Tail on Linux: Inspect Recent Output and Watch Logs

When a process is writing to a log, opening the file in an editor is often slower than asking one focused question: what happened most recently, and what happens next?

tail answers both. It prints the end of a file or stream, and it can stay open to show new data as it arrives.

Get the part of the file you need

With no options, tail prints the last 10 lines:

tail app.log

To see a larger or smaller slice, pass a count with -n:

tail -n 25 app.log

If the file contains fewer lines than requested, tail prints the whole file. It reads the file; it does not modify it.

A small but useful distinction: -n 8 means “show the last eight lines,” while -n +8 means “start at line eight and print through the end.” Line numbering starts at 1:

tail -n +8 notes.txt

For ordinary text, use line counts. -c selects bytes instead, which can start in the middle of a line or a multibyte UTF-8 character:

tail -c 100 data.txt

Follow new output

To print the current last 10 lines and then wait for new data, use -f:

tail -f app.log

This is useful while reproducing a bug or waiting for a service to report an event. If you only want to see output produced after you start watching, begin with zero lines:

tail -n 0 -f app.log

Stop the foreground command with Ctrl+C. That interrupts tail; it does not stop the application writing the log.

If you want to narrow down a noisy log first, pipe matching lines into tail:

grep "ERROR" app.log | tail -n 10

Here, grep selects matching lines and tail keeps only the last ten matches. For more ways to search logs and other text, see this guide to searching with grep.

The log rotation gotcha

There are two ways a log can change while you watch it. An application may append to the existing file, or a log manager may rename that file and create a new one at the same path.

On GNU/Linux, tail -f follows the file it opened. If the original file is renamed, it may keep watching that old file rather than the replacement. Use -F when you want GNU tail to follow the filename and retry opening it if it disappears:

tail -F app.log

GNU tail -F is equivalent to --follow=name --retry. This behavior is useful for rotated logs, but -F is a GNU extension and may not exist in every Unix implementation. Check the local tail manual before relying on it elsewhere.

Combine output without losing the source

Without a filename, tail reads from standard input, so it works with other commands:

some-command | tail -n 5

That displays the last five lines produced by some-command; it does not save them. If you need to inspect output while also writing it to a file, a Linux tee walkthrough covers that pattern.

You can also pass multiple files:

tail -n 5 app.log worker.log

GNU tail adds a filename header for each file when more than one is supplied. GNU tail -q suppresses those headers:

tail -q -n 5 app.log worker.log

Options and header behavior can differ across implementations.

When the output looks wrong

• A follow command appears idle: That is expected until new data arrives. Check that the application is writing to the file you opened, and that you can read it.
• You see the wrong section: -n 8 selects the last eight lines; -n +8 starts at line eight.
• The file was replaced: Try GNU/Linux tail -F if you need to keep following the pathname through rotation.
• The file cannot be opened: Check the path and your account's read access. Avoid changing permissions broadly just to inspect a log; use the appropriate account or ask an administrator for access.

tail is a simple reader for the file or stream you give it. It is excellent for quick checks, but it does not manage logs, guarantee that a service is writing where you expect, or replace service-specific logging tools.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.