VMware ESXi and vSphere Cluster Management

Display the Last Lines of a Text File with tail

Learn how to use Linux tail to display recent file and log entries, choose a line count, follow live updates, and troubleshoot permissions and log locations.

The Linux tail command displays the ending portion of a file. It is especially useful when you care about the newest entries in a text file or system log rather than the entire file.

A text file stores readable character-based lines. A log file is a text file or journal record that documents events produced by the operating system or an application.

What tail does

Without options, tail prints the final 10 lines of a file to the terminal. This terminal output is called standard output, the normal stream where command results appear.

tail notes.txt

The command shows the last 10 lines of notes.txt. Reading only the ending lines is often more practical than opening a large file when the recent activity is the important part—for example, when checking what happened most recently in a system log.

Basic tail syntax

The basic form is:

tail FILE

Replace FILE with a relative or absolute path. An absolute path begins at the filesystem root, represented by /.

tail /home/pi/notes.txt

Here, /home/pi/notes.txt identifies one precise file regardless of the directory from which you run the command. The result is printed directly in the terminal.

Prerequisites: You should know how to open a terminal, run a command, read terminal output, and recognize basic paths such as /var/log.

Inspecting recent system log activity

Linux systems record events in logs. These events can include boot and shutdown activity, service starts and failures, network changes, device messages, and errors. Looking at the newest entries helps diagnose a problem soon after it occurs.

A common location for traditional log files is /var/log. On systems where the traditional message log exists, you can inspect its newest entries with:

tail /var/log/messages

This displays the final 10 lines of /var/log/messages. The path is common on some Linux distributions, but it is not guaranteed to exist on every Raspberry Pi OS installation.

Common log-reading choices

Source	When it applies	How to inspect recent entries
Traditional file under `/var/log`	The distribution or application writes events to a regular log file.	`tail /var/log/LOG_FILE`
`/var/log/messages`	The file is present and contains the system messages you need.	`tail /var/log/messages`
systemd journal	The system stores system logs in the journal instead of the expected regular file.	`journalctl -n COUNT`

Choose how many lines to display

The -n option sets the number of ending lines to print. The requested count replaces the default of 10.

tail -n 13 /var/log/messages

This prints the final 13 lines. The clearer separated form is -n NUMBER. An optional compact form places the number directly after the option:

tail -n13 /var/log/messages

Both forms request 13 lines, but the separated form is generally easier to read, especially in scripts and instructional examples.

Option	Purpose	Example
No option	Display the final 10 lines.	`tail notes.txt`
`-n COUNT`	Display a chosen number of final lines.	`tail -n 20 notes.txt`
`-f`	Continue displaying lines appended to the file.	`tail -f app.log`
`-n COUNT -f`	Display a chosen ending section, then continue following updates.	`tail -n 20 -f app.log`

Follow a file as it changes

The -f option means follow. It keeps tail running after the existing ending lines are displayed. When another process appends lines to the file, tail writes those new lines to the terminal.

tail -f /var/log/messages

This is useful for live monitoring. For example, start the command, reproduce a networking or service problem, and watch for new events that might explain it.

You can combine -f with -n to choose how much previous context appears before live monitoring begins:

tail -n 13 -f /var/log/messages

Stop follow mode by pressing Ctrl+C. This interrupts the running command and returns you to the shell prompt.

Permissions and Linux differences

Some logs can be read only by the root user or by members of a particular group. If your account lacks permission, the command may report Permission denied. When appropriate and understood, use sudo to run the command with administrative privileges:

sudo tail /path/to/log

Use elevated access carefully. It is better to inspect ownership and permissions when you have administrative access than to change permissions unnecessarily.

Log names and locations vary between Linux distributions, installed services, and logging configurations. Many modern Raspberry Pi OS systems use systemd journal logging. In that case, a traditional file such as /var/log/messages may be absent, and journalctl is the appropriate alternative.

journalctl -n 13

To follow new systemd journal entries live, use:

journalctl -f

Troubleshooting tail

File does not exist

If tail reports that a file does not exist, check for a mistyped path. You can list likely log files with:

ls /var/log

Check the spelling and capitalization of the path.
Look for the log location used by your distribution or application.
Try journalctl -n COUNT if the system uses the systemd journal instead of a regular file.

Permission denied

The log may be restricted to privileged users or a specific group. Use sudo only when appropriate:

sudo tail -n 20 /path/to/log

If administrative access is available, check the file's ownership and permissions before deciding how to proceed.

No new lines appear with tail -f

Follow mode displays only content appended after the command starts. No new output may mean that no process is writing entries, that the wrong file is being followed, or that log rotation has replaced the file.

Generate or wait for an event that should create a log entry.
Verify the application's active log path.
For a file that may be rotated or replaced, use tail -F when that behavior is needed.

There is not enough previous context

The default is only 10 lines. Increase the count with -n:

tail -n 50 /var/log/messages

Useful command patterns

Show the default ending section: tail notes.txt.
Show a specific number of lines: tail -n 13 /var/log/messages.
Watch a traditional log: tail -f /var/log/messages.
Show context and then watch for updates: tail -n 20 -f /var/log/messages.
Use the systemd journal when no suitable log file exists: journalctl -n 20 or journalctl -f.

Exam-relevant note: Remember the distinction between -n, which controls how many ending lines are printed, and -f, which keeps the command running to display newly appended lines. tail with no option prints 10 lines by default.

For related file inspection, see displaying the last line of a text file.