More last line linux

How to monitor only the last n lines of a log file?

I have a growing log file for which I want to display only the last 15 lines. Here is what I know I can do:

As the log file is filled, tail appends the last lines to the display. I am looking for a solution that only displays the last 15 lines and get rid of the lines before the last 15 after it has been updated. Would you have an idea?

That’s a good question. By today’s terminology one would say you want a widget for you shell script to do something like that if you want to have it all in one script in one shell (tmux would be an option otherwise). github.com/charmbracelet/gum is building something like that, but their features are not on this level yet.

6 Answers 6

It might suffice to use watch:

$ watch tail -n 15 mylogfile.txt

Be aware that this solution doesn’t work if the file grows more than 15 lines between two watch updates. You can use -n to change this interval.

If you use watch, try the -n option to control the interval between each update.

Thus, the following would call tail every 2 seconds

$ watch -n 2 tail -n 15 mylogfile.txt 

while this one polls it every 1 second

$ watch -n 1 tail -n 15 mylogfile.txt 

You could stream the logfile running less and pressing SHIFT + F that will stream the file using less. $ less mylogfile.txt Then just press SHIFT + F and it will stream. I think it is convenient for monitoring log files that update.

Indeed, not what I was looking for but close. You should also be able to use less +F mylogfile.txt as the manual says it it is similar in behavior to tail -f. If you, dear comment reader haven’t used less +G mylogfile.txt yet, then you now know how to immediately jump to the end of a log file. A useful and great time saver on old an poorly maintained systems.

Maybe you find the -d param handy.

-d Highlight the differences between successive updates. Option will read optional argument that changes highlight to be permanent, allowing to see what has changed at least once since first iteration.

In Solaris, AIX or HPUX or UNIX-like (including Linux) you can use scripts to monitoring logs or anything like that:

while true; clear; do date; echo ; echo "MONITORING LOG IN "/path/to/file.log": "; echo "Obs.: Last 20 lines of a logfile: echo ; tail -20 /path/to/file.log; echo ; sleep 5; done 

Old question, but I’ve decided to write myself a bash function that does exactly that. Pasting the script here for those who want it. » ntail » preserves the last N lines and has a timeout before updating the screen to minimize flickering effects when stdout updates too often.

You can try it out with the following example command, for which the screen updates should preserve the «date», but render a scrolling effect on the stdout of the for loop:

date; for i in $(seq 1 2000); do echo $i; sleep 0.03; done | ntail 10 

#!/bin/bash # Display last N lines of input like tail, but cleaning the screen before every update. # Example: date; for i in $(seq 1 2000); do echo $i; sleep 0.03; done | ntail 10 function ntail < # default to 10 lines of tail output NUM_LINES=$# gets the current time in milliseconds function mstime() < date +%s%3N >LAST_UPDATE=$(mstime) # last time the screen was updated NEEDS_REFRESH=false # whether to refresh the screen SCREEN_BUFFER_SIZE=0 # number of lines on the screen while IFS= read -r NEW_LINE; do # concatenate new the new line to the buffer TAIL_BUFFER="$TAIL_BUFFER$NEW_LINE"$'\n' # if last update is greater than 100ms, refresh screen if [ $(($(mstime) - LAST_UPDATE)) -gt 100 ]; then NEEDS_REFRESH=true fi # refresh screen if needed if [ "$NEEDS_REFRESH" = true ]; then # reduce buffer size to last NUM_LINES lines TAIL_BUFFER=$(echo "$TAIL_BUFFER" | tail -n "$NUM_LINES")$'\n' # clear the last SCREEN_BUFFER_SIZE lines, preserving the stdout above that for _ in $(seq 1 "$SCREEN_BUFFER_SIZE"); do printf "\033[1A\033[2K" done # print the new buffer printf "%s" "$TAIL_BUFFER" SCREEN_BUFFER_SIZE=$(echo "$TAIL_BUFFER" | wc -l) SCREEN_BUFFER_SIZE=$((SCREEN_BUFFER_SIZE - 1)) LAST_UPDATE=$(mstime) NEEDS_REFRESH=false fi done < /dev/stdin >ntail "$@" 

Источник

Print the last line of a file, from the CLI

I think the original question specified «awk» but since the question changed to be more generic, this answer made no sense. So I improved the answer a little bit. Overall, «tail» is a great solution, but «awk» might offer more nuanced control.

Use the right tool for the job. Since you want to get the last line of a file, tail is the appropriate tool for the job, especially if you have a large file. Tail’s file processing algorithm is more efficient in this case.

If you really want to use awk,

EDIT : tail -1 file deprecated

Is it a must to use awk for this? Why not just use tail -n 1 myFile ?

@yael Not at all; tail -1 will be way faster than awk for a large file. I tried on an ~3m line file; tail was instantaneous while awk took .44s

@yael. tail is specifically meant for processing the file from the «end». Therefore, its faster than awk. Because awk processes files from the beginning. The algorithms are different.

@yael is right — in the sence that awk (3B) is faster to type than tail (4B). When it comes to speed — well tail has a simpler task, and no script to parse before execution. However, @ghostdog74 is not right about «working from the end». If the input is piped, tail also needs to work from the beginning. And not to mention tail -n +N .

I wanted the first field of the last line of the file ( awk ‘END < print $1 >‘ ). While it’s not what the OP asked, the question helped and was easier to search for than «first field of last line of file»

Источник

What is the command to display the last TEN lines in file: /var/log/syslog

Welcome to Ask Ubuntu! @user260487: If my answer was helpful to you, then please consider marking it as the accepted answer so others may more easily find it in the future. This is also a polite way to thank the person answering your question for helping you out.

2 Answers 2

$ tail /var/log/syslog Mar 21 11:41:32 whoopsie[1194]: last message repeated 15 times Mar 21 11:42:32 whoopsie[1194]: last message repeated 20 times Mar 21 11:43:32 whoopsie[1194]: last message repeated 16 times Mar 21 11:44:32 whoopsie[1194]: last message repeated 14 times Mar 21 11:45:32 whoopsie[1194]: last message repeated 11 times Mar 21 11:46:32 whoopsie[1194]: last message repeated 16 times Mar 21 11:47:32 whoopsie[1194]: last message repeated 15 times Mar 21 11:48:32 whoopsie[1194]: last message repeated 14 times Mar 21 11:49:32 whoopsie[1194]: last message repeated 16 times Mar 21 11:50:32 whoopsie[1194]: last message repeated 22 times 

For default, tail shows last 10 lines of input file. To display more, there is an option -n .
From man tail :

-n, --lines=K output the last K lines, instead of the last 10; or use -n +K to output lines starting with the Kth 

$ tail -n 15 /var/log/syslog Mar 21 11:56:45 Karimov-Danil named[1122]: error (network unreachable) resolving './DNSKEY/IN': 2001:dc3::35#53 Mar 21 11:56:45 Karimov-Danil named[1122]: error (network unreachable) resolving './NS/IN': 2001:dc3::35#53 Mar 21 11:56:48 Karimov-Danil named[1122]: managed-keys-zone: Unable to fetch DNSKEY set '.': timed out Mar 21 11:56:51 Karimov-Danil whoopsie[1194]: online Mar 21 11:57:54 whoopsie[1194]: last message repeated 17 times Mar 21 11:58:58 whoopsie[1194]: last message repeated 16 times Mar 21 12:00:03 whoopsie[1194]: last message repeated 10 times Mar 21 12:01:03 whoopsie[1194]: last message repeated 16 times Mar 21 12:02:03 whoopsie[1194]: last message repeated 10 times Mar 21 12:03:03 whoopsie[1194]: last message repeated 17 times Mar 21 12:04:03 whoopsie[1194]: last message repeated 14 times Mar 21 12:05:03 whoopsie[1194]: last message repeated 17 times Mar 21 12:06:03 whoopsie[1194]: last message repeated 13 times Mar 21 12:07:04 whoopsie[1194]: last message repeated 16 times Mar 21 12:08:04 whoopsie[1194]: last message repeated 16 times 

Источник

How to display the last part of the file in the Linux system?

To display the last part of the file, we use the tail command in the Linux system.

The tail command is used to display the end of a text file or piped data in the Linux operating system. By default, it displays the last 10 lines of its input to the standard output. It is also complementary of the head command.

Syntax

The general syntax of the tail command is as follow −

Brief description of options available in the tail command.

Sr.No.	Option & Description
1	-c, —byte = [-]NUM Display the last NUM bytes of each file. Or -c +NUM to display starting with byte NUM of each file.
2	-f, —follow [ = ] Display appended data as the file grows.
3	-F Same as —follow =name —retry
4	-n, —lines [-]NUM Display the last NUM lines instead of the first 10.
5	—max-unchanged-starts = N With —follow = name, reopen a FILE which has not
6	—pid = PID With -f option, terminate after process ID, PID dies
7	-q, —quiet, —silent Never prompt headers giving file names
8	—retry Keep trying to open a file if it is not accessible
9	-v, —verbose Always display headers giving file names
10	-z, —zero-terminated Line delimiter is NULL, not newline
11	—help Displays a help message and then exits.
12	—version It gives info about the version and then exits.

By default, the tail command prints the last ten lines without any option as shown in this example.

First, we will create a file containing more than ten lines using the cat command in the Linux system as shown below.

$ cat >text.txt First line. Second line. Third line. Fourth line. Fifth line. Sixth line. Seventh line. Eighth line. Ninth line. Tenth line. Eleventh line.

Then, we will use the tail command in the Linux system to display the last ten lines.

$ head text.txt Second line. Third line. Fourth line. Fifth line. Sixth line. Seventh line. Eighth line. Ninth line. Tenth line. Eleventh line.

To prints the last n lines, we use -n or —lines option with the head command as shown below.

Suppose we want to display the last four lines of the text.txt file then we have to execute the command as shown below.

To check more information about the tail command, we use the —help option with the head command in the Linux operating system as shown below.

To check version information of the tail command, we use the —version option with the tail command in the Linux operating system as shown below.

Источник

Linux “more” Command with Examples

The cat command is a very handy tool when viewing short text files. However, when you have large files, it only gives you the last section of the file that constitutes the last few lines of the file. This compels you to scroll all the way up to start reading the file from the very beginning.

A better approach is to make use of the Linux more command. The command displays one section of the file at a time and allows you to comfortably scroll all the way to the end of the file.

In this guide, we look at the Linux more command and demonstrate how you can make the most out of it.

Basic Syntax

The Linux more command takes the following syntax:

Linux more Command Without Any Options

In its basic form, the more command displays the first section of the file. By pressing the “ENTER” key, you can scroll line by line, all the way to the bottom of the file.

Here, we are displaying the /etc/ssh/sshd_config file using the more command:

To scroll line by line, just press “ENTER”.

To sift through the configuration file page by page, tap on the “SPACE BAR” key.

Linux more Command with the -d Option

With the -d command option, the more command prompts you to either proceed to view the file by pressing the “SPACE” key or simply exit by pressing the “Q” key on the keyboard.

Display First N Lines of a File

In the first two examples, the more command displays the first section of the file. To display the very first 10 lines, for example, run the command below:

This displays the first 10 lines of the file, whereupon, you can continue scrolling normally by pressing the “ENTER” key.

Squeeze Blank Lines in a File

Multiple blank lines in a file can often be a put-off. If you have a file with multiple blank lines, you can remove them on display by simply using the -s option, as shown below

Use more Command to Read the Output of Another Command

Additionally, you can pipe the output of the cat command to more command as provided below. This is akin to invoking more command without any command options.

Those are some of the most commonly used more command options. For more options, visit the man pages.

Summary

Viewing large files can be a challenge using the basic cat command or text editors such as nano or vim. The Linux more command allows you to comfortably go over the file line by line or page by page.

About the author

Karim Buzdar

Karim Buzdar holds a degree in telecommunication engineering and holds several sysadmin certifications. As an IT engineer and technical author, he writes for various web sites. He blogs at LinuxWays.

Источник