Working with Linux often means dealing with large log files, configuration files, and constantly changing output streams. While tools like vim are essential for editing files, and utilities such as batcat, multitail, or less are excellent for viewing content, the tail command remains one of the most practical utilities for quickly inspecting the end of a file.

In day-to-day system administration tasks—whether you’re debugging services, monitoring logs, or verifying system activity—you will frequently rely on commands like create users with useradd, split screen in vim, edit in vim a file opened with less. However, when you simply want to see the newest lines in a file or monitor changes in real time, the Linux tail command is the fastest and most efficient solution.

This guide explains how to use the tail command in Linux and Ubuntu, covering both basic and advanced usage, real-world scenarios, and techniques that system administrators rely on daily.

What Is the tail Command in Linux?

The tail command is a standard Unix and Linux utility used to display the last part of a file, typically the last 10 lines by default.

It is commonly used to:

• Inspect log files
• Monitor real-time system activity
• Debug services
• Analyze application output
• Track updates to files as they happen

Basic syntax:

tail [options] file

Example:

tail logfile.log

This command prints the last 10 lines of logfile.log.

---

Why the tail Command Is Important

Many Linux services continuously write data into log files. Some logs can grow to gigabytes in size, making it impractical to open them entirely.

Instead of loading the full file, tail allows you to:

• Read only the most recent entries
• Monitor files in real time
• Combine with other commands like grep for filtering
• Diagnose problems quickly

For system administrators, tail is one of the most commonly used troubleshooting tools.

---

How to Use the Tail Ubuntu Command Line

Using tail in Ubuntu is identical to most Linux distributions.

Basic usage:

tail filename.txt

This prints the last 10 lines of the file.

Example with a system log:

tail /var/log/syslog

This allows you to quickly see the most recent events recorded by the system.

---

Linux Tail Last 100 Lines

Often, viewing just 10 lines is not enough. You can display more lines using the -n option.

Example:

tail -n 100 logfile.log

This command shows the last 100 lines of the file.

Alternative syntax:

tail -100 logfile.log

This produces the same result.

This technique is frequently used when troubleshooting server logs or application errors.

---

Ubuntu Tail Last 100 Lines Example

If you’re analyzing system activity on Ubuntu, you might run:

tail -n 100 /var/log/syslog

Or for authentication logs:

tail -n 100 /var/log/auth.log

This helps quickly identify recent login attempts or security events.

---

Tail -f Command in Linux

One of the most powerful features of tail is the follow mode, enabled with -f.

The Tail -f command use case is monitoring a file as it grows.

Example:

tail -f logfile.log

This command keeps the terminal open and displays new lines as they are added to the file.

This is extremely useful for:

• Monitoring application logs
• Watching server activity
• Tracking debugging output
• Observing script execution

Press Ctrl + C to stop the process.

---

Linux Tail Log File Continuously

If you need to monitor a log file continuously, the -f option is the simplest solution.

Example:

tail -f /var/log/syslog

This allows administrators to see system events in real time.

Another example:

tail -f /var/log/nginx/access.log

This displays incoming web requests as they happen.

---

Linux Tail File Continuously With Multiple Files

You can monitor multiple files simultaneously.

Example:

tail -f logfile1.log logfile2.log

The output will display entries from both files.

If you frequently monitor multiple logs, tools like multitail provide a more advanced interface with split views and color highlighting.

---

How to Use Tail Ubuntu in Linux for Log Debugging

A common workflow for debugging services looks like this:

1. Start monitoring the log
2. Trigger the application action
3. observe new entries

Example:

tail -f /var/log/apache2/error.log

Now perform an action on your website. Any errors will appear instantly in the terminal.

This technique is widely used when diagnosing:

• web server errors
• authentication problems
• service crashes
• permission issues

---

Showing Lines Starting From a Specific Position

The + syntax lets you start output from a specific line.

Example:

tail -n +50 file.txt

This displays the file starting from line 50 onward.

This is useful when you want to skip earlier content and focus on newer entries.

---

Watching File Changes Even After Rotation

Log rotation tools often replace log files automatically.

In such cases, tail -f might stop following the file.

The better option is:

tail -F logfile.log

The -F option automatically reconnects if the file is rotated or recreated.

This is extremely useful for long-running monitoring sessions.

---

Combining Tail With Other Commands

The real power of Linux comes from combining commands.

Filter log entries

tail -f logfile.log | grep error

This displays only lines containing the word error.

---

Monitor warnings

tail -f logfile.log | grep warning

---

Count new lines

tail -f logfile.log | wc -l

This counts incoming lines.

---

Viewing Logs With Line Limits and Follow Mode

You can combine options for more control.

Example:

tail -n 50 -f logfile.log

This command:

• Displays the last 50 lines
• Continues monitoring the file afterward

This is one of the most commonly used commands in system administration.

---

Practical Tail Command Examples

View the last lines of a configuration file

tail /etc/passwd

---

Monitor a web server log

tail -f /var/log/nginx/error.log

---

Inspect the latest kernel messages

tail -n 50 /var/log/kern.log

---

Follow a file and filter results

tail -f application.log | grep failed

---

Tail vs Head Command

The tail command has a complementary utility called head.

• head shows the beginning of a file
• tail shows the end

Example:

head file.txt

vs

tail file.txt

Together, these commands help quickly inspect large files without opening them in a text editor.

---

When to Use Tail Instead of Vim or Less

Although editors like vim are powerful, they are not always the best choice for log monitoring.

Use tail when you need:

• real-time updates
• minimal resource usage
• fast log inspection
• automation in scripts

Use vim when you need to:

• modify files
• perform complex searches
• edit configurations

Often administrators will first inspect logs using tail, then switch to vim for deeper analysis.

---

Conclusion

The Linux tail command is one of the simplest yet most powerful tools available in the terminal. Whether you’re monitoring logs, debugging services, or analyzing system activity, tail allows you to quickly access the most relevant part of a file.

From basic commands like displaying the last lines of a file to advanced techniques such as real-time log monitoring with tail -f, this utility remains a core part of every Linux administrator’s toolkit.

Combined with other commands and utilities, tail becomes even more powerful, enabling efficient troubleshooting and system monitoring directly from the command line.

Mastering the tail command will significantly improve how you analyze logs, track system events, and manage Linux servers in real-world environments.