tail text

The tail man page is 200 lines long. You need one flag — -f — and you’ll debug live systems faster than anyone staring at a log viewer refresh button.

Something broke. You need to see what’s happening right now. Not what happened five minutes ago. Not a static log file you have to refresh. Right now. Live. As it happens.

So you opened a log file in a text editor. You scrolled to the bottom. You waited. Nothing new appeared because text editors don’t auto-refresh. You closed it. You opened it again. New lines appeared. You scrolled to the bottom again. You repeated this cycle six times before admitting there has to be a better way.

tail -f shows you the end of a file and watches it. New lines appear the instant they’re written. You see events as they happen. It’s a live feed of your log file — a security camera for your server.

Unless you’re running Windows then wtf none of this applies to you. But hey, come to the dark side, go install WSL2 and you can follow along. We’ll wait. Impatiently.

If you’re lazy like me (all sysadmins are!) then click here for the tail cheat sheet.

Follow a log file (the reason you’re here)

tail -f /var/log/syslog

Shows the last 10 lines, then waits. Every new line that gets written to the file appears on your screen immediately. Press Ctrl+c to stop.

This is the single most useful command for debugging live systems. Web server returning errors? tail -f /var/log/nginx/error.log. Application crashing? tail -f /var/log/app.log. Something writing to syslog? tail -f /var/log/syslog.

Follow and filter

tail -f /var/log/syslog | grep ERROR

Only shows lines containing “ERROR” as they appear. The noise is gone. You only see what matters. Combine with grep for surgical precision.

tail -f /var/log/nginx/access.log | grep "POST /api"

Watch API POST requests in real-time. You’re now monitoring traffic patterns from your terminal.

Show more than 10 lines

tail -n 50 /var/log/syslog

The last 50 lines. -n sets how many lines from the end. The default is 10, which is often not enough context.

tail -100 /var/log/syslog

Shorthand — just the number. Same thing.

Show from a specific line number

tail -n +100 file.txt

Starting from line 100 to the end. The + means “from this line forward” instead of “last N lines.”

Follow multiple files

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Watches both files. When a new line appears in either one, tail shows it with a header indicating which file it came from:

==> /var/log/nginx/access.log <==
192.168.1.5 - - [15/Mar/2026:14:32:07 +0000] "GET /api/status" 200

==> /var/log/nginx/error.log <==
2026/03/15 14:32:08 [error] 1842#1842: connect() failed

Now you can correlate access logs with error logs in real-time. A request came in, and half a second later an error occurred. Connected.

tail -F (capital F) for rotated logs

tail -F /var/log/syslog

Capital -F is like -f but handles log rotation. When a log file gets rotated (renamed and replaced by logrotate), lowercase -f stops following because the file descriptor changed. Capital -F detects the rotation and switches to the new file automatically.

Always use -F for log files that might get rotated. Which is most log files.

Combine with other commands

Watch a command’s output grow

tail -f <(ping google.com)

Process substitution — runs ping and follows its output. Useful for any long-running command where you want the latest output.

Last lines of multiple files

tail -n 5 /var/log/*.log

Last 5 lines of every .log file. Each file gets a header. Quick health check across all your logs.

Pair with watch for non-log files

watch -n 2 'tail -5 /proc/meminfo'

Updates every 2 seconds. Shows the last 5 lines of memory info. Not the same as -f (which follows appended lines), but useful for files that get rewritten rather than appended.

head (tail’s less popular sibling)

While we’re here — head shows the beginning of a file instead of the end:

head -n 20 file.txt

First 20 lines. For when the important stuff is at the top (headers, config file openings, CSV column names).

head -n 1 *.csv

First line of every CSV file — usually the headers. Quick way to check what columns you’re working with before firing up awk.

The flags that actually matter

“But I use a log viewer—”

Tell me more.

“I view logs in the AWS Console.” The AWS Console shows you CloudWatch logs with a 30-second refresh delay, pagination, and a UI that requires three clicks to change the time range. tail -f shows you lines the instant they’re written. Zero delay. Zero clicks.

“Kibana shows me searchable logs.” Kibana is excellent for aggregated, searchable, historic log analysis across distributed systems. It’s also a multi-gigabyte Elasticsearch deployment. For watching one log file on one server right now, tail -f | grep pattern does the job in zero milliseconds with zero infrastructure.

“I open the log file in VS Code.” VS Code doesn’t auto-refresh open files by default. Even with an extension, it re-reads the entire file on each refresh. tail -f streams only new lines. On a 2GB log file, that’s the difference between instant updates and a frozen editor.

“I use less +F.” That’s actually solid. less +F is similar to tail -f with the bonus that you can press Ctrl+c to stop following and then search/navigate the file, then press F to resume following. If you already use less, this is a power move.

“I just cat the log and scroll.” You just loaded a 500MB file into your terminal buffer. Your terminal is now using 2GB of RAM to display text. Your scrollback is full. Your terminal might crash. tail -n 100 shows the last 100 lines. That’s probably all you needed.

tail cheat sheet

You made it. Or you skipped straight here. Either way, no judgment. Copy and paste these. Pin them. Tattoo them on your forearm. Whatever works.

The one command: tail -F /var/log/something.log — capital F, handles rotation, shows new lines instantly. Add | grep pattern to filter. That’s your live debugging setup.

Back to the top, you overachiever.