tail 用於實時日誌監測文件內容。
tail [OPTION]... [FILE]...
將每個 FILE 的最後 10 行打印到標準輸齣。
若有多個 FILE，將給定文件名頭前置到每個文件。
當沒有 FILE 或 FILE 為 - 時，讀取標準輸入。
注意：長選項強製性自變量，對於短選項也是強製性的。
OPTION 參數
| 參數 | EN 解釋 | 中文翻譯 | 備注 |
|---|---|---|---|
| -c, --bytes=[+]NUM |
output the last NUM bytes; or use -c +NUM to output starting with byte NUM of each file |
輸齣最後 NUM 字節； 或使用 -c +NUM 從每文件第 NUM 字節開始輸齣 |
|
| -f, --follow[={name|descriptor}] |
output appended data as the file grows; an absent option argument means 'descriptor' |
隨文件增長輸齣追加數據； 缺失選項自變量意味著 descriptor |
|
| -F | same as --follow=name --retry | 如同 --follow=name --retry | |
| -n, --lines=[+]NUM |
output the last NUM lines, instead of the last 10; or use -n +NUM to output starting with line NUM |
輸齣最後 NUM 行，而不是最後 10 行； 或使用 -n +NUM 從第 NUM 行開始輸齣 |
|
| --max-unchanged-stats=N |
with --follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated log files); with inotify, this option is rarely useful |
采用 --follow=name，在 N (默認 5) 次迭代後重新打開沒有改變大小的 FILE，看它是否已解除鏈接或重命名 (這是輪換日誌文件的通常情況)； 對於 inotify (通知)，此選項很少有用 |
|
| --pid=PID | with -f, terminate after process ID, PID dies | 采用 -f，在進程 ID，PID 死亡後終止 | |
| -q, --quiet, --silent | never output headers giving file names | 從不輸齣給定文件名頭 | |
| --retry | keep trying to open a file if it is inaccessible | 保持試著打開文件，若不可訪問 | |
| -s, --sleep-interval=N |
with -f, sleep for approximately N seconds (default 1.0) between iterations; with inotify and --pid=P, check process P at least once every N seconds |
采用 -f，在迭代之間休眠約 N 秒 (默認 1.0 秒)； 對於 inotify (通知) 和 --pid=P，至少每 N 秒校驗進程 P 一次 |
|
| -v, --verbose | always output headers giving file names | 始終輸齣給定文件名頭 | |
| -z, --zero-terminated | line delimiter is NUL, not newline | 行定界符為 NUL，而不是換行符 | |
| --help | display this help and exit | 顯示此幫助並退齣 | |
| --version | output version information and exit | 輸齣版本信息並退齣 |
NUM 可以擁有乘數後綴：
b 512，kb 1000，k 1024，mb 1000*1000，m 1024*1024，gb 1000*1000*1000，g 1024*1024*1024， 等適用於 t、p、e、z、y。
采用 --follow (-f)，tail 默認跟隨文件描述符，意味著即使 tail 文件被重命名，tail 也將繼續跟蹤其結尾。
當真正想要跟蹤文件的實際名稱，而不是文件描述符 (例如，日誌輪換) 時，不期望這種默認行為。
在此情況下使用 --follow=name。
這導緻 tail 以順應重命名、刪除和創建的方式，跟蹤命名文件。
| 功能 | 命令 | 文字解釋 | 示例 | 示例解釋 |
|---|---|---|---|---|
| 幫助 | tail --help | 展示幫助信息 | ||
| 版本 | tail --version | 展示版本信息 |
隨文件內容增長，實時監控指定文件內容
root@:/var/log# tail -f /var/log/auth.log Oct 21 02:17:01 Izj6C3Okxpwhhktqwedrf0Z CRON[5123]: pam_unix(cron:session): session closed for user root Oct 21 02:20:55 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: Invalid user admin from 13.19.117.13 Oct 21 02:20:55 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: input_userauth_request: invalid user admin [preauth] Oct 21 02:21:03 iZj6c3okxpwhhkt9xrjxh0Z sshd[5129]: Connection closed by 13.19.117.13 port 35136 [preauth] Oct 21 02:25:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5131]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:25:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5131]: pam_unix(cron:session): session closed for user root Oct 21 02:35:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5136]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:35:02 iZj6c3okxpwhhkt9xrjxh0Z CRON[5136]: pam_unix(cron:session): session closed for user root Oct 21 02:39:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5140]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 21 02:39:01 iZj6c3okxpwhhkt9xrjxh0Z CRON[5140]: pam_unix(cron:session): session closed for user root
隨文件內容增長，高亮顯示關鍵詞，實時監控多個指定文件內容
root:~# tail -f /var/log/nginx/access.log /var/log/nginx/error.log ==> /var/log/nginx/access.log <== ==> /var/log/nginx/error.log <== 2025/10/20 18:41:07 [warn] 3714#3714: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: could not build optimal server_names_hash, you should increase either server_names_hash_max_size: 512 or server_names_hash_bucket_size: 64; ignoring server_names_hash_bucket_size
隨文件內容增長，高亮顯示關鍵詞，實時監控指定文件內容
root:~# tail -f /var/log/nginx/error.log | ack --color "ignored" 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3714#3714: conflicting server name "qt4.digitser.run" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on 0.0.0.0:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.net" on [::]:80, ignored 2025/10/20 18:41:07 [warn] 3717#3717: conflicting server name "qt4.digitser.run" on [::]:80, ignored
版權聲明： 本文為獨傢原創稿件，版權歸 樂數軟件 ，未經許可不得轉載。
