Hot answers tagged

159

Use the -F option instead: tail -F /var/log/kern.log The -F option tells tail to track changes to the file by filename, instead of using the inode number which changes during rotation. It will also keep trying to open the file if it's not present.


146

It might suffice to use watch: $ watch tail -n 15 mylogfile.txt


118

No, tail doesn't read the whole file, it seeks to the end then read blocks backwards until the expected number of lines have been reached, then it displays the lines in the proper direction until the end of the file, and possibly stays monitoring the file if the -f option is used. Note however that tail has no choice but to read the whole data if provided a ...


113

grc, the generic colourizer is pretty cool. apt-get install grc Just do grc tail -f /var/log/apache2/error.log and enjoy! You’ll also find it on GitHub.


113

I suggest the sed solution, but for the sake of completeness, awk 'NR >= 57890000 && NR <= 57890010' /path/to/file To cut out after the last line: awk 'NR < 57890000 { next } { print } NR == 57890010 { exit }' /path/to/file Speed test: 100,000,000-line file generated by seq 100000000 > test.in Reading lines 50,000,000-50,000,010 ...


88

Have you tried tail -f file1 file2? It appears to do exactly what you want, at least on my FreeBSD machine. Perhaps the tail that comes with a Debian system can do it too?


77

You can use tail command with -f : tail -f /var/log/syslog It's good solution for real time show.


72

You describe the GNU tail utility. The difference between these two flags is that if I open a file, a log file for example, like this: $ tail -f /var/log/messages ... and if the log rotation facility on my machine decides to rotate that log file while I'm watching messages being written to it ("rotate" means delete or move to another location etc.), the ...


68

You could have seen how tail works yourself. As you can for one of my files read is done three times and in total roughly 10K bytes are read: strace 2>&1 tail ./huge-file >/dev/null | grep -e "read" -e "lseek" -e "open" -e "close" open("./huge-file", O_RDONLY) = 3 lseek(3, 0, SEEK_CUR) = 0 lseek(3, 0, SEEK_END) ...


62

From the tail(1) man page: With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail’ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descrip- tor (e.g., log rotation). ...


55

You can use this to strip the first two lines: tail -n +3 foo.txt and this to strip the last two lines: head -n -2 foo.txt (assuming the file ends with \n for the latter) Just like for the standard usage of tail and head these operations are not destructive. Use >out.txt if you want to redirect the output to some new file: tail -n +3 foo.txt >out....


54

It's probably output buffering from grep. you can disable that with grep --line-buffered. But you don't need to pipe output from grep into awk. awk can do regexp pattern matching all by itself. tail -f test.txt | awk '/Beam/ {print $3}'


54

With GNU timeout: timeout 20 tail -f /path/to/file


49

If you want lines X to Y inclusive (starting the numbering at 1), use tail -n +$X /path/to/file | head -n $((Y-X+1)) tail will read and discard the first X-1 lines (there's no way around that), then read and print the following lines. head will read and print the requested number of lines, then exit. When head exits, tail receives a SIGPIPE signal and dies,...


47

Use the "watch" command: watch ls This will run the "ls" command every 2 seconds.


43

tac only helps if you also use grep -m 1 (assuming GNU grep) to have grep stop after the first match: tac accounting.log | grep -m 1 foo From man grep: -m NUM, --max-count=NUM Stop reading a file after NUM matching lines. In the example in your question, both tac and grep need to process the entire file so using tac is kind of pointless. ...


43

As said in the comments, Ctrl-C does not kill the tail process, which is done by sending either a SIGTERM or SIGKILL signal (the infamous -9...); it merely sends a SIGINT which tells tail to end the forward mode and exit. FYI, these's a better tool: less +F filename In less, you can press Ctrl-C to end forward mode and scroll through the file, then press ...


41

You can tail multiple files with… multitail. multitail -Q 1 'directory/*' -Q 1 PATTERN means to check for new content in existing or new files matching PATTERN every 1 second. Lines from all files are shown in the same window, use -q instead of -Q to have separate windows.


39

Yes, less can follow by file name The feature has a fairly obscure syntax: less --follow-name +F file.log With less, --follow-name is different from the tail option --follow=name. It does not make less follow the file, instead it modifies the behaviour of the command key F inside of less to follow based on the file name, not the file descriptor. Also, ...


38

You can pipe the tail -f into sed, telling it to quit when it sees the line you're searching for: tail -f /path/to/file.log | sed '/^Finished: SUCCESS$/ q' sed will output each line it processes by default, and exit after it sees that line. The tail process will stop when it tries to write the next line and sees its output pipe is broken


36

tail -f's tail is actually something unknown in the present, so how should the next tail know it. On the other hand tail -f's head is something already known and could therefor be processed. Or to put it simpler: tail is relative to the end of the file, but the output stream of tail -f got no EOF (at least not before its termination). If you find the first ...


36

There is a way better way of achieving this: less +F <file> It'll show you the whole file, has the full power of less and will wait for new input. If you want to stop waiting for input, and read a specific part, you can stop it with ^C and resume with F. The F command is always available in less, if you decide to watch for changes while having a ...


35

Maybe: tail -n +1 -f file | awk '{printf "\r%lu", NR}' Beware that it would output a number for every line of input (though overriding the previous value if sent to a terminal). Or you can implement the tail -f by hand in shell: n=0 while :; do n=$(($n + $(wc -l))) printf '\r%s' "$n" sleep 1 done < file (note that it runs up to one wc and one ...


35

I think you've covered the main point: less +F reads the whole file, whereas on many systems tail -f only reads the end of the file, and even on the systems where it does read the whole file, at least it doesn't keep the whole file in memory. That makes less +F impractical for very large files. You can, however, run less -n +F, which causes less to read only ...


34

If you're getting this warning when using the StorNext filesystem and are running coreutils 8.21 or earlier, there isn't much to worry about; this warning message is expected. GNU tail has hardwired knowledge about a number of filesystem types, and warns when it encounters an unknown type. Support for the StorNext filesystem was added to tail in coreutils ...


33

Use sed: sed -n -e '10,100p' input.txt > output.txt sed -n means don't print each line by default. -e means execute the next argument as a sed script. 10,100p is a sed script that means starting on line 10, until line 100 (inclusive), print (p) that line. Then the output is saved into output.txt. If your file is longer than suggested, this version (...


33

What you see is effect of a standard stdout buffer in grep provided by Glibc. The best solution is to disable it by using --line-buffered (GNU grep, I'm not sure what other implementations might support it or something similar). As for why this only happens in some cases: ssh server "tail -f /var/log/server.log | grep test" runs the whole command in the ...


32

Have a look at lnav, the advanced log file viewer. It can also pretty print various formats. Before: After:


32

tail lets you add -n to specify the number of lines to display from the end, which can be used in conjunction with -f. If the argument for -n starts with + that is the count of lines from the beginning (0 and 1 displaying the whole file, 2 indicating skip the first line, as indicated by @Ben). So just do: tail -f -n +0 filename If your log files get ...


32

It's not tail, it's the piping. mysql uses a tabular with ASCII boxing output format when its stdout is a terminal device, when it's intended for a user, and reverts to a scripting format when it's not, like when it's a pipe or a regular file. You'd see the same different format with mysql... | cat or mysql > file; cat file See also the -r/--raw, -s/...


Only top voted, non community-wiki answers of a minimum length are eligible