The Linux Mail command: show the latest lines of a file

Introduction

In the world of system management and software development, one of the most useful tools we find in the Linux terminal is the commandtail. Its main function is to show the last lines of a file, which is essential when we need to review logs, debug scripts or simply monitor the output of processes that are continuously generating information. Unlikehead, which focuses on the file start,tailIt allows us to focus on the most recent, saving us time and avoiding the burden of reading all the content when the file is large.

Basic syntax

The simplest way to usetailis:

tail [opciones] nombre_del_archivo

If no option is indicated, the command assumes by default to show the last 10 lines of the specified file. This default behavior means that, in many cases, writing is enough.tail /var/log/syslogto quickly get a look at what has happened in the system recently.

Most commonly used options

• -n N: allows to specify the exact number of lines you want to see. For example,tail -n 20 archivo.logshows the last 20 lines.
• -f(follow): makestailkeep the output open and continue to show new lines as they are added to the file. It is ideal for monitoring real-time login.
• - F: similar to-f, pero además vuelve a intentar leer el archivo si este es rotado o eliminado y luego recreado, lo que lo hace más robusto en entornos de rotación de logs.
• -c N: instead of lines, show the last N bytes of the file. Useful when working with binary data or when you need an exact fragment of size.
• --reby: is combined with-fto continue trying to read the file even if it is initially not available, waiting until it appears.

Practical examples

Imagine we manage a web server and want to review the latest entries in the access file:

tail -n 50 /var/log/apache2/access.log

This command will show us the latest 50 lines, allowing us to see which requests have been met in the last minute or two, depending on traffic.

To follow the error record while it is produced, we can use:

tail -f /var/log/apache2/error.log

The terminal will be on hold and every new line that is written in the error file will appear immediately, facilitating real-time problem detection.

If we need to inspect the end of a binary file, for example a corrupt image, and we want to see the last 100 bytes:

tail -c 100 imagen.jpg

This will turn those bytes into the standard output, often mixed with non-printable characters, but we can redirect them tohexdumporodfor a more detailed analysis.

In case the log file is rolled while we are monitoring it, the option-Fis very useful:

tail -F /var/log/syslog

So, even if the system creates a newsyslogand removes the old one,tailwill continue to show new entries without the need to restart the command.

Combinetailwith other commands

The real power oftailis revealed when we chain it with other Linux utilities. For example, to filter only lines containing the word "error" in the last 100 lines of a log:

tail -n 100 /var/log/app.log | grep -i error

Similarly, we can count how many times a certain pattern appears on those lines:

tail -n 200 /var/log/auth.log | grep -c "Failed password"

Or to order the last 30 lines alphabetically (although rare, it serves as an example):

tail -n 30 archivo.txt | sort

Another common use is to combinetail -fwithawkto extract specific fields from a log in CSV format or separated by spaces:

tail -f /var/log/access.log | awk '{print $1, $7}'

This will show the client's IP address and the requested URL in real time.

Tips and tricks

• When working with very large files, use-nwith a reasonable number prevents the terminal from filling with unnecessary output.
• If you only need the last byte or the last few bytes,-cis more efficient than reading lines and then cutting.
• In scripts, it is good practice to check the output code oftail(e.g.$?) to detect whether the file did not exist or did not have permits.
• To prevent the output oftail -fis mixed with other messages from the terminal, you can redirect it to a file or to a display process likelesswith the option-F.
• Remember thattaildoes not modify the file; it is read-only, so it is safe to use it in production environments.

Conclusion

The commandtailis an essential tool for anyone working with Linux, be it system manager, developer or command line enthusiast. Its simplicity, combined with the power of its options and the ease of combining it with other utilities, makes it a quick and effective solution to inspect the end of files, monitor real-time logs and extract relevant information from large data volumes. DomaintailIt will allow you to save time, diagnose problems more agily and maintain better control over what happens in your system.