---
title: tail — view the end of logs
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: Essential command for checking logs by viewing only the last lines of a file and following them in real time with -f.
tags: program, server log recording and analysis, tail
---

**💬 "tail command"**

tail shows the **end** of a file. Logs accumulate with the latest content at the bottom, so this is the starting point for incident response.

Add `-f` to follow content appended to the file in real time.

- **Concept**: prints the last N lines of a file. The default is 10 lines.
- **Left argument**: use -n followed by a number to specify how many lines to view.
- **Right argument**: the target file path.
- **-f**: changes behavior to real-time following (tail -f).
## Commonly used options

| Option | Description |
| --- | --- |
| -n <N> | prints the last N lines (-n 100) |
| -f | follows the end of the file in real time |
| -F | also follows rotated files — recommended for production logs |
| -q | omits filename headers when there are multiple files |

## 3 essential command combinations

- `tail -n 100 /var/log/nginx/access.log` — check the last 100 lines
- `tail -F /var/log/nginx/error.log` — track errors in real time while enduring rotation
- `tail -n 50 /var/log/app.log | grep -i error` — extract only errors from recent logs
**💬 "Show me a safe example to use in production without causing incidents"**

Here are common situations on a live production server, organized in order.

### Step 1 · Check recent errors

View the last 100 lines of the log.

```
tail -n 100 /var/log/nginx/error.log
```

### Step 2 · Follow in real time

When reproducing the issue, follow with -F.

```
tail -F /var/log/nginx/error.log
```

### Step 3 · Filter by pattern

Narrow down the cause by filtering only specific keywords.

```
tail -F /var/log/app.log | grep -i 'timeout\|exception'
```

## How it is used in practice

### 1. Responding to a surge in 502 errors

**Situation** — 502 errors suddenly increase and you need to find the cause.

```
tail -F /var/log/nginx/error.log
```

**Result** — upstream connection failure messages appear in real time, confirming that it is a backend problem.

**Point** — it is standard to look at the status codes in access.log and the causes in error.log together.

### 2. Checking for errors immediately after deployment

**Situation** — you want to immediately check whether the app starts after deployment.

```
tail -n 200 /var/log/app/app.log | grep -i -E 'error|exception|fatal'
```

**Result** — you can check within seconds whether there are exceptions caused by the deployment.

**Point** — if you add this check to your deployment script, it can also be used as a criterion for automatic rollback.

## Things to watch out for

- -f does not exit. After checking, end it with Ctrl+C.
- -f breaks during log rotation. Use -F for production logs.
- tail -f does not reopen the file, so after rotation it may follow the old inode (use -F to solve this).
## Actual execution screen

This is the result of checking recent error logs (backend connection failure).

![Result of running the tail command: recent error logs](https://games.aidebatehub.com/assets/tail-demo.png)

Actual production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/logs/tail.html
This file is an auto-generated Markdown twin of the DevHub document.