tail — view the end of logs

💬 "tail command"

tail shows the end of a file. Logs accumulate with the latest content at the bottom, so this is the starting point for incident response.

Add -f to follow content appended to the file in real time.

• Concept: prints the last N lines of a file. The default is 10 lines.
• Left argument: use -n followed by a number to specify how many lines to view.
• Right argument: the target file path.
• -f: changes behavior to real-time following (tail -f).

Commonly used options

3 essential command combinations

• tail -n 100 /var/log/nginx/access.log — check the last 100 lines
• tail -F /var/log/nginx/error.log — track errors in real time while enduring rotation
• tail -n 50 /var/log/app.log | grep -i error — extract only errors from recent logs

💬 "Show me a safe example to use in production without causing incidents"

Here are common situations on a live production server, organized in order.

Step 1 · Check recent errors

View the last 100 lines of the log.

tail -n 100 /var/log/nginx/error.log

Step 2 · Follow in real time

When reproducing the issue, follow with -F.

tail -F /var/log/nginx/error.log

Step 3 · Filter by pattern

Narrow down the cause by filtering only specific keywords.

tail -F /var/log/app.log | grep -i 'timeout\|exception'

How it is used in practice

1. Responding to a surge in 502 errors

Situation — 502 errors suddenly increase and you need to find the cause.

tail -F /var/log/nginx/error.log

Result — upstream connection failure messages appear in real time, confirming that it is a backend problem.

Point — it is standard to look at the status codes in access.log and the causes in error.log together.

2. Checking for errors immediately after deployment

Situation — you want to immediately check whether the app starts after deployment.

tail -n 200 /var/log/app/app.log | grep -i -E 'error|exception|fatal'

Result — you can check within seconds whether there are exceptions caused by the deployment.

Point — if you add this check to your deployment script, it can also be used as a criterion for automatic rollback.

Things to watch out for

• -f does not exit. After checking, end it with Ctrl+C.
• -f breaks during log rotation. Use -F for production logs.
• tail -f does not reopen the file, so after rotation it may follow the old inode (use -F to solve this).

Actual execution screen

This is the result of checking recent error logs (backend connection failure).

!Result of running the tail command: recent error logs

Actual production server

Source (HTML): https://games.aidebatehub.com/programs/linux/logs/tail.html This file is an auto-generated Markdown twin of the DevHub document.