linux tail 命令_Linux tail命令示例

linux tail 命令

Linux tail command outputs the last part of the files. There is an option to keep the file open for further entries. This makes it very useful to work with log files where we can check the logs in real-time when an event is happening.

Linux tail命令输出文件的最后一部分。有一个选项可以使文件保持打开状态以供进一步输入。这使得处理日志文件非常有用，当事件发生时，我们可以实时检查日志。

1. Linux tail命令语法 (1. Linux tail Command Syntax)

The syntax of tail command is:

tail命令的语法为：

$ tail [OPTION]... [FILE]...

All the options and file names are optional.

所有选项和文件名都是可选的。

2.如果没有提供文件，tail将如何处理？ (2. What will tail do if no file is provided?)

If you don’t provide the file name to tail, or specify it as a hyphen (-), the standard input is read.

如果您不提供文件名结尾，或将其指定为连字符（-），则将读取标准输入。

3.读取文件的最后10行 (3. Reading the last 10 lines of a File)

If we don’t specify any option, the tail will read the last 10 lines of a file.

如果不指定任何选项，则尾部将读取文件的最后10行。

# tail error.log
2019-10-29 11:31:09.887840 [INFO] [16169] [APVH_recipes_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_recipes_Suphp73.sock.pid].
2019-10-29 11:31:09.887968 [INFO] [16169] [APVH_recipes_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_recipes_Suphp73.sock
2019-10-29 11:31:09.896280 [INFO] [16169] [APVH_recipes_Sulsphp73:] add child process pid: 27035, procinfo: 0x2c5e2b0
2019-10-29 11:31:09.896396 [INFO] [16169] [APVH_recipes_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_recipes_Suphp73.sock.pid].
2019-10-29 11:31:17.182067 [INFO] [16169] [APVH_golangd_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid].
2019-10-29 11:31:17.182116 [INFO] [16169] [APVH_golangd_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_golangd_Suphp73.sock
2019-10-29 11:31:17.182991 [INFO] [16169] [APVH_golangd_Sulsphp73:] add child process pid: 27067, procinfo: 0x447cff0
2019-10-29 11:31:17.183048 [INFO] [16169] [APVH_golangd_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid].
2019-10-29 11:31:20.641690 [INFO] [16169] [149.56.101.239:45604] [ACL] Access to context [/] is denied!
2019-10-29 11:31:27.245789 [INFO] [16169] [198.199.83.232:46876] [ACL] Access to context [/] is denied!
#

4. Linux tail命令选项 (4. Linux tail Command Options)

Short Option	Long Option	Description
-c	–bytes=K	output the last K bytes of the file. We can use “-c +K” to output bytes starting with the Kth of each file.
-f	–follow[={name\|descriptor}]	output appended data as the file grows. If we specify -F, it’s same as “–follow=name –retry”
-n	–lines=K	output the last K lines, instead of the last 10; or use ‘-n +K’ to output starting with the Kth line.
-q	–quiet, –silent	never output headers giving file names
	–retry	keep trying to open a file if it is inaccessible
-s	–sleep-interval=N	used with with -f to sleep for approximately N seconds (default 1.0) between iterations.
-v	–verbose	always output headers giving file names
	–version	output version information and exit.

短期权	长期权	描述
-C	–bytes = K	输出文件的最后K个字节。我们可以使用“ -c + K”来输出从每个文件的第K个字节开始的字节。
-F	–follow [= {name \| descriptor}]	随着文件的增长输出附加的数据。如果指定-F，则与“ –follow = name –retry”相同
-n	–lines = K	输出最后K行，而不是最后10行；或使用'-n + K'从第K行开始输出。
-q	–安静，–安静	从不输出给出文件名的头文件
	-重试	如果无法访问，请继续尝试打开文件
-s	–sleep-interval = N	与-f一起使用时，在两次迭代之间睡眠大约N秒（默认为1.0）。
-v	–详细	总是输出标头给出文件名
	-版	输出版本信息并退出。

If the first character of K (the number of bytes or lines) is a ‘+’, print beginning with the Kth item from the start of each file, otherwise, print the last K items in the file.如果K的第一个字符（字节或行数）是'+'，则从每个文件的开头开始从第K个项目开始打印，否则，打印文件中的最后K个项目。
K may have a multiplier suffix: b 512, kB 1000, K 1024, MB 1000*1000, M 1024*1024, GB 1000*1000*1000, G 1024*1024*1024, and so on for T, P, E, Z, Y.K可以有一个乘数后缀：b，512，kB 1000，K 1024，MB 1000 * 1000，M 1024 * 1024，GB 1000 * 1000 * 1000，G 1024 * 1024 * 1024等，对于T，P，E Z，Y。
With –follow (-f), tail defaults to following the file descriptor, which means that even if a tailed file is renamed, the tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descriptor (e.g., log rotation).使用–follow（-f），tail缺省遵循文件描述符，这意味着即使重命名已尾的文件，tail也将继续跟踪其结尾。当您确实要跟踪文件的实际名称而不是文件描述符（例如，日志轮换）时，这种默认行为是不可取的。
Use –follow=name in that case. That causes the tail to track the named file in a way that accommodates renaming, removal, and creation.在这种情况下，请使用–follow = name。这会导致尾部以适应重命名，删除和创建的方式跟踪命名文件。

5. Linux tail命令示例 (5. Linux tail Command Examples)

Let’s look at some examples of tail command usage.

让我们看一下tail命令用法的一些示例。

5.1）限制尾输出中的行数 (5.1) Limit the Number of Lines in tail Output)

We can use -n or –lines option to limit the number of lines in the tail output.

我们可以使用-n或–lines选项来限制尾输出中的行数。

# tail -n 5 error.log# tail --lines=5 error.log

If we use + prefix with the option value, the output will be started from that line number in the file.

如果我们在选项值中使用+前缀，则输出将从文件中的该行号开始。

# wc -l error.log
27360 error.log# tail -n +27358 error.log
2019-10-29 13:09:35.142604 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock
2019-10-29 13:09:35.144320 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 18132, procinfo: 0x367c520
2019-10-29 13:09:35.144389 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].# tail --lines=+27358 error.log
2019-10-29 13:09:35.142604 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock
2019-10-29 13:09:35.144320 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 18132, procinfo: 0x367c520
2019-10-29 13:09:35.144389 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
#

5.2）限制tail输出中的字节数 (5.2) Limit the Number of Bytes in tail Output)

We can use -c or –bytes option to output the specified bytes from the end of the file.

我们可以使用-c或–bytes选项从文件末尾输出指定的字节。

# tail -c 100 error.log[16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
# tail --bytes=100 error.log[16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
#

If we use + with the option value, the file data from that byte will be output to the console.

如果我们在选项值上使用+，则该字节中的文件数据将输出到控制台。

# ls -ltr error.log
-rw-r--r--. 1 nobody nobody 3475359 Oct 29 13:15 error.log
# tail -c +3475350 error.log
ock.pid].
#

5.3）具有多个文件的Linux tail命令 (5.3) Linux tail Command with Multiple Files)

We can pass multiple file names and the output will have a header with the file name followed by the output.

我们可以传递多个文件名，并且输出将带有一个标头，其文件名后跟输出。

# tail -n 2 error.log error.log.2019_10_27
==> error.log <==
2019-10-29 13:17:24.356633 [INFO] [16169] [APVH_golangd_Sulsphp73:] add child process pid: 19670, procinfo: 0x27af560
2019-10-29 13:17:24.356789 [INFO] [16169] [APVH_golangd_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid].==> error.log.2019_10_27 <==
2019-10-27 20:26:31.050022 [INFO] [16169] [176.9.99.9:34084] [ACL] Access to context [/] is denied!
2019-10-27 20:26:31.216835 [INFO] [16169] [176.9.99.9:34118] [ACL] Access to context [/] is denied!
#

We can use -q option for silent output. It’s useful to merge the output from multiple files.

我们可以使用-q选项进行静默输出。合并多个文件的输出非常有用。

# tail -n 2 -q error.log error.log.2019_10_27
2019-10-29 13:18:44.095709 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 19947, procinfo: 0x4312b50
2019-10-29 13:18:44.095766 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
2019-10-27 20:26:31.050022 [INFO] [16169] [176.9.99.9:34084] [ACL] Access to context [/] is denied!
2019-10-27 20:26:31.216835 [INFO] [16169] [176.9.99.9:34118] [ACL] Access to context [/] is denied!
#

5.4）监视文件中的更改 (5.4) Watching a File for Changes)

We can use -f option to watch the file for further changes. This is the most widely used option with the tail command. It’s useful to track logs in real-time and debug it.

我们可以使用-f选项来监视文件的进一步更改。这是tail命令中使用最广泛的选项。实时跟踪日志并进行调试非常有用。

[root@li1197-217 logs]# tail -f error.log
2019-10-29 13:22:31.719103 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 20640, procinfo: 0x384a9a0
2019-10-29 13:22:31.719172 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid].
2019-10-29 13:22:32.176946 [INFO] [16169] [APVH_android_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
2019-10-29 13:22:32.176979 [INFO] [16169] [APVH_android_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_android_Suphp73.sock
2019-10-29 13:22:32.177901 [INFO] [16169] [APVH_android_Sulsphp73:] add child process pid: 20645, procinfo: 0x2df6830
2019-10-29 13:22:32.177955 [INFO] [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
2019-10-29 13:22:39.634710 [INFO] [16169] [APVH_javastr_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
2019-10-29 13:22:39.634755 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock
2019-10-29 13:22:39.641576 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 20677, procinfo: 0x286e3b0
2019-10-29 13:22:39.641694 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].

We can watch multiple files too with the -f option.

我们也可以使用-f选项查看多个文件。

[root@li1197-217 logs]# tail -f error.log lsrestart.log
==> error.log <==
2019-10-29 13:22:31.719103 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 20640, procinfo: 0x384a9a0
2019-10-29 13:22:31.719172 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid].
2019-10-29 13:22:32.176946 [INFO] [16169] [APVH_android_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
2019-10-29 13:22:32.176979 [INFO] [16169] [APVH_android_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_android_Suphp73.sock
2019-10-29 13:22:32.177901 [INFO] [16169] [APVH_android_Sulsphp73:] add child process pid: 20645, procinfo: 0x2df6830
2019-10-29 13:22:32.177955 [INFO] [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid].
2019-10-29 13:22:39.634710 [INFO] [16169] [APVH_javastr_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
2019-10-29 13:22:39.634755 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock
2019-10-29 13:22:39.641576 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 20677, procinfo: 0x286e3b0
2019-10-29 13:22:39.641694 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].==> lsrestart.log <==
Thu Oct 10 17:45:33 UTC 2019
restart, LSWS running: 1
Wed Oct 23 08:53:16 UTC 2019
restart, LSWS running: 1
Wed Oct 23 09:03:02 UTC 2019
restart, LSWS running: 1

We can also specify the number of lines in the output with the -f option.

我们还可以使用-f选项指定输出中的行数。

# tail -2f error.log
2019-10-29 13:28:46.086130 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 21976, procinfo: 0xd032210
2019-10-29 13:28:46.086193 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid].

5.5）将tail命令与pipe和grep一起使用 (5.5) Using the tail Command with pipe and grep)

Sometimes we are interested in only specific messages in the tail output. We can use the tail command with pipe and grep to filter the specific messages in the output.

有时我们只对尾部输出中的特定消息感兴趣。我们可以将tail命令与pipe和grep一起使用，以过滤输出中的特定消息。

# tail -100f error.log | grep 'denied'
2019-10-29 13:21:49.170651 [INFO] [16169] [159.65.53.153:38448] [ACL] Access to context [/] is denied!
2019-10-29 13:22:00.991330 [INFO] [16169] [182.71.209.203:22089] [ACL] Access to context [/] is denied!
2019-10-29 13:25:47.188167 [INFO] [16169] [79.137.42.145:36674] [ACL] Access to context [/] is denied!
2019-10-29 13:25:52.668213 [INFO] [16169] [162.144.60.165:52886] [ACL] Access to context [/] is denied!

5.6）使用tail命令过滤另一个命令输出 (5.6) Using tail command to filter another command output)

We can use the tail command with another command to filter the output lines. It’s useful when we are interested only in the few lines from a command output.

我们可以将tail命令与另一个命令一起使用以过滤输出行。当我们仅对命令输出中的几行感兴趣时，这很有用。

# ls -ltr | tail -n 3
-rw-r--r--. 1 nobody nobody    24406 Oct 23 09:08 error.log.2019_10_23.02
-rw-r--r--. 1 nobody nobody 10486279 Oct 27 20:26 error.log.2019_10_27
-rw-r--r--. 1 nobody nobody  3494794 Oct 29 13:29 error.log
#

# ls -ltr | tail -n +15
-rw-r--r--. 1 nobody nobody 10490954 Oct 21 09:42 error.log.2019_10_21
-rw-r--r--. 1 nobody nobody 10485856 Oct 22 07:44 error.log.2019_10_22
-rw-r--r--. 1 nobody nobody 10485809 Oct 22 14:16 error.log.2019_10_22.01
-rw-r--r--. 1 nobody nobody  5398751 Oct 23 08:29 error.log.2019_10_23
-rw-r--r--. 1 nobody nobody    61485 Oct 23 08:58 error.log.2019_10_23.01
-rw-r--r--. 1 root   root        162 Oct 23 09:03 lsrestart.log
-rw-r--r--. 1 nobody nobody    24406 Oct 23 09:08 error.log.2019_10_23.02
-rw-r--r--. 1 nobody nobody 10486279 Oct 27 20:26 error.log.2019_10_27
-rw-r--r--. 1 nobody nobody  3499801 Oct 29 13:34 error.log

5.7）打印尾版 (5.7) Printing tail version)

We can use –version to print the tail command version.

我们可以使用–version打印tail命令的版本。

# tail --version
tail (GNU coreutils) 8.22
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.Written by Paul Rubin, David MacKenzie, Ian Lance Taylor,
and Jim Meyering.
#

5.8）tail命令的详细输出 (5.8) tail command verbose output)

If we use the verbose option, the output will have a header with the file name.

如果我们使用verbose选项，则输出将带有文件名的标头。

# tail -v -n 2 error.log
==> error.log <==
2019-10-29 13:39:30.769561 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 24454, procinfo: 0x405b840
2019-10-29 13:39:30.769618 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
#

六，结论 (6. Conclusion)

Linux tail command is very useful to debug log messages in real-time. It's a great tool for developers to work with log files.

Linux tail命令对于实时调试日志消息非常有用。这是开发人员使用日志文件的好工具。

Reference: Wikipedia Page

参考：维基百科页面

翻译自: https://www.journaldev.com/33349/linux-tail-command-examples

linux tail 命令