tail -f for live log monitoring in Linux CLI - Commands & Configuration

Introduction

Sometimes you want to watch a file as it changes in real time, like when checking logs to see what is happening right now. The tail -f command lets you do this by showing the end of a file and updating the display as new lines are added.

When you want to see new error messages as they appear in a server log file.

When you are debugging a program and want to watch its output live.

When monitoring access logs to track user activity on a website in real time.

When you want to follow the progress of a long-running script or process by watching its log.

When you need to confirm that a service is starting correctly by watching its startup logs.

Commands

This command shows the last 10 lines of the syslog file and keeps the terminal open to display new lines as they are added. It helps you watch system messages live.

Terminal

tail -f /var/log/syslog

Expected Output

Apr 27 10:00:01 server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Apr 27 10:00:02 server systemd[1]: Started Daily apt download activities.

Apr 27 10:01:15 server kernel: [12345.678901] usb 1-1: new high-speed USB device number 4 using xhci_hcd

→

-f - Follow the file as it grows, showing new lines in real time.

This command shows the last 20 lines of the syslog file and then follows it live. The -n 20 flag changes how many lines you see at the start.

Terminal

tail -n 20 -f /var/log/syslog

Expected Output

Apr 27 09:59:50 server systemd[1]: Starting Daily apt download activities...

Apr 27 10:00:01 server CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Apr 27 10:00:02 server systemd[1]: Started Daily apt download activities.

Apr 27 10:01:15 server kernel: [12345.678901] usb 1-1: new high-speed USB device number 4 using xhci_hcd

→

-n - Show a specific number of lines from the end of the file before following.

→

-f - Follow the file as it grows.

This command stops the tail -f process by killing it. Use this to exit live monitoring when you are done.

Terminal

pkill -f 'tail -f /var/log/syslog'

Expected Output

No output (command runs silently)

→

-f - Match the full command line when searching for the process to kill.

Key Concept

If you remember nothing else from this pattern, remember: tail -f lets you watch a file live as it grows, showing new lines immediately.

Common Mistakes

Running tail without -f when wanting live updates

Without -f, tail only shows the last lines once and then exits, so you miss new lines added later.

Always add the -f flag to keep tail running and showing new lines as they appear.

Not stopping tail -f properly and closing the terminal abruptly

This can leave processes running in the background or cause confusion.

Use Ctrl+C to stop tail -f cleanly or kill the process with pkill if needed.

Summary

Use tail -f filename to watch the end of a file live as it grows.

Add -n number to show more lines at the start before following.

Stop live monitoring with Ctrl+C or by killing the tail process.