Display the Last Lines of a Text File in Linux with tail

Learn how to use Linux tail to display the final lines of text files, choose a line count, and monitor new log entries with follow mode.

The tail command displays the ending portion of one or more files. It is especially useful for reviewing the newest entries in a log file or another append-only text file.

A log file records events, status messages, errors, or activity from an operating system or application. Because new entries are commonly added at the end, tail provides a quick way to inspect recent activity without reading the entire file.

Unless you redirect or pipe its output, tail writes to standard output, which normally means your terminal.

Basic tail syntax and default behavior

By default, tail prints the final 10 lines of a file:

tail FILE

For example, this command displays the last 10 lines of notes.txt:

tail notes.txt

A line is a text record generally separated from the next record by a newline character. The command therefore counts newline-separated records when selecting the ending lines.

You can also inspect a system log, such as:

tail /var/log/messages

This prints the last 10 entries when that file exists and your account can read it. Log locations vary by Linux distribution and by application; some systems use different files or a centralized logging service.

Display a specified number of final lines

Use the -n option to choose how many ending lines to print. The readable standard form is:

tail -n NUMBER FILE

To print exactly the final five lines of notes.txt:

tail -n 5 notes.txt

The compact form -n5 is also commonly accepted:

tail -n5 notes.txt

Prefer -n 5 in scripts and examples because the separated number is easier to read.

Follow a file as it grows

The -f option enables follow mode. In this mode, tail remains running and prints lines appended after the command starts. Follow mode is useful for watching application activity, troubleshooting a service, or monitoring a live log.

tail -f /var/log/messages

The command first shows the current final 10 lines, then waits for new entries and prints them as they are added. Press Ctrl+C to stop follow mode and return to the shell.

Combine -n and -f when you want a defined amount of existing context before monitoring new entries:

tail -n 5 -f application.log

This displays the last five existing lines of application.log, then prints later appended entries as they arrive.

Common tail options

Practical examples

View the most recent entries in a text file

tail notes.txt

Expected result: the final 10 lines of notes.txt are printed to the terminal.

View the final lines of a system log

tail /var/log/messages

Expected result: the last 10 entries from the specified log are printed if the path exists and is readable on your system.

View exactly five final lines

tail -n 5 notes.txt

Expected result: only the last five lines of notes.txt are printed.

Watch a log for new messages

tail -f /var/log/messages

Expected result: the current ending lines appear first, followed by new lines added to the log until you press Ctrl+C.

Start with five lines and continue monitoring

tail -n 5 -f application.log

Expected result: five existing lines appear first, followed by later appended entries in real time.

Safe and correct use

• Use text-oriented files. tail is intended for readable text. Its output may be confusing or unhelpful for binary files.
• Check permissions. Protected logs may require an account with read access or, when authorized, an appropriate privilege mechanism.
• Check the path. An absent or inaccessible file produces an error instead of the expected file contents.
• Confirm the log location. The correct path depends on the Linux distribution, logging configuration, and application.

Troubleshooting tail

File does not exist

If tail reports that a file does not exist, the filename or directory may be incorrect, or the expected log location may differ on your system.

Verify the path and filename, then locate the applicable log file for the current distribution or application. Relative paths are interpreted from the current working directory, while absolute paths begin at the filesystem root.

Permission denied

A permission error means your current user cannot read the file. Use an account with appropriate access or, when authorized, run the command through the necessary privilege mechanism. Do not grant broader permissions than required just to inspect a log.

Follow mode shows no activity

No output after the initial lines does not necessarily indicate a problem. The file may simply have no new entries yet. It is also possible that you are monitoring the wrong file or that the application writes to another location.

Generate or wait for relevant activity, confirm the log path, and verify which file the service actually writes.

Log rotation stops updates

Many logging systems periodically rotate logs by renaming the current file and creating a replacement. A process following the original file may not automatically display entries written to the replacement.

When this happens, use a follow behavior designed to track a filename across replacement, if supported by the tail implementation and operating environment. Also confirm that the application and logging system are writing to the file you expect.

Related command-line tasks

Once you can inspect the end of a file with tail, you can combine it with other command-line tools. For example, grep can search log output, less can page through large files, and shell redirection or pipelines can send standard output to another destination. The complementary head command displays the beginning of a file.

For this lesson's complete reference, see display the last lines of a text file with tail.