hpr-knowledge-base/hpr_transcripts/hpr1042.txt

Episode: 1042
Title: HPR1042: LiTS 012: tail
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr1042/hpr1042.mp3
Transcribed: 2025-10-17 17:50:18

---

Welcome to Linux in the Shell episode 12, the tail command.
My name is Dan Washco.
I'll be your host today and as always I want to give a shout out to hacker public radio
for hosting the website and the audio of this show.
Support hacker public radio because it's a great community project.
Tail command.
Remember, head on over to the website for the full writeout.
But here we go.
Tail command is a highly versatile command that she's staple in every system
administrator's toolbox.
And hopefully if it's not yours, it will be by the end of this episode.
Tail is very simple.
It by default will output the last 10 lines of a file that you specify to standard out.
Are you can specify more than one file on the command line?
You could tell file one file two file three and it will show you the last 10 lines of
those files.
It'll separate each file entry with a header telling you the name of the file and that's
by default.
So if you had it would show you file one in a header form and then it will show you
the 10 lines of file one last 10 lines of file one file two, it will list the name of the
file to last 10 lines of file two and then file three last three 10 lines of file three.
You can suppress the output of those headers by typing the dash q or dash dash quiet option.
And that will not output the headers but by default it will.
You can specify how many lines you want to show in one of three ways.
The dash n with some integer like 20 would show the last 20 lines of a file 30 would show
the last 30 lines or you could specify dash dash lines equal 40 which are sort of last
40 lines of a file.
And in some versions of tail most of them you could just specify dash some manager like
30, tail dash 30 some file will show the last 30 lines of a file it's easy way that you
can do it.
Now you can instead of showing the last 30 lines of a file you could specify with the
dash n plus and in some integer like dash n plus 30 will show a file from line 30 to
the end.
So any dash n plus some number will show from that number to the end of the file.
So that's pretty handy.
Now also instead of specifying line numbers you can use bytes or characters you can do
dash c or the dash dash bytes flag and specify some number and by default that works in
bytes.
So if you did tail dash c 30 or tail dash dash bytes equals 30 it would show you that
file from the last 30 bytes of that file.
Okay, just like dash n shows you last 30 lines dash c shows you bytes and similarly you
can do a plus 30 which would show you from 30 bytes of the file to the end.
So dash c plus 30 would be start from 30 bytes into the file and show to the end.
Now like the df command and the dh command that we talked about in the past you could specify
instead of bytes you can specify a multiplier like for instance if you wanted kilobytes
instead of bytes you could specify you would just simply add the multiplier to the end
of the integer for instance dash c plus dash c 30 is 30 bytes but dash c 30k is 30 kilobytes
dash c 30m is 30 megabytes dash c 30g is 30 gigabytes and so on.
Now if you go with the single letter k m g t and so on you're going to get it in bytes
like one kilobytes is a thousand 24 bytes and then one megabyte is a thousand 24 kilobytes
and so on so it's multiplied by 124 you can switch it to multiples of a thousand instead
by using like k capital k b or capital m b or capital g b and that's multiples of a thousand
instead of thousand 24 so just just be aware of that chances are you'll probably want to stick
with the multiples of twenty one thousand 24 that you're used to.
Now that's all great but we're tail really shines for our system administrator is the
dash f or dash dash follow option and what that does is let's say you're watching your PHP log
or your Apache log or any log file for that matter and you're trying to find an error or you're
trying to replicate an error well just tailing the log file you could see the last ten lines
or the thirty lines or whatever but it be handy is handy to watch it as it's going on real time
and that's where the dash f option comes in so if you pass dash f option to some log file like
PHP log tail dash f PHP log it'll start showing the last ten lines of PHP log but then it'll
continuously update the output to the screen with what's going what gets put into the log file
so you'll be watching that log file in real time and that's extremely handy and again you can
you could do that follow a number of files you can follow like your PHP log your Apache error log
at the same time all in the same line and it will show you both of those and it will separate the
entries of course what you're seeing to the screen with the headers unless you specify the quiet mode
but the dash f for follow is extremely handy and being able to monitor your logs real time and
it will continue the output though that as those logs get updated now follow operates in one of
two ways there's a follow equals name or follow equals descriptor and by default it's descriptor
and in the way that these two work is is different let's say that you are watching your Apache log
you're you're monitoring your Apache log and the default is descriptor and you have log rotate
going on or something happens that the log changes or gets deleted or gets rotated like I said
and if it gets rotated it chances are it gets rotated to a different name and like log dot and some
date stamp and creates a new Apache log well tails behavior with follow descriptor which is a
default is going to follow that name change so it's going to move from watching like PHP log to
over to php log dot timestamp and it will continue monitoring that so it'll go with the change
and you probably not want to do that with something like a log file because then the the rotated log
is not going to be updated anymore so if you want to continue following the original log you want to
follow it with the the name option so it's dash dash follow equals name and that's not the default
behavior of tail so in this instance with dash dash follow equals name if the log became rotated
instead of tail following the log to its new location it would stay there and continue to monitor
the log file that name that you specified so it would still stay on php dot log and it would attempt
to continue monitoring php dot log now it is possible that if it if php dot log doesn't get written
in a certain amount of time that tail may dump out and say the file no longer exists you can control
that and say no no no tail you you continue with the dash dash follow equals name continue to monitor
that log and then specify the dash dash retry option and it will continue to follow that log by name
and it with that load disappears it will continue to retry following that log until you either quit
or the file reappears again so it's very handy options right there now the dash dash f equals name
has a shorter option which is a dash capital f so dash f is follow equals descriptor dash capital
f is follow equals name so keep that in the back of your mind how you want to do use one of those
now if you're reading the man I'm going to before I cover that one let's talk about dash dash
pd equals so let's say you're monitoring a log file and you have some action going on
until you're monitoring the file with dash f and you got an action going on and it's a process
that's running and you just want to monitor the log file or some file while that process is running
so you could do the dash f and then dash dash pd equals the process idea of that pd and then
the file you want to monitor and tail will continue to monitor that file so long as that process
is still active and then once the process quits tail will quit there too so that's that could be
handy depending on what you're doing now if you're looking at the man page for tail info page you
will come upon an option in there called sleep interval dash dash sleep dash interval or dash s
for sleep interval be aware that this option will probably not work for you what that basically says
is tail monitors a file basically every second interval so it'll check to see if the file has changed
every second and you can change those intervals you can increase them by the dash s or the dash
dash sleep dash interval and you can specify like two seconds three seconds four and a half seconds
and so on that does not work anymore in most modern distributions because of something called
I notify in the kernel and tail is compiled with I notify what I notify does is that it monitors
the file system for changes and anytime a change is made to the file system it passes that information
on to an application that's aware and I tail is I notify aware now so you could specify seconds
or sleep interval and it's not going to matter with an I notify aware tail it'll just update tail
whether you'll get the update output whenever a file changes occurs so just be aware that dash
dash dash sleep interval is not going to work for you however it will work if you're using it
with the PID option and what that does is with PID equals something it monitors whether that PID
is still active every so often every but whatever the interval is specified dash s so dash s instead
of applying to change interval of a file now it applies to when tail looks to see whether
that PID is still active so if you work to set tail to monitor a file with in the quit with the PID
option and you specify a sleep interval of like 10 seconds if what it does is tails running it looks
to see if that PID process is still running and then it'll sleep for 10 seconds and then look
to see if the process is running but it will continue to show the output of whatever your monitoring
whatever file your monitoring it will continue to show that output but it will look for that process
every 10 seconds so if you quit that process or it terminates it could take anywhere from
one to nine seconds depending on where it was in that sleep process for it to register to look
for that process and notice it's not there anymore and then quit tail so that you can control how
it's observing for the process idea or with the sleep on there that still works you can try that
yourself but as you can tell tail is a very useful command and should be a staple in every system
administrators toolbox but even if you're not a system administrator it's extremely handy
and debugging stuff when you don't know what's going on in your system like you plug in a USB
device and nothing's happening you can tail your message log so tail dash FVAR log message and
you can plug it in you know plug that device in and see what kind of messages or whatever gets
reported to the system about that that device if there's anything occurring in the message log
and you know it's just a handy tool you can monitor your web site logs your patchy logs your PHP
any log or any file that's being written to or even standard out you can do a tail of standard
out of an application and just monitor it it's very very handy my name is Dan Waschko this was
Linux in the shell thank you hacker public radio if you haven't read the right up of Linux
in the shell go over there look at the right up watch the video get some examples of using the tail
command and I'll see you in a fortnight have a great one
you have been listening to hacker public radio or hacker public radio does our we are a community
podcast network that releases shows every week day Monday through Friday today show like all our
shows was contributed by an hbr listener like yourself if you ever consider recording a podcast
then visit our website to find out how easy it really is hacker public radio was founded by the
digital dot pound and the economical and computer cloud hbr is funded by the binary revolution
at binref dot com all binref projects are crowd- Exponsored by linear pages from shared hosting
to custom private clouds go to lunar pages dot com for all your hosting needs unless otherwise
today's show is released on the creative commons attribution share a line