When you are troubleshooting a crashed web server or investigating a failed software installation in Linux, your best friend is the system log file. However, server logs can easily grow to be tens of thousands of lines long.
If you try to open a massive log file using a text editor like nano or print it to the screen using cat, your terminal will freeze or be completely overwhelmed by thousands of pages of text. If a server just crashed, you don’t care what happened three months ago; you only care about the very last few lines of the file. This is exactly what the tail command is built for.
How to View the End of a File
By default, the tail command will instantly print the last 10 lines of any file directly to your terminal screen.
Syntax: tail [filename]
For example, to check the most recent system messages on an Ubuntu server, you would type:
tail /var/log/syslog
Press Enter, and Linux will instantly output the final 10 lines of that massive file, allowing you to quickly spot any immediate error codes.
How to Change the Number of Lines
Sometimes 10 lines isn’t enough context. You can easily tell tail exactly how many lines you want to see by using the -n (number) flag.
If you want to view the last 50 lines of the Apache web server error log, you would use:
tail -n 50 /var/log/apache2/error.log
You can make this number as small as 1, or as large as 1000, giving you precise control over how much data you pull onto your screen.
How to Follow a Log File in Real-Time
This is the most powerful and widely used feature of the tail command. Instead of just printing the last 10 lines and quitting, you can force tail to stay open and actively monitor the file for changes.
You do this using the -f (follow) flag.
tail -f /var/log/auth.log
When you press Enter, Linux will print the last 10 lines of the authentication log, but the command prompt will not return. The program will pause and wait.
If a user attempts to log into the server via SSH right at that moment, the new log entry will instantly appear on your screen in real-time. This is an indispensable tool for watching exactly what happens when you restart a service or trigger a specific error.
When you are finished monitoring the file and want your terminal prompt back, simply press Ctrl + C to terminate the tail process.