Most system administrators know the tail command. By default, it displays the 10 last lines of a file.
The -f option is less known. Besides displaying the last 10 lines of a file, it mainly provides a way to watch what is written into a file in real-time:
# tail -f /var/log/messages Apr 4 20:30:01 vm systemd: Stopping user-0.slice. Apr 4 20:31:35 vm systemd: Created slice user-0.slice. Apr 4 20:31:35 vm systemd: Starting user-0.slice. Apr 4 20:31:35 vm systemd: Started Session 961 of user root. Apr 4 20:31:35 vm systemd-logind: New session 961 of user root. Apr 4 20:31:35 vm systemd: Starting Session 961 of user root. Apr 4 20:31:35 vm dbus[590]: [system] Activating service name='org.freedesktop.problems' (using servicehelper) Apr 4 20:31:35 vm dbus-daemon: dbus[590]: [system] Activating service name='org.freedesktop.problems' (using servicehelper) Apr 4 20:31:35 vm dbus[590]: [system] Successfully activated service 'org.freedesktop.problems' Apr 4 20:31:35 vm dbus-daemon: dbus[590]: [system] Successfully activated service 'org.freedesktop.problems' Apr 4 20:33:53 vm systemd: Started Session 962 of user root. Apr 4 20:33:53 vm systemd-logind: New session 962 of user root. Apr 4 20:33:53 vm systemd: Starting Session 962 of user root. ...
When debugging complicated situations involving several files, the tail command proves to be a invaluable tool. In fact, you can specify several files after the -f option and a header will be displayed each time something is written into a different file:
# tail -f /var/log/messages /var/log/secure ==> /var/log/messages <== Apr 4 20:51:07 vm systemd-logind: Removed session 963. ==> /var/log/secure <== Apr 4 20:51:11 vm sshd[21933]: Accepted password for root from 94.23.44.29 port 47411 ssh2 ==> /var/log/messages <== Apr 4 20:51:11 vm systemd: Started Session 966 of user root. Apr 4 20:51:11 vm systemd-logind: New session 966 of user root. ==> /var/log/secure <== Apr 4 20:51:11 vm sshd[21933]: pam_unix(sshd:session): session opened for user root by (uid=0) ==> /var/log/messages <== Apr 4 20:51:11 vm systemd: Starting Session 966 of user root. ...
For example, OpenStack engineers use this kind of command to debug their configuration on compute nodes:
# tail -f /var/log/{ceilometer,neutron,nova,openvswitch}/*.log /var/log/syslog
When troubleshooting, using the tail command should become a reflex!
Wow, that was interesting. I’ve never imagined that tail -f takes as argument more than 1 log.
I also discovered it recently.
Really interesting !!!