tail 用于实时日志监测文件内容。
tail [OPTION]... [FILE]...
将每个 FILE 的最后 10 行打印到标准输出。
若有多个 FILE，将给定文件名头前置到每个文件。
当没有 FILE 或 FILE 为 - 时，读取标准输入。
注意：长选项强制性自变量，对于短选项也是强制性的。
OPTION 参数
| 参数 | EN 解释 | 中文翻译 | 备注 |
|---|---|---|---|
| -c, --bytes=[+]NUM |
output the last NUM bytes; or use -c +NUM to output starting with byte NUM of each file |
输出最后 NUM 字节； 或使用 -c +NUM 从每文件第 NUM 字节开始输出 |
|
| -f, --follow[={name|descriptor}] |
output appended data as the file grows; an absent option argument means 'descriptor' |
随文件增长输出追加数据； 缺失选项自变量意味着 descriptor |
|
| -F | same as --follow=name --retry | 如同 --follow=name --retry | |
| -n, --lines=[+]NUM |
output the last NUM lines, instead of the last 10; or use -n +NUM to output starting with line NUM |
输出最后 NUM 行，而不是最后 10 行； 或使用 -n +NUM 从第 NUM 行开始输出 |
|
| --max-unchanged-stats=N |
with --follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated log files); with inotify, this option is rarely useful |
采用 --follow=name，在 N (默认 5) 次迭代后重新打开没有改变大小的 FILE，看它是否已解除链接或重命名 (这是轮换日志文件的通常情况)； 对于 inotify (通知)，此选项很少有用 |
|
| --pid=PID | with -f, terminate after process ID, PID dies | 采用 -f，在进程 ID，PID 死亡后终止 | |
| -q, --quiet, --silent | never output headers giving file names | 从不输出给定文件名头 | |
| --retry | keep trying to open a file if it is inaccessible | 保持试着打开文件，若不可访问 | |
| -s, --sleep-interval=N |
with -f, sleep for approximately N seconds (default 1.0) between iterations; with inotify and --pid=P, check process P at least once every N seconds |
采用 -f，在迭代之间休眠约 N 秒 (默认 1.0 秒)； 对于 inotify (通知) 和 --pid=P，至少每 N 秒校验进程 P 一次 |
|
| -v, --verbose | always output headers giving file names | 始终输出给定文件名头 | |
| -z, --zero-terminated | line delimiter is NUL, not newline | 行定界符为 NUL，而不是换行符 | |
| --help | display this help and exit | 显示此帮助并退出 | |
| --version | output version information and exit | 输出版本信息并退出 |
NUM 可以拥有乘数后缀：
b 512，kb 1000，k 1024，mb 1000*1000，m 1024*1024，gb 1000*1000*1000，g 1024*1024*1024， 等适用于 t、p、e、z、y。
采用 --follow (-f)，tail 默认跟随文件描述符，意味着即使 tail 文件被重命名，tail 也将继续跟踪其结尾。
当真正想要跟踪文件的实际名称，而不是文件描述符 (例如，日志轮换) 时，不期望这种默认行为。
在此情况下使用 --follow=name。
这导致 tail 以顺应重命名、删除和创建的方式，跟踪命名文件。
| 功能 | 命令 | 文字解释 | 示例 | 示例解释 |
|---|---|---|---|---|
| 帮助 | tail --help | 展示帮助信息 | ||
| 版本 | tail --version | 展示版本信息 |
随文件内容增长，实时监控指定文件内容
root@:/var/log# tail -f /var/log/auth.log Oct 21 02:17:01 Izj6C3Okxpwhhktqwedrf0Z CRON[5123]: pam_unix(cron:session): session closed for user root Oct 21 02:20:55 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: Invalid user admin from 13.19.117.13 Oct 21 02:20:55 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: input_userauth_request: invalid user admin [preauth] Oct 21 02:21:03 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: Connection closed by 13.19.117.13 port 35136 [preauth] Oct 21 02:25:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5131]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:25:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5131]: pam_unix(cron:session): session closed for user root Oct 21 02:35:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5136]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:35:02 iZj6c3okxpwhhkt9xrjxh0Z CRON[5136]: pam_unix(cron:session): session closed for user root Oct 21 02:39:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5140]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:39:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5140]: pam_unix(cron:session): session closed for user root
随文件内容增长，高亮显示关键词，实时监控多个指定文件内容
root:~# tail -f /var/log/nginx/access.log /var/log/nginx/error.log ==> /var/log/nginx/access.log <== ==> /var/log/nginx/error.log <== 2025/10/20 18:41:07 [warn] 3714#3714: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size
随文件内容增长，高亮显示关键词，实时监控指定文件内容
root:~# tail -f /var/log/nginx/error.log | ack --color "ignored" 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on [::]:80, ignored
版权声明： 本文为独家原创稿件，版权归 乐数软件 ，未经许可不得转载。
