When troubleshooting server errors, debugging a newly deployed application, or monitoring system security, static text editors like nano or vim are insufficient. You don’t just want to see what a log file contained ten minutes ago; you need to watch the log file update dynamically in real-time as events occur.
The Linux tail command is perfectly designed for this exact scenario.
Understanding the Basics of tail
By default, if you use the tail command on a file, it simply prints the last 10 lines of that file to standard output and then immediately terminates.
tail /var/log/syslog
While useful for a quick glance, this does not provide real-time monitoring.
Using the Follow Flag (-f) for Real-Time Monitoring
To force the command to remain active and continuously stream new data as it is appended to the file, you must append the -f (follow) flag.
tail -f /var/log/auth.log
When you execute this, your terminal prompt will not return. Instead, the last 10 lines will print, and the cursor will pause at the bottom of the screen. Any new SSH login attempts, sudo executions, or authentication errors will instantly appear on your screen the millisecond the operating system writes them to the log.
To exit this real-time monitoring mode and return to your normal command prompt, press Ctrl + C.
Adjusting the Initial Line Output (-n)
Sometimes the last 10 lines do not provide enough context before the live stream begins. You can combine the -f flag with the -n (number) flag to dictate exactly how many historical lines should be printed first.
For example, to display the last 50 lines of the Apache error log, and then continue following it in real-time:
tail -n 50 -f /var/log/apache2/error.log
Monitoring Multiple Log Files Simultaneously
A powerful, often overlooked feature of tail -f is its ability to monitor multiple files at the exact same time. This is incredibly useful if you need to correlate an error in an application log with a system-level event.
tail -f /var/log/nginx/access.log /var/log/nginx/error.log
When monitoring multiple files, tail automatically injects a small header (e.g., ==> /var/log/nginx/error.log <==) into the live stream whenever the output switches from one file to another, keeping the data perfectly organised for you.