Textbook of Linux

tail prints the last lines (default 10) of a file, the mirror image of head. Its most famous feature is -f ("follow"), which keeps the file open and streams new lines as they are appended—the canonical way to watch a log file in real time.

tail file.txt                     # last 10 lines
tail -n 50 file.txt               # last 50 lines
tail -f /var/log/syslog           # follow live
tail -F /var/log/syslog           # follow across log rotation
tail -n +100 file                 # from line 100 to end

tail -F (capital F) is usually preferable to -f for long-running sessions because it survives log rotation: when logrotate moves the old file aside and creates a new one, -F reopens the new file.

For structured log viewing, journalctl -f is the systemd equivalent for the journal. tail -f still works on plain text log files and is used everywhere from debugging web applications to watching security logs on a suspect system. Combined with grep (tail -f /var/log/auth.log | grep Failed), it is the simplest possible monitoring tool.