Linux tail Command: -f for Live Logs, -n for Last N Lines

Q: How do I save the tail output?

`tail -n 100 file.log > saved.log`. The team that uses this captures the last N lines for analysis.

Q: Can I tail a compressed file?

Not directly. Use `zcat file.log.gz | tail` or `zless file.log.gz`. The team that works with rotated gzip logs uses `zless` or `zcat | tail`.

tail shows the last lines of a file. tail file.log shows the last 10 lines. tail -f file.log follows the file (live updates). tail -n 100 file.log shows the last 100 lines. tail -F file.log handles log rotation. The team that uses tail -f watches logs in real-time. The team that uses tail -n extracts recent lines for analysis.

Basic tail
Live log watching (-f)
Log rotation handling (-F)
Multiple files
With grep
Pipe from other commands
Bytes from end (-c)
Tail alternative: less + F
FAQ

Basic tail

tail file.log

Shows the last 10 lines. The team that wants fewer/more lines uses -n:

tail -n 5 file.log   # last 5 lines
tail -n 100 file.log # last 100

Live log watching (-f)

tail -f file.log

Follows the file - new lines appear as they’re written. Ctrl-C to exit.

The team that uses tail -f watches a service log while restarting the service to see new output in real-time.

Log rotation handling (-F)

tail -F file.log

Capital F follows the file by name (reopens if the file is rotated). Lowercase -f follows by inode (fails if rotated). The team that uses -F survives logrotate; the team that uses -f loses the tail when rotation happens.

Multiple files

tail -f file1.log file2.log

Shows file names as a header when switching between files:

==> file1.log <==
(last lines of file1.log)

==> file2.log <==
(last lines of file2.log)

The team that uses multiple files has one terminal for multiple logs.

With grep

tail -f file.log | grep "ERROR"

Filter live log output for patterns. The team that uses this watches for errors without scrolling through everything.

Pipe from other commands

ls -la | tail        # last lines of ls
ps aux | tail         # last processes
df -h | tail          # last lines of df

tail works on stdin by default. The team that uses this for one-liners has quick output filtering.

Bytes from end (-c)

tail -c 100 file.log   # last 100 bytes
tail -c 1k file.log   # last 1 KB

Useful for binary files or when you know exact byte size. The team that uses -c for specific byte counts has precise control.

Tail alternative: less + F

less +F file.log opens the file and follows it (like tail -f). Press Ctrl-C to stop following, then you can scroll. The team that uses less +F has interactive log exploration: follow until interesting, then scroll.

FAQ

What’s the difference between tail -f and tail -F?

-f follows by inode (fails on log rotation). -F follows by name (reopens on rotation). The team that uses -F for rotated logs has continuous viewing.

Can I tail a file as a non-root user?

Yes - if your user has read permission on the file. The team that uses sudo tail has access to protected logs.

How do I save the tail output?

tail -n 100 file.log > saved.log. The team that uses this captures the last N lines for analysis.

Can I tail a compressed file?

Not directly. Use zcat file.log.gz | tail or zless file.log.gz. The team that works with rotated gzip logs uses zless or zcat | tail.

Why does my tail -f stop showing new lines?

Either the file was rotated (use -F instead) or the file was deleted and recreated. The team that uses -F survives rotation.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: