Is `tail -f` more efficient than `less +F`?

Question

This article pointed out some reasons to use less +F over tail -f. Most of the reasons are about the features, not technical reasons: less +F can highlight, search, navigate through file.

How about the technical reasons?

AFAIK, less uses polling each one second to update the file, while tail, as POSIX defined use a loop that sleeps for 1 second and copies any bytes that are available. This is sufficient but POSIX also encouraged implementation to use more efficient method. At least GNU tail use inotify, so it's more efficient.

less also keeps the file content in memory, so with huge file, like a few gigabytes, it can slow down your computer.

So, is there any others technical reasons to use tail -f over less +F?

Answer 1

I think you've covered the main point: less +F reads the whole file, whereas on many systems tail -f only reads the end of the file, and even on the systems where it does read the whole file, at least it doesn't keep the whole file in memory. That makes less +F impractical for very large files. You can, however, run less -n +F, which causes less to read only the end of the file, at the cost of not displaying line numbers.

Under the hood, between less -n +F and tail -f, the main difference is that tail uses a file change notification service on some platforms (e.g., inotify on Linux), which allows it to display new data instantly, whereas less might take up to 1 second to display the new data because it checks for new data in a loop and sleeps between checks.

Another difference between less +F and tail -f is that less will invoke its input filter, but that usually won't have any impact on log files.

A technical difference which is in favor of less +F is that you can make it truncate lines at the screen width with the -S option, whereas tail gives you no choice but to display the whole line no matter how long it is.

Interface-wise, there's not that much of an advantage to using less. tail -f is useful to notice when something happens. You can even run it in the background. If something happens and you want to look at the file in more detail, you can open it in less in another terminal.

If you want to watch multiple files, multitail is the way to go. Even for a single file, multitail has additional nifty features such as filtering and colorizations.