tail -f for live log monitoring in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What does tail -f /var/log/syslog do?

You run the command tail -f /var/log/syslog in a terminal. What will you see?

Linux CLI

tail -f /var/log/syslog

A It shows the last 10 lines of the syslog file and then waits, showing new lines as they are added.

B It deletes the syslog file and creates a new empty one.

C It shows the entire syslog file from the beginning and then exits immediately.

D It copies the syslog file to a backup location.

💡 Hint

Think about what -f means in tail.

The -f option in tail means 'follow'. It shows the last part of the file and keeps the terminal open to display new lines as they are added, useful for live monitoring.

💻 Command Output

intermediate

What happens if you run tail -f /var/log/syslog and the file is deleted?

You start tail -f /var/log/syslog. While it is running, the syslog file is deleted by another process. What will tail do?

Linux CLI

tail -f /var/log/syslog

A It automatically switches to another log file.

B It immediately stops and exits with an error.

C It shows an error and stops following the file but stays open.

D It continues to show new lines if the file is recreated with the same name.

💡 Hint

Consider how tail -f tracks files by inode, not just name.

tail -f follows the file descriptor. If the file is deleted but recreated with the same name, tail will continue to follow the new file if it detects it.

❓ Configuration

advanced

How to limit tail -f to show only lines containing 'error' live?

You want to monitor a log file live but only see lines that contain the word 'error'. Which command will do this?

A tail -f /var/log/syslog | grep -v 'error'

B tail -f /var/log/syslog | grep 'error' -m 1

C tail -f /var/log/syslog | grep --line-buffered 'error'

D tail -f /var/log/syslog | grep 'error' --no-buffer

💡 Hint

Think about how to keep grep showing matches as they appear.

The --line-buffered option makes grep output lines as soon as they match, which is necessary when piping from tail -f for live filtering.

❓ Troubleshoot

advanced

Why does tail -f stop showing new lines after log rotation?

You use tail -f /var/log/app.log to watch a log. After log rotation, no new lines appear. Why?

A Because <code>tail -f</code> is still following the old file descriptor which no longer receives new data.

B Because <code>tail</code> does not support files larger than 1GB.

C Because the terminal lost connection to the server.

D Because the log file was deleted and <code>tail</code> automatically exits.

💡 Hint

Think about how log rotation works and how tail -f tracks files.

Log rotation renames or moves the current log file and creates a new one. tail -f keeps following the old file descriptor, so it misses new lines in the new file.

✅ Best Practice

expert

Which tool is best for live log monitoring with automatic handling of log rotation?

You want to monitor logs live and ensure the tool continues showing new lines even after log rotation. Which tool is best suited?

A less

B multitail

C cat

D tail -f

💡 Hint

Consider tools designed for advanced log monitoring beyond basic tail.

multitail can follow multiple files and handles log rotation gracefully, unlike basic tail -f.