Monitor Linux Logs in Real Time with Tail

This guide demonstrates how to use the Linux tail command to track and monitor log files as they update in real time. You will learn the primary command flags for live streaming, how to handle log rotation, how to view multiple files simultaneously, and how to filter real-time output using standard Linux utilities.

Basic Real-Time Monitoring with the -f Flag

By default, the tail command prints the last 10 lines of a specified file and exits. To monitor changes continuously, use the -f (follow) option. This tells tail to keep the file open and output new lines as they are appended.

tail -f /var/log/syslog

To stop monitoring at any time, press Ctrl + C.

Handling Log Rotation with the -F Flag

In production environments, services regularly rotate logs using tools like logrotate. When a log rotates, the original file is renamed, and a new empty file is created with the original name. The standard -f flag tracks the file descriptor, meaning it will stop displaying new output once the rotation occurs.

To ensure continuous tracking across rotations, use the -F flag. This flag tracks the file by its filename and automatically retries if the file becomes inaccessible or is recreated.

tail -F /var/log/nginx/access.log

Displaying a Specific Number of Historical Lines

If you need more context before live monitoring begins, combine the -f flag with the -n flag to specify how many existing lines to output initially.

To display the last 50 lines before following new lines:

tail -n 50 -f /var/log/auth.log

Monitoring Multiple Log Files Simultaneously

You can pass multiple file paths to tail to stream more than one log at once. The command will prepend each output block with a header indicating which file generated the logs.

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Filtering Real-Time Output with Grep

You can pipe the real-time stream from tail directly into grep to isolate specific errors, IP addresses, or keywords.

tail -f /var/log/syslog | grep --line-buffered "error"

Using the --line-buffered flag with grep ensures that matching lines are printed to the terminal immediately rather than held in a memory buffer.