Command of the Day: tail
If you saw yesterday’s Command of the Day about head
then you prolly saw this coming.
This is the command you’ll commonly see when reading constant output from a file or from a log.
Hell, the heroku CLI has a --tail
option for logs that continues to display output.
It is by far one of my most commonly used commands.
Especially when I’m doing server work.
Overview⌗
As head
views the top of the file, tail
shows the bottom.
The copyrite header of tail.c
show’s 1989.
I’m assuming that they were designed and released around the same time.
A common author between them is one David MacKenzie.
Usage⌗
There is definaetly some usage commonality between head
and tail
.
They both default to 10 lines of output; you can specify the number of lines displayed; you can specify the number of bytes; and can use zero-terminated input.
The table below shows some of the common flags you’ll see.
option | long-form | description |
---|---|---|
-c |
--bytes |
output the last x bytes |
-f |
--follow |
continute to output as file gets bigger |
-F |
same as --follow=name --retry |
|
-n |
--lines |
output the last x lines |
--pid |
usues -f ; stopes when pid is killed |
|
--retry |
keep trying to output file | |
-z |
--zero-terminated |
line delimiter is NUL, not newline |
Examples⌗
The default output.
tail ~/.zshrc
# zsh-completions
fpath=($HOME/.zsh/zsh-completions $fpath)
fpath=($fpath $HOME/.zsh/func)
typeset -U fpath
##########
# Prompt #
source $HOME/.zsh/zsh-drt-prompt/drt-prompt.zsh
Similar to head -n -x
you can use tail -n +x
to display all except the first x
lines of data.
If it works out in your favour to use +x
instead of -y
.
For instance the following two commands produce the same output with my .vimrc
file.
tail -n 9 .vimrc
tail -n +85 .vimrc
"nerdtree config
map <C-n> :NERDTreeToggle<CR>
let NERDTreeShowHidden=1 "show hidden files
let NERDTreeIgnore=['\.swp'] "ignore swap files
let NERDTreeMapOpenInTab='<ENTER>' "open files from NERDTree in new tab
autocmd VimEnter * if argc() == 0 && !exists("s:std_in") | NERDTree | endif "open a NERDTree automatically when vim starts up if no files were specified
"javacomplete2 config
autocmd FileType java setlocal omnifunc=javacomplete#Complete
Using the -f
flag allows you to follow files as data is being written to it.
Try running tail -f /var/log/system.log
. You’ll see some data but the console is still waiting.
As data is written to the log, it will continue to output.
Let’s execute a shutdown
command by executing shutdown -h +20
.
Now we should see it written to the system.log
.
You can abort the shutdown by running kill -9 PID
where PID
is the process id for the shutdown command.
It would have been displayed in the terminal after you ran the previous command.
tail -f /var/log/system.log
Feb 26 19:26:15 localhost login[838]: DEAD_PROCESS: 838 ttys003
Feb 26 19:26:16 localhost timed[78]: settimeofday({0x5e570ca8,0xb2e00}) == 0
Feb 26 19:27:32 localhost syslogd[38]: ASL Sender Statistics
Feb 26 19:27:32 localhost login[862]: USER_PROCESS: 862 ttys003
***System shutdown message from user@localhost***
System going down in 6 minutes
The --pid
option is a pretty interesting concept.
It’s best used in conjunction with the -f
option.
This wiill constantly read a particiular file while PID is currently available.
If for whatever reason you needed to block and you have the PID of a long running process, you can use tail --pid
.
Here’s a trivial example. I’ll read from /dev/null
to keep the output to nothing.
sleep 20 &
[1] 1010
tail --pid=1010 -f /dev/null
[1] + done sleep 20
Lastly, let’s look at the NULL terminated option.
In this completely random scenerio, a program returns a bunch of numbers that are NULL terminated.
The output of that program is 9930045001073
and you need to know the last number that was outputted to the terminal.
Is it 3? 73? 1073? 5001073?
echo -ne $'\0'99$'\0'300$'\0'4$'\0'500$'\0'10$'\0'73$'\0' | tail --zero-terminated -n 1
73
It’s rare for me to see strings NULL terminated these days, but there are times where it might be necessary.
C strings are terminated by the \0
character.
You might find it in the wild someday, and on that day, you’ll be ready.
Conclusion⌗
Going into system administration?
Mostly likely you’ll be getting pretty comfortable using tail -f
.
Hopefully the next script you use will use some handy tricks involving head
and tail
.
References⌗
- [1] tail Source Code | Github
- [2] GNU’s Who | GNU.org
- [3] Wait for a process to finish | Stack Overflow