Learn › Linux Foundations › Reading Files
tail - a hands-on Linux lab on a real virtual machine.
Read the end of any file with tail. The default last 10, choose a count with -n, start from a line with -n +N, and grab bytes with -c, all in the practice terminal. Plus what -f, the follow flag, is for.
You have been reading files from the top. head shows you the first lines, cat pours out the whole thing. But a huge amount of the time, the part you actually care about is at the bottom of a file, not the top.
Think about a log file: a text file where a program writes down what it does, one line at a time, newest entry last. The line that tells you what just went wrong is the last one. The command that jumps straight to the bottom of a file is tail.
The black boxes in this lesson are a practice terminal: a safe sandbox that only checks the one command each step teaches, so you cannot break anything. It replays real output here. On the real machine at the end of the module, the mission builds these same files for you and you run tail for real.
You are working inside a folder called intercept, a small pile of captured logs. Start with the plainest possible tail. Type this exact command and press Enter:
tail ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: tail ~/intercept/logs/messages.log output: line 1: system boot line 2: loading kernel modules line 3: network interface up line 4: mounting filesystems line 5: starting services line 6: user student logged in line 7: running diagnostics line 8: ready hint: Type tail, a space, then the path to the file. Like this: tail ~/intercept/logs/messages.log
You saw all eight lines. That is the clue to how tail works: with no options it prints the last 10 lines of a file. This log only has 8 lines, and 8 is fewer than 10, so tail gave you the whole thing. On a real log with thousands of lines you would have seen only the final 10, the freshest entries, and nothing else.
tail prints the end of a file. By default it shows the last 10 lines and stops. That is the entire idea: skip everything above, show me the bottom.
It has a mirror-image twin you may have already met. head shows the first lines of a file; tail shows the last lines. Same defaults (10 lines), opposite ends. They are partners, and together they let you read either end of a file without opening the whole thing.
Reach for tail when the newest information is at the bottom, which is almost always true for logs. Reach for head when you want the start of a file, like a header row or the opening lines.
Ten lines is just the default. When you want a different number, the -n flag sets it. -n is short for number of lines: tail -n <count> shows exactly that many lines from the end.
You rarely need all ten. Ask for just the last three entries of the log:
tail -n 3 ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: tail -n 3 ~/intercept/logs/messages.log output: line 6: user student logged in line 7: running diagnostics line 8: ready hint: Add -n and the number 3 between tail and the path. Like this: tail -n 3 ~/intercept/logs/messages.log
Exactly three lines, counted from the bottom up: line 8, line 7, line 6, printed in file order. tail always keeps the lines in their original top-to-bottom order; it just starts them from wherever the count reaches. Change the 3 to any number and tail gives you that many trailing lines.
The same flag works on any file. Next to messages.log in the intercept logs sits report.txt, a twelve-line intercept report. You only care about how it ends: the summary and its verdict. Pull the last four lines:
tail -n 4 ~/intercept/logs/report.txt
prompt: student@linuxcamp:~$ answer: tail -n 4 ~/intercept/logs/report.txt output: SECTION 2: SUMMARY Two anomalies flagged for review. No data loss detected. END OF REPORT hint: Same shape as before, just a 4 and the report path: tail -n 4 ~/intercept/logs/report.txt
Four lines, the whole closing section, without scrolling past the eight lines above it. This is what tail is for: on a long file you skip straight to the part that matters. The report has twelve lines total, so those last four are lines 9 through 12. Hold that thought, because the next flag reaches the same four lines from a completely different direction.
So far -n has meant "the last N lines." Put a + in front of the number and the meaning flips. Now tail -n +N means "start at line N and print everything from there to the end." It counts from the top, not the bottom, then runs to the finish.
The report has twelve lines, and its summary section begins on line 9. Ask for everything from line 9 onward:
tail -n +9 ~/intercept/logs/report.txt
prompt: student@linuxcamp:~$ answer: tail -n +9 ~/intercept/logs/report.txt output: SECTION 2: SUMMARY Two anomalies flagged for review. No data loss detected. END OF REPORT hint: Put a plus sign before the number: tail -n +9 ~/intercept/logs/report.txt
The same four lines you got with tail -n 4, but you reached them a different way. -n 4 said "the last four lines"; -n +9 said "from line 9 to the end." They landed on the same block for one reason: this file is exactly 12 lines long. So "from line 9" and "the last 4" name the same four lines here.
The +N form shines when a file has a header you want to skip. tail -n +2 data.csv drops the first line, the column titles, and hands you every data row after it.
Usually you think in lines, but sometimes you want a fixed amount of raw text from the very end, measured in bytes. A byte is a single character here (in plain English text, one letter, digit, or space is one byte). The -c flag counts bytes instead of lines: tail -c <count> prints the last N bytes.
The last line of the log, line 8: ready, is 13 characters, and the invisible newline that ends it makes 14 bytes. Ask for exactly the last 14 bytes:
tail -c 14 ~/intercept/logs/messages.log
prompt: student@linuxcamp:~$ answer: tail -c 14 ~/intercept/logs/messages.log output: line 8: ready hint: Use -c and the number 14 this time: tail -c 14 ~/intercept/logs/messages.log
Fourteen bytes gave you the final line exactly, because that line plus its newline is 14 bytes. -c does not care about line boundaries at all: ask for 10 bytes instead and tail would hand you 8: ready and a newline, chopping the line partway through. That is normal for byte mode, and it is what makes -c useful when you need a precise chunk from the end rather than whole lines.
There is one more form of tail, and it is the reason engineers keep this command within reach: tail -f. The -f is short for follow. It prints the last lines like normal, then does not quit. It stays open and watches the file, and every time a program adds a new line, that line appears on your screen the instant it is written.
This is how you watch a server as it runs. When something is going wrong right now, engineers open the log with tail -f and read the trouble as it happens, live.
tail -f never ends on its own, so the practice terminal cannot replay it. To stop following and get your prompt back, press Ctrl+C. That key combination sends an interrupt that tells the running command to quit; it does not close your terminal. You can try tail -f on any file on the module's mission machine, and Ctrl+C gets you out; just know that nothing new will appear unless a program is actively writing to the file.
Scaffolding off. No command is shown this time. You have every piece you need.
You want the two most recent entries from the log, messages.log, and nothing above them. Point tail at the log file and cap the output at the last two lines.
prompt: student@linuxcamp:~$ answer: tail -n 2 ~/intercept/logs/messages.log output: line 7: running diagnostics line 8: ready hint: Think back to the -n step, where a number set how many trailing lines to show. Point tail at the log and ask for 2.
Nailed it. -n 2 capped the output at the last two lines, line 7 and line 8, the freshest pair, in their original order. You combined the flag and the number from memory, which is exactly the move the real machine will ask of you.
You earned this cheat sheet. Every row is a form of tail you have already run:
tail and head are the pair you reach for first on any file too long to read whole: head for the start, tail for the end. And when a file is still being written, tail -f lets you watch it fill in real time.
On a fast-moving log, tail -f can scroll faster than you can read. Stop it with Ctrl+C, then use tail -n 20 to freeze the last 20 lines and read them at your own pace.
The practice terminal has shown you every form of tail. The reading-files module ends with one real machine, and that is where you read the ends of files for real.
In the module's capstone mission, a Linux VM boots just for you on the same intercept files. Its objectives use exactly what you just ran: the default last-10, -n for a line count, -n +N to start from a line, and -c for bytes. One difference from here: the lab shows no commands. You read the objective, you recall the flag, you type it. That recall is what makes it stick.
Finish the other reading-files lessons, then go cover the rearguard for real.
Practice tail in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.