Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to do a tail -f (or similar) on a file, and grep it at the same time? I wouldn't mind other commands just looking for that kind of behavior.

share|improve this question
up vote 32 down vote accepted

Using GNU tail and GNU grep, I am able to grep a tail -f using the straight-forward syntax:

tail -f /var/log/file.log | grep search_term
share|improve this answer

It will work fine; more generally, grep will wait when a program isn't outputting, and keep reading as the output comes in, so if you do:

$ (echo foo; sleep 5; echo test; sleep 5) | grep test

Nothing will happen for 5 seconds, then grep will output the matched "test", and then five seconds later it will exit when the piped process does

share|improve this answer

Add --line-buffered to grep, and that may reduce the delay for you. Very useful in some cases.

tail -f foo | grep --line-buffered bar
share|improve this answer
That's useful when the output of grep doesn't go to a terminal (redirected to another type of file). line buffering is the default when the output goes to a terminal, so it won't make any difference there. Note that that option is GNU specific. – Stéphane Chazelas Feb 13 '14 at 14:16

You can just pipe the output of grep into tail -f. There are also programs that combine tail -f functionality with filtering and coloring, in particular multitail (examples).

share|improve this answer
tail -f access | awk '/ADD/{print $0}'

Use the above, i use it usually.

share|improve this answer

You can use netcat to grep the results of tail -f as new results come in quite easily.

sudo nc -s localhost -l -p 1337 | grep ssh

tail -f /var/log/file.log | nc 1337

This sets grep to listen to results for input coming from port 1337.
The second command pipes the output of tail -f to netcat and sends it out localhost 1337. To do it locally you need to switch ttys for each of the two sets of commands, or use something like screen.

share|improve this answer

It works. But take care that output is no longer instantaneous: it gets buffered through the pipe.

share|improve this answer
Agreed. To test this, open two windows. Run tail -f in one window, and tail -f logfile | grep pattern in the other window. Lines containing pattern don't always appear in both windows at the same time. I've seen lines appear 30 seconds apart on rare occasions, which was annoying. – Stefan Lasiewski Oct 19 '10 at 19:46
That might have more to do with the system flipping between running one or the other instance of tail. A better test would us tee or something. – Kevin Cantu Oct 19 '10 at 22:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.