|
Softpanorama |
May the source be with you, but remember the KISS principle ;-)
|
| News | Syntax | Recommended Links | Sorting algorithms | Recommended Papers | Rcut | Reference | Pipes |
| Perl re-implemenations | uniq | sort | tr | AWK | Tips | Humor | Etc |
Unix tail tail command is a standard way of watching log files in Unix. By default the last 10 lines are displayed. tail has a special command line option -f (follow) that allows a file to be monitored. Instead of displaying the last few lines and exiting, tail displays the lines and then continue to monitors the file. As new lines are added tail updates the display. This is particularly useful for monitoring log files. For example:
tail -f /var/adm/messages
Using options the number of lines printed and the printing units (lines, blocks or bytes) may be changed. The syntax is:
tail [-f | -r] [-b number | -c number | -n number | -number | + number] [file ...]
The tail utility displays the contents of file or, by default, its standard input, to the standard output. The display begins at a byte, line, or 512-byte block location in the input. Default is lines but bytes count is possible
Typically tail is use with "minus" operation which means that the lines are counted from the end of the file. But in GNU version of tail this is actually only one of two possibilities and tail can count lines from the beginning too. Few people know about this. Still it is important to understand that:
$ tail +2 lines Line 2 Line 3 Line 4 Line 5 ... ... ...
Here a number starting with a plus (+) sign is an offset relative to the top of the file. BTW that means that tail +1 file gives you the entire file, the same as cat. +2 skips the first line, and so on
Other options are used less often include:
If more than a single file is specified, each file is preceded by a header consisting of the string ``==> XXX <=='' where ``XXX'' is the name of the file.
The tail utility exits 0 on success or >0 if an error occurred.
To display the last 500 lines of the file foo:
$ tail -500 foo
Keep /var/log/messages open, displaying to the standard output anything appended to the file:
$ tail -f /var/log/messages
Frequently used variants often can be made into alias, for example:
alias mess='tail -100 /var/log/messages | more'
The tail utility is expected to be a superset of the IEEE Std1003.2-1992 (``POSIX.2'') specification. In particular, the -b and -r options are extensions to that standard.
The historic command line syntax of tail is supported by this implementation. The only difference between this implementation and historic versions of tail, once the command line syntax translation has been done, is that the -b, -c and -n options modify the -r option, i.e., -r -c 4 displays the last 4 characters of the last line of the input, while the historic tail (using the historic syntax -4cr) would ignore the -c option and display the last 4 lines of the input.
A tail command appeared in Version 7 AT&T UNIX.
inotail is a replacement for the 'tail' program found in the base installation of every Linux/UNIX system. It makes use of the inotify infrastructure in recent versions of the Linux kernel to speed up tailing files in the follow mode (the '-f' option). Standard tail polls the file every second by default while inotail listens to special events sent by the kernel through the inotify API to determine whether a file needs to be reread.
Currently inotail is not fully compatible to neither POSIX or GNU tail but might be in the future. (Note: I'm currently working on correct tailing from pipes which would make inotail fully compatible to POSIX tail)
- Linux kernel 2.6.13 or higher with CONFIG_INOTIFY enabled
- Standard C Library (tested with GNU libc but might work with others too)
2007-09-07 - inotail 0.5 released
Released version 0.5 of inotail containing only small fixes. Please refer to the changelog for details.
download
Debian users can find the inotail package in the Debian package archive. inotail is also available in the Ubuntu Universe repository.
#!/usr/bin/perl -w
#
# A Perl implementation of tail for the Perl Power Tools project by
# Thierry Bézecourt <thbz@worldnet.fr>. Includes an implementation
# of Chip Rosenthal's xtail.
#
# Please see the pod documentation at the end of this file.
#
# 99/12/24 : made tail -f work on VMS (thanks to Joe Kazimierczyk)
# fixed a bug when tailing small files
# 99/11/19 : important performance improvement for tail on big files
# (now usable for any file size)
# 99/03/07 : implemented xtail in the -f option
# 99/03/03 : fixed the -f option which was completely broken
# 99/03/02 : first version
This is the homepage for the Perl Power Tools implementation of the standard tail command.
Current Perl implementations are:Baseline documentation:
- Here is a version and its manpage by Thierry Bezecourt (1999-03-07).
Supporting files: readme.thierry, mktest.thierry.
#!/usr/bin/perl
use File::Tail;
$file=File::Tail->new( $file_to_tail );
while (defined($line=$file->read))
{
print $line;
}
The output from other commands can be piped (i.e., sent) to tail to use as its input. For example, the following sends the output from the ls command (which by default lists the names of the files and directories in the current directory) to tail, which, in turn, prints the final ten lines of the output that it receives from ls to the monitor screen:
ls | tailThis output could easily be redirected, for example to a file named last_filenames as follows:
ls | tail >> last_filenamesIt could also be piped to one or more filters for additional processing. For example, the sort filter could be used with its -r option to sort the output in reverse alphabetic order prior to writing to a file:
ls | tail | sort -r >> last_filenamesThe -q (i.e., quiet) option causes tail to not print the file name before each set of lines and to eliminate the vertical space between each set of lines when there are multiple input sources. The -v (i.e., verbose) option causes tail to print the file name even if there is just a single input file.
Tail could be viewed as a counterpart of the head command, which always starts reading from the beginning of files and which can continue until any specified distance from the beginning. However, there are a few differences. Perhaps the most useful of these is that tail is somewhat more flexible in that, in addition to being able to start reading any specified distance from the end of a file, it can also start at any specified distance from the beginning of a file.
Tail can be instructed to begin printing from some number of lines or bytes from the start of a file by preceding the number with a plus sign instead of a minus sign. For example, the following would print each of the designated files to the display monitor beginning with the seventh line and until the end:
tail +7 aardvark anteater armadilloThe c option could be used to tell tail to print each of the designated files beginning with the seventh byte instead of the seventh line:
tail +7c aardvark anteater armadillo
inotail is a replacement for the 'tail' program found in the base installation of every Linux/Unix system. It makes use of the inotify infrastructure in recent versions of the Linux kernel to speed up tailing files in the follow mode (the '-f' option). Standard tail polls the file every second by default, while inotail listens to special events sent by the kernel through the inotify API to determine whether a file needs to be reread.
Similarly, tail shows the last few lines (again, 10 by default) of a file or stream:
% ypcat passwd | tail cal:*:1492:160:Calvin Hobbes:/home/cal:/bin/csh adams:*:116:100:John Adams:/home/pkduck-b/adams:/bin/csh gary:*:1177:20:Gary North:/home/pkduck-e/gary:/bin/csh quincy:*:1092:20:Quincy Lizard:/home/triton-a/quincy:/bin/csh talbot:*:1679:75:Bob Talbot:/home/enterprise-a/cadmec/talbot:/bin/csh help:*:1034:31:Help Desk:/home/lewey-a/processor/help:/bin/csh glen:*:1543:20:Glen Carpenter:/home/pkduck-e/glen:/bin/csh brent:*:1799:706:Brent Adams:/home/dogbert-a/brent:/bin/csh lou:*:1701:30:Lou Grant:/home/pkduck-h/lou:/bin/csh adam:*:1124:317:Adam Baker:/home/lewey-d/adam:/bin/csh
As with head, you can specify the number of lines from the end of the file at which to start display by prefacing the number with a hyphen ("-"). You can also specify the location as a number of lines from the beginning by prefacing the number with a plus sign ("+"):
% wc -l /usr/man/man1/tail.1 143 /usr/man/man1/tail.1 % tail +141 /usr/man/man1/tail.1 .LP Various kinds of anomalous behavior may happen with character special files. % tail -3 /usr/man/man1/tail.1 .LP Various kinds of anomalous behavior may happen with character special files.
Since the tail man page has 143 lines, "tail +141" is equivalent to "tail -3" in this case.Unlike with head, tail will operate on units other than lines. By adding the character "b" to the number, you can display the last blocks, and with "c" the last characters:
% tail -10c /usr/man/man1/tail.1 al files.
Don't forget about newlines.tail also has the unexpected function that it allows you to reverse the lines spewed. By default, with just the "-r" flag, tail displays the whole file in reverse order by line:
% cat > foo << END this is a test END % tail -r foo test a is this
A number of lines to reverse can be included, but it cannot be relative to the beginning of the file, only the end. ("+" acts just like "-")tail also has the wildly useful feature that it can be told to wait around for further input to a file rather than stopping when it gets to the end. This is especially useful to monitor the progress of a process whose output you have redirected to a file:
% clearmake >& Transcript & [1] 12688 % tail -f Transcript[the output from the clearmake will be displayed here as it arrives in "Transcript"]
When called in this manner, the tail will continue to read lines from the file and wait for more until you kill it ("^C" is handy here ;-) even after the clearmake has completed and there is no longer output being appended to the file.One final difference between head and tail: while head will operate on multiple files, tail will not, so don't expect something like "tail foo bar biff" to show anything more than the last 10 lines of "foo".
MultiTail
Most admins are already familiar with using tail -f logfile to watch system, application, and error logs when they're troubleshooting. However, the tail utility only follows one file at a time. If you need to watch two or more logfiles at the same time, which is fairly common, the MultiTail < http://www.vanheusden.com/multitail/ > utility by Folkert van Heusden is an excellent tool to have handy.
Basically, MultiTail handles two or more files simultaneously, and presents them in a split-screen view that makes it convenient to watch two, three, or more logfiles at the same time. This has come in particularly handy for me when troubleshooting issues with Web sites and mail issues. Technically, one can replicate the MultiTail experience by using GNU Screen to create a split screen environment and using |tail -f /logfile/ |multiple times -- but why? MultiTail makes it simple.
inotail is a replacement for the 'tail' program found in the base installation of every Linux/Unix system. It makes use of the inotify infrastructure in recent versions of the Linux kernel to speed up tailing files in the follow mode (the '-f' option). Standard tail polls the file every second by default, while inotail listens to special events sent by the kernel through the inotify API to determine whether a file needs to be reread.
Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.
Standard disclaimer: The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.
Last modified: August 02, 2008