A powerful debugging tool.

Most system administrators know the tail command. By default, it displays the 10 last lines of a file.

The -f option is less known. Besides displaying the last 10 lines of a file, it mainly provides a way to watch what is written into a file in real-time:

# tail -f /var/log/messages
Apr  4 20:30:01 vm systemd: Stopping user-0.slice.
Apr  4 20:31:35 vm systemd: Created slice user-0.slice.
Apr  4 20:31:35 vm systemd: Starting user-0.slice.
Apr  4 20:31:35 vm systemd: Started Session 961 of user root.
Apr  4 20:31:35 vm systemd-logind: New session 961 of user root.
Apr  4 20:31:35 vm systemd: Starting Session 961 of user root.
Apr  4 20:31:35 vm dbus[590]: [system] Activating service name='org.freedesktop.problems' (using servicehelper)
Apr  4 20:31:35 vm dbus-daemon: dbus[590]: [system] Activating service name='org.freedesktop.problems' (using servicehelper)
Apr  4 20:31:35 vm dbus[590]: [system] Successfully activated service 'org.freedesktop.problems'
Apr  4 20:31:35 vm dbus-daemon: dbus[590]: [system] Successfully activated service 'org.freedesktop.problems'
Apr  4 20:33:53 vm systemd: Started Session 962 of user root.
Apr  4 20:33:53 vm systemd-logind: New session 962 of user root.
Apr  4 20:33:53 vm systemd: Starting Session 962 of user root.
...

When debugging complicated situations involving several files, the tail command proves to be a invaluable tool. In fact, you can specify several files after the -f option and a header will be displayed each time something is written into a different file:

# tail -f /var/log/messages /var/log/secure
==> /var/log/messages <== 
Apr 4 20:51:07 vm systemd-logind: Removed session 963. 

==> /var/log/secure <== 
Apr 4 20:51:11 vm sshd[21933]: Accepted password for root from 94.23.44.29 port 47411 ssh2 

==> /var/log/messages <== 
Apr 4 20:51:11 vm systemd: Started Session 966 of user root. 
Apr 4 20:51:11 vm systemd-logind: New session 966 of user root. 

==> /var/log/secure <== 
Apr 4 20:51:11 vm sshd[21933]: pam_unix(sshd:session): session opened for user root by (uid=0)

==> /var/log/messages <==
Apr 4 20:51:11 vm systemd: Starting Session 966 of user root.

...

For example, OpenStack engineers use this kind of command to debug their configuration on compute nodes:

# tail -f /var/log/{ceilometer,neutron,nova,openvswitch}/*.log /var/log/syslog

When troubleshooting, using the tail command should become a reflex!