 lines of each:

tail -n 20 /var/log/syslog /var/log/auth.log

You can also follow multiple files at once. tail prints the filename header each time a different file receives new output:

tail -f /var/log/syslog /var/log/auth.log

How to Use Tail with Other Commands #

tail is often combined with other commands through pipes.

To follow a log file and filter for a specific IP address:

tail -f /var/log/nginx/access.log | grep 192.168.42.12

Only lines containing that IP are printed. This is one of the most useful patterns for debugging live traffic.

To show the five processes using the most CPU, pipe ps through sort and tail:

ps aux | sort -nk 3 | tail -5

The sort -nk 3 sorts numerically by the third column (%CPU) in ascending order, so tail -5 grabs the five highest values from the end of the sorted list.

To extract lines 20 through 30 from a file, combine tail with the head command :

tail -n +20 /var/log/syslog | head -n 11

tail -n +20 outputs everything from line 20 onward, and head -n 11 keeps only the first 11 lines of that output (lines 20 through 30).

Quick Reference #

For a printable quick reference, see the tail cheatsheet .

Conclusion #

The tail command is a staple for anyone who works with log files or processes text on the command line. For the inverse operation (printing the beginning of a file), see the head command .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page