How to Read the End of a Log File in Ubuntu Using the tail Command

When you are managing a Linux server, troubleshooting an application crash, or monitoring a web server, you will inevitably need to read system log files. However, log files in Ubuntu (usually stored in the /var/log/ directory) can grow to be thousands of lines long. Opening a massive log file in a standard text editor like nano or trying to read it with cat is incredibly inefficient, as you will be flooded with old, irrelevant data.

Because the most recent and relevant events are always appended to the very bottom of a log file, Linux provides a dedicated command specifically designed for this purpose: tail. The tail command allows you to instantly output only the final few lines of any text file.

This guide explains how to use the tail command in the Ubuntu terminal to effectively read and monitor log files.

Step 1: Use the Basic tail Command

By default, the tail command will display the last 10 lines of a specified file and then immediately return you to the command prompt.

1. Open your Ubuntu terminal.
2. Type tail followed by a space, and then the absolute path to the file you want to read. For example, to read the system authentication log, you would type:

   tail /var/log/auth.log

3. Press Enter. You will instantly see the 10 most recent login attempts or authentication events on your system.

Note: Many files in /var/log/ require administrative privileges to read. If you receive a “Permission denied” error, simply prepend the command with sudo (e.g., sudo tail /var/log/syslog).

Step 2: Specify the Number of Lines

Often, 10 lines is not enough context to understand an error. You can tell the command exactly how many lines you want to see by using the -n (number) flag followed by your desired amount.

1. To view the last 50 lines of the syslog file, type the following command and press Enter:

   tail -n 50 /var/log/syslog

The terminal will instantly spit out a much larger chunk of the most recent data.

Step 3: Monitor a Log File in Real-Time (Live Follow)

The most powerful feature of tail is the ability to “follow” a file. Instead of returning you to the command prompt, the command stays open and continuously prints new lines to your screen the exact millisecond they are written to the log by the system. This is invaluable for watching a web server log while you click around a website to see if errors occur.

1. To follow a file in real-time, use the -f (follow) flag:

   tail -f /var/log/syslog

2. The last 10 lines will print, and the cursor will blink at the bottom of the screen. As new system events happen, they will appear instantly.
3. To exit follow mode and return to your normal command prompt, press Ctrl + C on your keyboard.