tail -f
tail -f --pid=PID# terminates after PID dies. The great thing about log files is that they constantly change as things happen on your system. The tail command shows you a snapshot of a file, and then deposits you back on the command line. Want to see the log file again? Then run tail again...and again...and again. Blech! With the -f (or --follow) option, tail doesn't close. Instead, it shows you the last 10 lines of the file (or a different number if you add -n to the mix) as the file changes, giving you a way to watch all the changes to a log file as they happen. This is wonderfully useful if you're trying to figure out just what is happening to a system or program. For instance, a web server's logs might look like this: Note In order to save space, I've removed the IP address, date, and time of the access.
$ tail -f /var/log/httpd/d20srd_org_log_20051201 "GET /srd/skills/bluff.htm HTTP/1.1"... "GET /srd/skills/senseMotive.htm HTTP/1.1"... "GET /srd/skills/concentration.htm HTTP/1.1"... "GET /srd/classes/monk.htm HTTP/1.1"... "GET /srd/skills/escapeArtist.htm HTTP/1.1"...
It's hard to represent in a book, but this file doesn't close. Instead, tail keeps it open, and makes sure that any new changes are shown. The file continues to scroll up, apparently forever or until you press Ctrl+c, which cancels the command and deposits you back on the command line. Try it with one of your log files, such as /var/log/syslog. Add in the q option to see only a certain number of lines to begin with, and then try it with two files, such as /var/log/syslog and /var/log/daemon.log, and see what happens (hint: It's remarkably similar to what you saw in "View the First 10 Lines of Several Files," but with constant updates). | 