How to Monitor Log Files in Real Time Using the Linux tail Command

When an application crashes or a web server starts returning 500 Internal Server errors, system administrators immediately rush to check the system log files. However, log files (such as /var/log/syslog or /var/log/nginx/error.log) can easily grow to thousands of lines long. Opening a massive, constantly updating file in a standard text editor like `nano` or `vim` is highly inefficient. Instead, the Linux standard for monitoring logs is the tail command, which allows you to view the absolute newest data at the very bottom of the file in real-time.

Basic Usage: Viewing the End of a File

By default, if you run the tail command against a text file, it will print exactly the last 10 lines of that file to your terminal screen and then exit.

1. Open your Linux terminal.
2. Type the command: tail /var/log/syslog
3. Press Enter.

If you want to see more or fewer lines, you can use the -n (number) flag. For example, to view the last 50 lines of the apache access log:

tail -n 50 /var/log/apache2/access.log

The Power of the Follow Flag (-f)

While viewing the last 50 lines is helpful, it is a static snapshot. If a new error occurs five seconds later, you won’t see it unless you manually run the command again. To create a live, scrolling monitor, you must use the -f (follow) flag.

tail -f /var/log/nginx/error.log

When you press Enter, the terminal will print the last 10 lines, but it will not return your bash prompt. The command stays active, hooking into the file system. Now, go to your web browser and deliberately trigger the error on your website. The exact second the Nginx web server writes the new error line to the log file, it will instantly pop up on your terminal screen.

This creates a live, real-time diagnostic dashboard, allowing you to watch the internal heartbeat of your server as users interact with it.

To exit this live-monitoring mode and reclaim your terminal prompt, simply press Ctrl + C on your keyboard.

Monitoring Multiple Log Files Simultaneously

In complex environments, an error might be caused by the web server (Nginx) but recorded by the database (MySQL). You can monitor both logs simultaneously in real-time by feeding multiple paths to the tail -f command.

tail -f /var/log/nginx/error.log /var/log/mysql/error.log

The terminal will print live updates from both files, automatically inserting clear headers (e.g., ==> /var/log/nginx/error.log <==) whenever it switches between printing a line from one file or the other, keeping your diagnostic data perfectly organized.