If a critical application crashes on your Linux server, the exact error code explaining why the crash occurred is almost always written to the very bottom of a system log file. Opening a massive, multi-gigabyte log file in a text editor like Nano simply to scroll to the absolute bottom is a massive waste of system memory.
Instead, Linux administrators use the tail command. This incredibly efficient utility instantly slices off the very end of a file and prints it to your terminal screen, allowing you to instantly view the most recent log entries without reading the rest of the data.
How to Use the tail Command
By default, if you use the command without any special flags, it will print exactly the last 10 lines of the target file.
- Open your Linux terminal.
- Type
tail, followed by a space, and then the exact path to the file.tail /var/log/syslog
- Press Enter.
The terminal will instantly spit out the bottom 10 lines of the file. Because it did not attempt to load the entire document into RAM, the command executes instantly.
Changing the Number of Lines
Ten lines is often not enough context to understand a complex server crash. You can override the default behavior by using the -n (number) flag to specify exactly how many lines you want to see.
- To read the last 50 lines:
tail -n 50 /var/log/syslog
- To read only the absolute last line:
tail -n 1 /var/log/syslog
How to “Follow” a File in Real-Time (The -f Flag)
The most powerful feature of the tail command is its ability to stream live data. If you are actively debugging a web server and want to watch the traffic hit your server in real-time, you can use the “follow” flag (-f).
tail -f /var/log/apache2/access.log
When you run this command, the terminal will print the last 10 lines of the file, but it will not return you to the command prompt. Instead, it will keep the file open. Every time the web server writes a brand new line of text to the log file, tail will instantly print that new line to your screen, creating a live, scrolling feed of your server’s activity.
To exit this live-streaming mode and return to your normal command prompt, simply press Ctrl + C on your keyboard.