Thursday, November 1, 2007

Log watching using tail or less

Log files typically grow in size, with the latest contents appended to the end of the log. I often need to watch a log file in live action, for error detection.

The command tail -f will display the last 10 lines of a file, and then continuously wait for new lines, and display them as they appear.
$ tail -f /var/log/messages


If you want to see more than ten lines at the outset, specify the new number (say 50 lines) like this:
$ tail -50   -f /var/log/messages


The tail command is fast and simple. But if you want more than just following a file (e.g., scrolling and searching), then less may be the command for you.
$ less /var/log/messages

Press Shift-F. This will take you to the end of the file, and continuously display new contents. In other words, it behaves just like tail -f.

To start less in the tail mode (thanks to Seth Milliken for this tip), execute:
$ less +F /var/log/messages


To scroll backwards, you must first exit the follow mode by pressing Control-c. Then, you can scroll back by pressing b. In fact, all the less commands are available to you once you are in the regular less mode. You can start a search by typing / followed by the string you want to search for.

Happy Log Watching !!!

P.S.
Related articles on tailing files:
Tail multiple files
Two additional ways to tail a log file

9 comments:

Anonymous said...

Do you know of any way to start less in tail mode?

Anonymous said...

Heh. Just figured it out. You can start less in tail mode by using the +F flag, e.g. '$ less +F /var/log/messages'

Peter Leung said...

Thanks, Seth. That was a good tip. I've added the +F flag to the blog entry.

felice rubio said...

congratulations for the blog, please keep it up!

Anonymous said...

$ tail -f -50 /var/log/messages
doesn't work for me.
$ tail -f -n 50 /var/log/messages
does.

Viktor VAD said...

You're my personal Jesus Christ! :)

Fortuner SUV Terbaik said...

thanks for sharing command tail or less.

­ said...

Hi there,
here is another method for all Commandliner´s.

Try this safe alternative to tail
"less -b1024 -B +F /var/log/your-archiv.log"

Best regards, V

Unknown said...

Thanks for this!!