Display the Last Lines of a Text File on Raspberry Pi with tail

Learn how to use the Raspberry Pi tail command to display the last lines of text files, inspect logs, follow new entries, and troubleshoot permissions and systemd journal differences.

The Linux tail command displays the ending portion of a text file. It is useful when you need to see the most recent notes in a file or investigate recent activity in a Raspberry Pi log.

By default, tail prints the final 10 lines to standard output, which is normally your terminal. A line is a text record ending with a newline character.

Unlike cat, which can display an entire file, tail shows only the end. Unlike head, which shows the beginning, tail shows the most recent or final lines.

Basic tail syntax

The general command structure is:

tail [options] FILE

For example, create or use a text file named notes.txt in the current directory and display its final 10 lines:

tail notes.txt

A file path can be relative, such as notes.txt or documents/notes.txt, or absolute, such as /home/pi/documents/notes.txt. A relative path starts from the directory shown in your terminal prompt; an absolute path starts at the root directory, written as /.

For background on navigating files and directories, see Raspberry Pi file management and using the terminal in Raspberry Pi OS.

Display a chosen number of ending lines

Use the -n option to choose how many final lines tail prints:

tail -n NUMBER FILE

For example, display the final five lines:

tail -n 5 notes.txt

Display the final 25 lines:

tail -n 25 notes.txt

-n 20 means “print the last 20 lines.” It does not mean “print line number 20.” If the file contains fewer lines than requested, tail prints all available lines.

Common tail options

Option	Purpose	Example
`-n NUMBER`	Display a specified number of ending lines.	`tail -n 25 notes.txt`
`-f`	Continue printing lines appended to the file.	`tail -f notes.txt`
`-n NUMBER -f`	Begin with a chosen number of ending lines and then follow new additions.	`tail -n 20 -f notes.txt`

Use tail to inspect Raspberry Pi logs

A log file contains chronological records of operating-system, application, or service activity. The end of a log normally contains its newest events, so tail gives you a quick view of what happened most recently.

On systems where a traditional logging service writes the file, you might inspect the newest entries in /var/log/syslog with:

sudo tail -n 20 /var/log/syslog

Use sudo only if a normal read is denied. It runs a permitted command with elevated privileges. You generally do not need sudo for a personal file such as notes.txt.

Recent log entries can help you investigate service failures, startup and shutdown activity, authentication messages, and network-related events. Read the relevant logs before changing system configuration; the messages may identify the problem without requiring an unnecessary change.

Log locations and services differ between Raspberry Pi OS releases and individual configurations. Some systems write traditional files below /var/log, often through rsyslog or another logging service. Other systemd-based installations store relevant events in the systemd journal, which is systemd’s log collection system, instead of a traditional file such as /var/log/messages.

Where to look for recent Raspberry Pi OS events

Logging source	When it is available	How to view recent events
Traditional files under `/var/log`	Available when a logging service writes the relevant file.	Use `tail` or `tail -f`.
systemd journal	Available on systemd-based installations.	Use `journalctl -n` or `journalctl -f`.

Follow new log entries with tail -f

The -f option means “follow.” It keeps tail running and prints new lines when they are appended to the file:

sudo tail -f /var/log/syslog

This is useful when troubleshooting a problem. Start the command, then reproduce the problem or start or restart the service in another terminal. Watch for newly printed messages that correspond to your action.

To begin with the latest 20 lines and then continue monitoring new entries, combine -n and -f:

sudo tail -n 20 -f /var/log/syslog

Press Ctrl+C to interrupt the foreground command and stop follow mode. tail -f is primarily intended for files that continue to receive appended data. If no new record is written, the terminal may appear idle while the command waits.

Follow systemd journal events with journalctl

If the expected file does not exist or does not contain the events you need, use journalctl, the command-line tool for querying and following the systemd journal.

Display the most recent 20 journal entries:

sudo journalctl -n 20

Follow new journal entries in real time:

sudo journalctl -f

To view the latest 20 messages for a particular service, such as the SSH service:

sudo journalctl -u ssh -n 20

Use the logging source appropriate to the service being investigated. A service may write to a traditional file, the journal, or its own application log.

Interpret tail output

Each displayed line is one record from the file. In a log, a record often includes a timestamp, host name, process or service name, and message. For example, a line might indicate when a service started or why an authentication attempt failed.

The default 10-line view may omit the earlier context needed to understand an error. Increase the line count when an event looks incomplete:

sudo tail -n 50 /var/log/syslog

You can also inspect a service-specific log or query the journal for that service. The last line is not always the cause of a problem; related messages immediately before it may explain what happened.

Troubleshooting tail commands

“No such file or directory” for a log

The Raspberry Pi OS installation may use a different file name, may not have a traditional syslog service configured, or may store the relevant messages in the systemd journal.

Check which files are available under /var/log.
Use sudo journalctl -n 20 to inspect recent journal entries.
Choose the logging source used by the service you are investigating.

Permission denied

A protected system log may be readable only by root or by a privileged group. If reading the file is appropriate, add sudo to the read-only command:

sudo tail -n 20 /var/log/syslog

Avoid using sudo for ordinary personal text files. Elevated privileges are unnecessary unless the file permissions require them.

tail -f appears to do nothing

No new lines may be arriving, the wrong file may be watched, or the service may write to the journal instead of that file.

Generate or reproduce the event you are investigating.
Confirm the file path and logging destination.
Try sudo journalctl -f when the service uses the systemd journal.

The needed error is not visible

The default 10-line view may be too short, or the error may have occurred earlier. Increase the count with -n, then check the relevant service-specific log or query the journal for that unit.

Follow mode stops after log rotation

Log rotation can rename the current file and create a replacement. A basic tail -f process may continue watching the old file and miss entries written to the replacement.

Restart the tail command after rotation.
For advanced file monitoring, investigate tail’s retry-oriented follow options.
For journal-based logs, prefer journalctl -f.

Quick reference

# Last 10 lines of a file
tail notes.txt

# Last 25 lines
tail -n 25 notes.txt

# Follow a traditional log file
sudo tail -f /var/log/syslog

# Last 20 systemd journal entries
sudo journalctl -n 20

# Follow systemd journal entries
sudo journalctl -f

Exam note: Remember the distinction between tail -n NUMBER, which selects ending lines, and tail -f, which waits for and displays lines appended later. Press Ctrl+C to stop a running follow command.

For related command-line practice, see useful Raspberry Pi terminal commands, searching text strings within files, and listing running processes.