Commands using tail (292)
-
with discard wilcards in bash you can "tail" newer logs files to see what happen, any error, info, warn... Show Sample Output
5tail -f *[!.1][!.gz] -
This command finds the 5 (-n5) most frequently updated logs in /var/log, and then does a multifile tail follow of those log files. Alternately, you can do this to follow a specific list of log files: sudo tail -n0 -f /var/log/{messages,secure,cron,cups/error_log} Show Sample Output
5ls -drt /var/log/* | tail -n5 | xargs sudo tail -n0 -f -
shows also time if its the same year or shows year if installed before actual year and also works if /etc is a link (mac os) Show Sample Output
5ls -lct /etc/ | tail -1 | awk '{print $6, $7, $8}' -
Calculates the size on disk for each package installed on the filesystem (or removed but not purged). This is missing the
| sort -rnwhich would put the biggest packges on top. That was purposely left out as the command is slightly on the slow side Also you may need to run this as root as some files can only be checked by du if you can read them ;) Show Sample Output5dpkg --get-selections | cut -f1 | while read pkg; do dpkg -L $pkg | xargs -I'{}' bash -c 'if [ ! -d "{}" ]; then echo "{}"; fi' | tr '\n' '\000' | du -c --files0-from - | tail -1 | sed "s/total/$pkg/"; done -
-f file(s) to be monitorized -n number of last line to be printed on the screen in this example, the content of two files are displayed
5tail -n 50 -f /var/log/apache2/access_log /var/log/apache2/error_log -
This command loops over all of the processes in a system and creates an associative array in awk with the process name as the key and the sum of the RSS as the value. The associative array has the effect of summing a parent process and all of it's children. It then prints the top ten processes sorted by size. Show Sample Output
5ps axo rss,comm,pid | awk '{ proc_list[$2]++; proc_list[$2 "," 1] += $1; } END { for (proc in proc_list) { printf("%d\t%s\n", proc_list[proc "," 1],proc); }}' | sort -n | tail -n 10 -
Using tail to follow and standard perl to count and print the lps when lines are written to the logfile.
5tail -f /var/log/logfile|perl -e 'while (<>) {$l++;if (time > $e) {$e=time;print "$l\n";$l=0}}' -
4tail -f <filename> | grep -C <# of lines to show above and below> <text>
-
Display the amount of memory used by all the httpd processes. Great in case you are being Slashdoted!
4ps -o rss -C httpd | tail -n +2 | (sed 's/^/x+=/'; echo x) | bc -
to download latest version of "util", maybe insert a sort if they wont be shown in right order. curl lists all files on mirror, grep your util, tail -1 will gets the one lists on the bottom and get it with wget Show Sample Output
4mirror=ftp://somemirror.com/with/alot/versions/but/no/latest/link; latest=$(curl -l $mirror/ 2>/dev/null | grep util | tail -1); wget $mirror/$latest -
4zcat access_log.*.gz | awk '{print $7}' | sort | uniq -c | sort -n | tail -n 20
-
This searches the Apache error_log for each of the 5 most significant Apache error levels, if any are found the date is then cut from the output in order to sort then print the most common occurrence of each error. Show Sample Output
4for i in emerg alert crit error warn ; do awk '$6 ~ /^\['$i'/ {print substr($0, index($0,$6)) }' error_log | sort | uniq -c | sort -n | tail -1; done -
Change the cut range for hits per 10 sec, minute and so on... Grep can be used to filter on url or source IP. Show Sample Output
4tail -f access_log | cut -c2-21 | uniq -c -
Netcat is used to serve a log-file over a network on port 1234. Point a browser to the specified server/port combo to view log-file updates in real-time.
4tail -f error_log | nc -l 1234 -
4tail -n2000 /var/www/domains/*/*/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | awk '{ if ($1 > 20)print $1,$2}'
-
This only works in bash
4diff <(tail -10 file1) <(tail -10 file2) -
Should be a bit more portable since echo -e/n and date's -Ins are not. Show Sample Output
4tail -f file | while read line; do printf "$(date -u '+%F %T%z')\t$line\n"; done -
when using named pipes only one reader is given the output by default. Also, most commands piped to by grep use a buffer which save output until tail -f finishes, which is not convenient. Here, using a combination of tee, sub-processes and the --line-buffered switch in grep we can workaround the problem.
4tail -f somefile |tee >(grep --line-buffered '1' > one.txt) |tee >(grep --line-buffered '2' > two.txt) -
This one is tried and tested for Ubuntu 12.04. Works great for tailing any file over http.
4(echo -e "HTTP/1.1 200 Ok\n\r"; tail -f /var/log/syslog) | nc -l 1234 -
This will show all changes in all log files under /var/log/ that are regular files and don't end with `gz` nor with a number Show Sample Output
4find /var/log -type f -iregex '.*[^\.][^0-9]+$' -not -iregex '.*gz$' 2> /dev/null | xargs tail -n0 -f | ccze -A -
This is useful for keeping an eye on an error log while developing. The !^ pulls the first arg from the previous command (which needs to be run in a sub-shell for this shortcut to work).
3(> errors.log) && tail -f !^ -
Use the aliased command 'nsl'
3alias nsl 'netstat -f inet | grep -v CLOSE_WAIT | cut -c-6,21-94 | tail +2' -
List top 20 IP from which TCP connection is in SYN_RECV state. Useful on web servers to detect a syn flood attack. Replace SYN_ with ESTA to find established connections Show Sample Output
3netstat -pant 2> /dev/null | grep SYN_ | awk '{print $5;}' | cut -d: -f1 | sort | uniq -c | sort -n | tail -20 -
Useful to e.g. keep an eye on several logfiles. Show Sample Output
3tail -f file1 (file2 .. fileN) -
In this case, I'm keeping an eye on /var/log/messages, but of course any file will do. When I'm following a file, I generally don't want to see anything other than what has been added due to the command or service I've executed. This keeps everything clean and tidy for troubleshooting.
3tail -n 0 -f /var/log/messages - < 1 2 3 4 > Last ›
What's this?
commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.
Check These Out
Stay in the loop…
- Follow the Tweets.
-
Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.
» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10 - Subscribe to the feeds.
-
Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):
Subscribe to the feed for:
- » all commands
- » commands with 3 up-votes (commandlinefu3)
- » commands with 10 up-votes (commandlinefu10)
- » commands using tail