You know tail -f. You've used grep. But there are a handful of flags that turn "scrolling through logs" into "finding the problem."
tail --follow=name — survives log rotation
Standard tail -f follows the file descriptor. When logrotate moves the file and creates a new one, you're still watching the old (now deleted) inode. --follow=name reopens the file by name, so you keep seeing new lines after rotation.
# instead of
tail -f /var/log/app.log
# use
tail --follow=name /var/log/app.log
head -n -N — skip the last N lines
Useful when logs have a footer (summary line, timestamp, ASCII art banner) you don't care about.
# show everything except the last 3 lines
head -n -3 /var/log/app.log
cat -A — reveal the invisible
Tabs become ^I, line endings become $, non-printing chars get visible. Catches the "why does this config work on my machine but not prod?" class of bugs — usually a tab vs spaces issue or CRLF vs LF.
cat -A /etc/nginx/nginx.conf
tac — read backwards
cat spelled backwards. Reads a file from the last line to the first. Faster than tail -n 100 | tac when you're hunting for the most recent occurrence of something.
tac /var/log/app.log | grep -m1 "ERROR"
journalctl -u service -f — systemd journal follow
If your service logs to journald (most systemd services do), this is cleaner than chasing log files. No rotation issues, includes metadata, and -f works like tail -f.
journalctl -u nginx -f
# or with time bounds
journalctl -u nginx --since "1 hour ago"
None of these are fancy. They're just the flags that keep you from writing awk one-liners at 2 AM. Keep them in muscle memory.
Top comments (0)