The tail command in Linux: display the last lines of a file

Introduction

In the world of system administration and software development, one of the most useful tools we find in the Linux terminal is the tail command. Its main function is to display the last lines of a file, which is indispensable when we need to review logs, debug scripts, or simply monitor the output of processes that continuously generate information. Unlike head, which focuses on the beginning of the file, tail allows us to focus on the most recent, saving us time and avoiding the burden of reading the entire content when the file is large.

Basic Syntax

The simplest way to use tail is:

tail [options] filename

If no option is indicated, the command assumes by default to show the last 10 lines of the specified file. This default behavior means that, in many cases, it is enough to write tail /var/log/syslog to quickly get a glimpse of what has happened on the system recently.

Most Used Options

• -n N: allows specifying the exact number of lines to view. For example, tail -n 20 archivo.log shows the 20 last lines.
• -f (follow): makes tail keep the output open and continue showing new lines as they are added to the file. It is ideal for monitoring logs in real time.
• -F: similar to -f, but also retries reading the file if it is rotated or deleted and then recreated, making it more robust in log rotation environments.
• -c N: instead of lines, shows the last N bytes of the file. Useful when working with binary data or when an exact-size fragment is needed.
• --retry: combines with -f to keep trying to read the file even if it is initially unavailable, waiting until it appears.

Practical Examples

Imagine we administer a web server and want to review the latest entries in the access log file:

tail -n 50 /var/log/apache2/access.log

This command will show the 50 most recent lines, allowing us to see which requests have been served in the last minute or two, depending on traffic.

To follow the error log as it is produced, we can use:

tail -f /var/log/apache2/error.log

The terminal will wait and each new line written to the error file will appear immediately, facilitating real‑time problem detection.

If we need to inspect the end of a binary file, for example a corrupted image, and we want to see the last 100 bytes:

tail -c 100 imagen.jpg

This will dump those bytes to standard output, often mixed with non‑printable characters, but we can pipe them to hexdump or od for a more detailed analysis.

In case the log file is rotated while we are monitoring it, the -F option is very useful:

tail -F /var/log/syslog

Thus, even if the system creates a new syslog and deletes the old one, tail will continue showing the new entries without needing to restart the command.

This post is also available in ESPAÑOL.