Command Line – tail

Pagers are a basic necessity for administering a system. That necessity is especially strong in Linux, where configuration settings are stored in text files. The best-known pagers, of course, are cat, less, and more, all of which present the entire contents of a file. However, if you want to monitor a file over time, such as the logs in /var/log or /tmp, the required tool is one that displays the lines at the end of the file, where new information is appended. The original tool for this purpose is tail, but, these days, it is increasingly being replaced by colortail or MultiTail. All these commands share the same basic functionality, but the replacements offer more control over how information is displayed (Figure 1).

Figure 1: The tail family is especially useful for monitoring the system logs found in /var/log.

tail and colortail

The original command, of course, is tail [1] (not to be confused with Tails Linux, which is used for secure browsing). By default, tail displays the last 10 lines of a file that it is monitoring. However, you can use

--lines=NUMBER (-n NUMBER)

to change the number of lines to display. Alternately, you can use

--bytes=NUMBER (-c NUMBER)

to set the number of kilobytes to display. However, because you are dealing with text files, fine-tuning can be difficult. In addition, rather than counting from the end of the file, you can set where to start the display with c +KILOBYTES.

Other options for tail are few. With --max-unchanged-stats=REITERATIONS, you can stop following a file if it remains unchanged after the defined number of updates. You can also use

--follow=NAME / DESCRIPTOR (-f)

to save output to a file.

This is a very limited set of options, which is probably why the latest release of Debian does not even bother to include the original command. Instead, it includes colortail (Figure 2). Like the original tail, colortail [2] allows users to set the number of lines to display, although it dispenses with setting the display in kilobytes. It also includes the -f option, which immediately displays any change in the hardware that a logfile is monitoring.

Figure 2: colortail color codes by column in the output.

However, colortail's main advantage is that it color codes each column in the display with the option:

--config=CONFIG-FILE (-k CONFIG-FILE)

For many, this color coding can make data easier to locate. If no configuration file is specified with the option, the default one is used. If you prefer, though, each file being viewed can use its own configuration file.

To create a colortail configuration file, open a plain text file and create a map of the columns, using square brackets and hyphens to indicate the total number of spaces in the column. Somewhere in the map must be a color code (Listing 1). For example, the first column of the file is often a three letter abbreviation for the date, followed by the day, and then the time. In this case,

Mar  8 8:41
[-1--][--2--]

1 = magenta
2 = cyan
3 = green
4 = yellow
5 = brightblue
6 = brightred

this map would color the month magenta, and the day and time cyan.

MultiTail

Of all the tail commands, MultiTail [3] is by far the most full-featured. Like tail, it lets you view multiple files, but, unlike tail, it uses ncurses to create sub-windows in the terminal window. In addition, it monitors wildcards intelligently, using the most recently modified match by default, which helps to monitor a directory of files. The command can also update the status line to show the arrival of new information, and, like colortail, can be color-coded. The command can either display specific files, or, with the use of regular expressions, files in a specific directory (Figure 3).

Figure 3: MultiTail is the most fully-featured member of the tail family of commands.

Since MultiTail runs from the command line, it uses keyboard shortcuts to navigate the display. These shortcuts can select the active window, scroll and search, and change the display. The controls are not those used by most programs – for example, the arrow keys have no effect whatsoever within a file, although they do function in pop-up windows. However, a list of the available shortcuts is available when you press F1 (Table 1). Other pop-up windows, such as lists of files and windows, display when you need to make a choice (Figure 4).

Figure 4: Press F1 for a list of MultiTail keyboard shortcuts.

Other behaviors in MultiTail are set using command options. The default number of lines displayed depends on the window's size, but can be set precisely with -n <number of lines>. Similarly, rather than have the same line repeated, you can set MultiTail to print the number of times that a message is repeated using –no repeat, or indicate the lack of new messages with an "x" by adding --mark-interval x. Alternatively, using --closeidle <number of seconds>, you can set a window to close if no information is given in the time specified. Should you want to stop and restart the display of a file, you can use -r <number of seconds> to set the interval before restarting. If you do restart, -R <number of seconds> will show the difference between the current reading and the previous one.

Still other commands modify the display once it is running. For example, -q <number of seconds> "<path to files>" allows new files to be added to a running display in separate windows, while -Q <number of seconds> "<path to files>" displays them in a single window. These options are especially well-suited for watching a directory of files and for making full use of regular expressions. However, note that the path must be placed in quotation marks, so that the shell does not try to parse it.

Output from MultiTail can also be directed by options. The option -a FILE saves the output. The file can be further defined by -S, which prepends the file name with the window's sub-number. You can also send output directly to a command using -g COMMAND for further editing or, perhaps, to take advantage of advanced search and replace tools like those in an advanced text editor like Bluefish or Kate.

Throughout MultiTail, standard regular expressions can be used. However, regular expressions are especially useful for scanning a directory of files for specific content. When a regular expression follows -e, you can search for a specific string in the files listed in MultiTail. With -ex, you can search for a command mentioned in a file and then execute it. More simply, you can use -ec to generate a list of matches on the regular expression. Such commands can make analyzing the output of files much easier.

Customizing the Display

Many users may be content to use MultiTail's default display parameters. However, you can choose to customize the display as part of the command. Using -s NUMBER, you can set the number of default columns. More specifically, you can follow -sw with a comma-separated list that specifies the number of pixels in each column – for instance:

-sw 20, 30, 10, 10

The number of vertical rows can be set in the same way with the option -sn. More generally, MultiTail's window height can be set with -wh NUMBER; although if you specify a height greater than your screen, the height will be automatically adjusted.

Specific parts of the window can also be customized. Some users might want to add -ts to give each line a time stamp, configuring the format in /etc/multitail.conf (Figure 5). Other users might add -D so as not to display the status line, or -du to position the status line at the top of the window.

Figure 5: MultiTail's configuration file is the easiest place to customize columns, colors, and other aspects of the display.

Numerous options for coloring different aspects of MultiTail and the contents of files can be set at the command line. However, since many color options depend on color schemes defined in /etc/multitail.conf, you might prefer to edit that file directly instead. If nothing else, the comments in the file give detailed instructions about how to write a color scheme and the available colors and fields. Very likely, the only time you might want to override multitail.conf from the command line is when you want to suppress the use of color altogether, either in a single file (-c) or in a list of files (-C).