linux上tail命令

The Linux tail command displays data from the end of a file. It can even display updates that are added to a file in real-time. We show you how to use it.

Linux tail命令从文件末尾显示数据。 它甚至可以实时显示添加到文件中的更新。 我们向您展示如何使用它。

系统杀死了尾巴吗？ (Did systemd Kill tail?)

The tail command shows you data from the end of a file. Usually, new data is added to the end of a file, so the tail command is a quick and easy way to see the most recent additions to a file. It can also monitor a file and display each new text entry to that file as they occur. This makes it a great tool to monitor log files.

tail命令向您显示文件末尾的数据。 通常，新数据会添加到文件的末尾，因此tail命令是查看文件最新添加的快速简便的方法。 它还可以监视文件，并在文件出现时显示该文件的每个新文本条目。 这使其成为监视日志文件的好工具。

Many modern Linux distributions have adopted the systemd system and service manager. This is the first process executed, it has process ID 1, and it is the parent of all other processes. This role used to be handled by the older init system.

许多现代Linux发行版都采用systemd系统和服务管理器。 这是第一个执行的进程，其进程ID为1 ，并且是所有其他进程的父级。 该角色曾经由较早的init系统处理。

Along with this change came a new format for system log files. No longer created in plain text, under systemd they are recorded in a binary format. To read these log files, you must use the journactl utility. The tail command works with plain text formats. It does not read binary files. So does this mean the tail command is a solution in search of a problem? Does it still have anything to offer?

随之而来的是系统日志文件的新格式。 不再以纯文本创建，而是在systemd下以二进制格式记录。 要读取这些日志文件，必须使用journactl实用程序。 tail命令适用于纯文本格式。 它不读取二进制文件。 那么，这是否意味着tail命令是寻找问题的解决方案？ 它还有什么可提供的吗？

There’s more to the tail command than showing updates in real-time. And for that matter, there are still plenty of log files that are not system generated and are still created as plain text files. For example, log files generated by applications haven’t changed their format.

tail命令比实时显示更新要多。 因此，仍然有许多不是系统生成的日志文件，而是仍然创建为纯文本文件。 例如，应用程序生成的日志文件没有更改其格式。

使用尾巴 (Using tail)

Pass the name of a file to tail and it will show you the last ten lines from that file. The example files we’re using contain lists of sorted words. Each line is numbered, so it should be easy to follow the examples and see what effect the various options have.

将文件名传递到tail ，它将显示该文件的最后十行。 我们正在使用的示例文件包含排序单词列表。 每行都有编号，因此应该容易遵循示例并了解各种选项的作用。

tail word-list.txt

To see a different number of lines, use the -n (number of lines) option:

要查看不同的行数，请使用-n (行数)选项：

tail -n 15 word-list.txt

Actually, you can dispense with the “-n”, and just use a hyphen “-” and the number. Make sure there are no spaces between them. Technically, this is an obsolete command form, but it is still in the man page, and it still works.

实际上，您可以省去“ -n”，而只需使用连字符“-”和数字。 确保它们之间没有空格。 从技术上讲，这是一种过时的命令格式，但仍在手册页中，并且仍然有效。

tail -12 word-list.txt

将尾巴与多个文件一起使用 (Using tail With Multiple Files)

You can have tail work with multiple files at once. Just pass the filenames on the command line:

您可以一次处理多个文件的tail处理。 只需在命令行中传递文件名即可：

tail -n 4 list-1.txt list-2.txt list-3.txt

A small header is shown for each file so that you know which file the lines belong to.

每个文件都显示一个小标题，以便您知道行所属的文件。

从文件开始显示行 (Displaying Lines from the Start of a FIle)

The + (count from the start) modifier makes tail display lines from the start of a file, beginning at a specific line number. If your file is very long and you pick a line close to the start of the file, you’re going to get a lot of output sent to the terminal window. If that’s the case, it makes sense to pipe the output from tail into less.

+ (从开始算起)修饰符使tail显示从文件开头开始的行，从特定行号开始。 如果您的文件很长，并且在文件的开头附近选择了一行，则将有很多输出发送到终端窗口。 如果是这种情况，就可以将tail的输出传递给less 。

tail +440 list-1.txt

You can page through the text in a controlled fashion.

您可以以受控方式翻阅文本。

Because there happen to be 20,445 lines in this file, this command is the equivalent of using the “-6” option:

因为此文件中恰好有20,445行，所以此命令等效于使用“ -6”选项：

tail +20440 list-1.txt

使用带尾字节 (Using Bytes With tail)

You can tell tail to use offsets in bytes instead of lines by using the -c (bytes) option. This could be useful if you have a file of text that was formatted into regular-sized records. Note that a newline character counts as one byte. This command will display the last 93 bytes in the file:

您可以通过-c (bytes)选项告诉tail使用字节而不是行的偏移量。 如果您有一个格式为常规大小的记录的文本文件，这可能会很有用。 请注意，换行符算作一个字节。 此命令将显示文件中的最后93个字节：

tail -c 93 list-2.txt

You can combine the -c (bytes) option with the + (count from the start of the file) modifier, and specify an offset in bytes counted from the start of the file:

可以将-c (字节)选项与+ (从文件开头算起)修饰符结合使用，并指定从文件开始算起的字节偏移量：

tail -c +351053 list-e.txt

尾部配管 (Piping Into tail)

Earlier, we piped the output from tail into less . We can also pipe the output from other commands into tail.

之前，我们将tail的输出通过管道传递到less 。 我们还可以将其他命令的输出通过管道传递给tail 。

To identify the five files or folders with the oldest modification times, use the -t (sort by modification time) option with ls , and pipe the output into tail.

要标识修改时间最久的五个文件或文件夹，请在ls使用-t (按修改时间排序)选项，并将输出通过管道传递到tail 。

ls -tl | tail -5

The head command lists lines of text from the start of a file. We can combine this with tail to extract a section of the file.  Here, we’re using the head command to extract the first 200 lines from a file. This is being piped into tail, which is extracting the last ten lines. This gives us lines 191 through to line 200. That is, the last ten lines of the first 200 lines:

head命令从文件开头列出文本行。 我们可以将其与tail结合使用以提取文件的一部分。 在这里，我们使用head命令从文件中提取前200行。 这是通过管道传递给tail ，它提取了最后十行。 这使我们从191行到200行。也就是说，前200行中的最后十行：

head -n 200 list-1.txt | tail -10

This command lists the five most memory-hungry processes.

此命令列出了五个最需要内存的进程。

ps aux | sort -nk +4 | tail -5

Let’s break that down.

让我们分解一下。

The ps command displays information about running processes. The options used are:

ps命令显示有关正在运行的进程的信息。 使用的选项是：

• a: List all processes, not just for the current user.

  a ：列出所有进程，而不仅限于当前用户。

• u: Display a user-oriented output.

  u ：显示面向用户的输出。

• x: List all processes, including those not running inside a TTY.

  x ：列出所有进程，包括不在TTY中运行的进程。

The sort command sorts the output from ps . The options we’re using with sort are:

sort命令对ps的输出进行sort 。 我们在sort中使用的选项是：

• n:  Sort numerically.

  n ：按数字排序。

• k +4: Sort on the fourth column.

  k +4 ：在第四列上排序。

The tail -5 command displays the last five processes from the sorted output. These are the five most memory-hungry processes.

tail -5命令显示排序后的输出中的最后五个进程。 这是五个最需要内存的过程。

使用尾巴实时跟踪文件 (Using tail to Track Files in Real-Time)

Tracking new text entries arriving in a file—usually a log file—is easy with tail. Pass the filename on the command line and use the -f (follow) option.

使用tail可以很容易地跟踪到达文件(通常是日志文件)中的新文本条目。 在命令行上传递文件名，然后使用-f (跟随)选项。

tail -f geek-1.log

As each new log entry is added to the log file, tail updates its display in the terminal window.

在将每个新日志条目添加到日志文件时，tail会更新其在终端窗口中的显示。

You can refine the output to include only lines of particular relevance or interest. Here, we’re using grep to only show lines that include the word “average”:

您可以优化输出以仅包括具有特定相关性或兴趣的行。 在这里，我们使用grep仅显示包含单词“ average”的行：

tail -f geek-1.log | grep average

To follow the changes to two or more files, pass the filenames on the command line:

要对两个或多个文件进行更改，请在命令行中传递文件名：

tail -f -n 5 geek-1.log geek-2.log

Each entry is tagged with a header that shows which file the text came from.

每个条目都标有标题，该标题显示文本来自哪个文件。

The display is updated each time a new entry arrives in a followed file. To specify the update period, use the -s (sleep period) option. This tells tail to wait a number of seconds, five in this example,  between file checks.

每当新条目进入后续文件时，显示内容都会更新。 要指定更新时间，请使用-s (睡眠时间)选项。 这告诉tail在文件检查之间等待几秒钟，在本示例中为五秒钟。

tail -f -s 5 geek-1.log

Admittedly, you can’t tell by looking at a screenshot, but the updates to the file are happening once every two seconds. The new file entries are being displayed in the terminal window once every five seconds.

不可否认，您无法通过查看屏幕截图来判断，但是文件更新每两秒钟发生一次。 每五秒钟在终端窗口中显示一次新文件条目。

When you are following the text additions to more than one file, you can suppress the headers that indicate which log file the text comes from. Use the -q (quiet) option to do this:

在将文本添加到多个文件中时，可以取消显示这些文本来自哪个日志文件的标题。 使用-q (安静)选项执行以下操作：

tail -f -q geek-1.log geek-2.log

The output from the files is displayed in a seamless blend of text. There is no indication which log file each entry came from.

文件的输出以无缝的文本混合显示。 没有指示每个条目来自哪个日志文件。

尾巴仍然有价值 (tail Still Has Value)

Although access to the system log files is now provided by journalctl, tail still has plenty to offer. This is especially true when it is used in conjunction with other commands, by piping into or out of tail.

尽管journalctl现在提供了对系统日志文件的journalctl ，但是tail仍然可以提供很多功能。 当它与其他命令配合使用时，尤其是通过将管道插入或拖出tail时，尤其如此。

systemd might have changed the landscape, but there’s still a place for traditional utilities that conform to the Unix philosophy of doing one thing and doing it well.

systemd可能已经改变了现状，但是传统实用程序仍然有一个地方，符合Unix哲学的一件事，就是做好。

翻译自: https://www.howtogeek.com/481766/how-to-use-the-tail-command-on-linux/

linux上tail命令