How to Look at the End of a File: tail (Unix Power Tools, 3rd Edition)

12.8. How to Look at the End of a File: tail

Let's say that you want to look at the end of some large file. For example, you've just sent some mail and want to find out whether it was handled correctly. But when you look at your mail logs, you find out that the log file is 30 or 40 KB long, and you don't care about the whole thing -- you certainly don't want to page through it until you get to the end. How do you handle this?

The tail command is just what you need in this situation. tail reads its input and discards everything except for the last ten lines (by default). Therefore, if you're pretty sure that the information you want is at the end of the file, you can use tail to get rid of the junk that you don't want. To see just the end of that mail log (in this case, qmail's log):

% tail /var/log/maillog
Feb 19 10:58:45 yyy qmail: 1014141525.474209 delivery 6039: success: did_0+0+1/
Feb 19 10:58:45 yyy qmail: 1014141525.491370 status: local 0/10 remote 0/20
Feb 19 10:58:45 yyy qmail: 1014141525.492211 end msg 111214
Feb 19 11:11:15 yyy qmail: 1014142275.469000 new msg 111214
Feb 19 11:11:15 yyy qmail: 1014142275.469631 info msg 111214: bytes 281 from
<xxx@yyy.zyzzy.com> qp 51342 uid 1000
Feb 19 11:11:15 yyy qmail: 1014142275.562074 starting delivery 6040: msg 111214
to remote xyz@frob.com
Feb 19 11:11:15 yyy qmail: 1014142275.562630 status: local 0/10 remote 1/20
Feb 19 11:11:30 yyy qmail: 1014142290.110546 delivery 6040: success:
64.71.166.115_accepted_message./Remote_host_said:_250_Ok:_queued_as_C0EC73E84D/
Feb 19 11:11:30 yyy qmail: 1014142290.127763 status: local 0/10 remote 0/20
Feb 19 11:11:30 yyy qmail: 1014142290.128381 end msg 111214

For another common example, to see the latest entries from the BSD or Linux kernel ring buffer:

% dmesg | tail
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
IPsec: Initialized Security Association Processing.
ad0: 19569MB <ST320430A> [39761/16/63] at ata0-master UDMA66
afd0: 239MB <IOMEGA ZIP 250 ATAPI> [239/64/32] at ata0-slave using PIO3
acd0: CDROM <ATAPI CDROM> at ata1-master using PIO4
Mounting root from ufs:/dev/ad0s1a
pid 50882 (fetch), uid 0: exited on signal 10 (core dumped)
pid 88041 (smbd), uid 1000 on /usr: file system full

This will give you the last ten lines from the dmesg command. If you need more or less than ten lines, look at Section 12.9.

Althought the GNU version is better behaved, some older versions of tail accept one (and only one!) filename:

% tail somefile

There are many other situations in which tail is useful: I've used it to make sure that a job that produces a big output file has finished correctly, to remind me what the last piece of mail in my mailbox was about, and so on. You'll find tail important whenever you're interested only in the end of something.

-- ML