Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · reading files

tail

the end of a file, live

tail prints the end of a file — the last ten lines unless told otherwise. That is where a log’s newest entries are, and with -f it stays open and prints each new line as it arrives, which makes it the usual way to watch a service while you test it.

A log grows at the bottom, so the end is where the news is.

Prints
The last 10 lines
unless -n says otherwise
Follow
-f
stays open; Ctrl+C to stop
Opposite
head
prints the first lines
Used on
Log files
mostly

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils
$ tail -n 3 app.log
12026-09-30 10:19:43 error: timeout after 30s
2026-09-30 10:20:01 info: retrying
2026-09-30 10:20:02 info: connected
2$ tail -f app.log
2026-09-30 10:20:02 info: connected
32026-09-30 10:31:02 info: request served in 12ms
^C
4$ head -n 1 app.log
2026-09-30 09:00:00 info: service started
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
The newest three entries

-n 3 asks for three lines instead of ten. They are printed in file order, oldest of the three first.

2
-f does not return to the prompt

It prints the last lines, then waits. The command is still running.

3
A line appears the moment it is written

Make a request to the service in another window and its log line shows up here. Ctrl+C, shown as ^C, stops following.

4
head is the same idea from the top

The first line of the file — here, when the service started.

Switches

A switch changes how the command behaves. These are the ones used day to day; man tail lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-n NUM
Print the last NUM lines instead of the last 10.
-n +NUM
Print from line NUM to the end of the file.
-f
Follow: keep the file open and print new lines as they are written.
-F
Follow by name: keep following even if the file is rotated and recreated.
-c NUM
Print the last NUM bytes instead of lines.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo tail -f /var/log/syslog

Watches the system log live. Fedora-family systems use /var/log/messages.

tail -f app.log | grep --line-buffered error

Follows a log but shows only the lines that match.

tail -n +2 data.csv

Prints from the second line onward — a file without its header row.

journalctl -u nginx -f

The same live view for a service that logs to systemd’s journal.

In cybersecurity

Watching a log as it is written is the quickest way to see an attack while it is happening.

Watch the auth log

"tail -f /var/log/auth.log" shows logins and sudo use as they occur. A stream of failures from one address is a password-guessing attempt in progress.

Logs are readable for a reason

Log files are usually limited to root and the adm group because they contain user names, addresses and sometimes mistyped passwords.

Rotation breaks -f

When a log is rotated, -f keeps following the old, renamed file and goes quiet. -F follows the name and picks up the new file.

Filed under

Reading files

Read alongside

catPrints the contents of a file to the terminal, or joins several files into one stream.grepSearches files for lines that match a pattern, and prints the lines it finds.