Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know there was a command on Unix that I could use to monitor a file and see changes that are getting written to it. This was quite useful especially for checking log files.

Do you know what it is called?

share|improve this question

9 Answers 9

up vote 84 down vote accepted

Do you mean

tail -f logfile.log

?

(Man page for tail)

share|improve this answer
    
Thanks I think that's the one I was looking for. But does it update in realtime? Can I somehow change the interval if it does not? –  Sebastian Hoitz Apr 30 '09 at 21:05
2  
Yes, it's real time. –  Adam Gibbins Apr 30 '09 at 21:06
8  
Sidenote: If your distribution provides the tailf command, use that in preference to tail -f. tailf is more efficient because it doesn't need to access the watched file if it's not being written to (poll accesses are annoying if you mounted the file system with atime updating.) –  Mihai Limbăşan May 2 '09 at 19:49
5  
At super user I found an answer recommending tail -F instead of -f , too –  Rafa Apr 18 '12 at 11:17
1  
tail -F will follow filenames rather than file objects, which is especially useful in case of log file rotation. –  Amir Ali Akbari Nov 20 '13 at 7:19

You probably meant tail, as per Jon Skeet's answer.

Another useful one is watch; it allows you to run a command periodically and see the output full screen. For example:

watch -n 10 -d ls -l /var/adm/messages

Will run the command ls -l /var/adm/messages every 10 seconds, and highlight the difference in the output between subsequent runs. (Useful for watching how quickly a logfile is growing, for example).

share|improve this answer

Tail is great ... less can also be used start less on the file i.e. less myfile then press F. This has less act as tail.

share|improve this answer
    
+1 Agree "tail is great" –  Chris Ballance Apr 30 '09 at 21:19
2  
less +F myfile will make it too –  rgmarcha Jun 4 '09 at 16:06

I prefer using less +FG1 over tail -f because I find myself needing to search a log file for a specific error or ID. If I need to search for something, I type ^C to stop following the file and ? to start searching backwards.

Key bindings are pretty much the same as in vi. Any command can be initialized on startup using the + option:

+cmd   Causes  the  specified  cmd  to be executed each time a new file is
       examined.  For example, +G causes less to  initially  display  each
       file starting at the end rather than the beginning.

For really long logs, I find it convenient to use the -n option which turns off line numbering. From the manpage:

-n or --line-numbers
          Suppresses line numbers.  The default (to use line numbers)  may
          cause  less  to run more slowly in some cases, especially with a
          very large input file.  Suppressing line  numbers  with  the  -n
          option  will  avoid this problem.  Using line numbers means: the
          line number will be displayed in the verbose prompt and in the =
          command,  and the v command will pass the current line number to
          the editor (see also  the  discussion  of  LESSEDIT  in  PROMPTS
          below).

1. Hat-tip to rgmarcha for pointing this out in the comments.

share|improve this answer

I'm editing a LaTeX file and wanted to monitor it also for changes somewhere in the middle. I whipped up the following little shell script that proved useful to me. I hope it'll also come in handy to someone else.

#!/bin/bash
FILE="$1"
CMD="$2"
LAST=`ls -l "$FILE"`
while true; do
  sleep 1
  NEW=`ls -l "$FILE"`
  if [ "$NEW" != "$LAST" ]; then
    "$CMD" "$FILE"
    LAST="$NEW"
  fi
done

Save it as watch.sh and do chmod u+x watch.sh. Then I execute it as follows:

./watch.sh file.tex pdflatex

If you want the command only to be run if actual modification takes place, you can use `md5sum "$FILE"` instead of `ls -l "$FILE"`.

share|improve this answer
    
to watch directories and their contents instead of a single file: NEW=`tree -sDct . -I 'ignore_pattern|another_pattern'` –  Andy Dec 19 '13 at 14:34

you can use the tailf command its very easiest one

tailf logfile.log
share|improve this answer

You can also use inotifywatch/inotifywait which hook into the kernels inotify subsystem. This way you can also watch for things like "open", "close" or "access".

But if you're simply want to get appended lines to stdout i agree on tail.

share|improve this answer

Tail is the standard, traditional, available everywhere unix tool. A little more sophisticated tool is multitail which can monitor several files simultaneously and does syntax highlighting.

share|improve this answer

If I want to be able to search around the file in addition to just tailing it, I use less with the "F" command.

When using tail, keep in mind that additional arguments are needed if the file might be rolling over or replaced by edit (default mode for vim's :w).

tail -f will cause tail to store the file descriptor and follow it. If the file is replaced the descriptor will be changed. The benefit of following the file descriptor is that if the file is renamed, you will still be following it.

tail --follow= will make tail track the named file by reopening it periodically to see if it has been replaced.

--retry is another useful option if you want to tail a log file but the file hasn't been created yet.

tail -F is a shortcut for --follow= --retry.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.