tail and head: show the end or start of a file

Updated November 2026

tail prints the end of a file, and with -f it keeps printing new lines as they are written. That makes it the classic way to watch a log while you test something. head prints the beginning.

Examples

tail /var/log/nginx/error.log           # last 10 lines
tail -n 50 app.log                      # last 50 lines
tail -n +100 data.csv                   # from line 100 to the end
tail -f /var/log/nginx/access.log       # follow new lines (Ctrl+C to stop)
tail -F /var/log/app/app.log            # follow, even when the log is rotated
tail -f access.log error.log            # follow several files, with headers
tail -f access.log | grep --line-buffered " 500 "   # follow only server errors
head -n 5 data.csv                      # first 5 lines
head -n -3 file.txt                     # all but the last 3 lines (GNU)
head -c 100 binary.dat | xxd            # first 100 bytes

-f or -F?

tail -f follows the open file. When log rotation renames app.log to app.log.1 and creates a new app.log, -f keeps watching the old, now silent file. tail -F notices the new file and switches to it, so use -F for logs.

Logs in the journal

On systemd systems many services log to the journal instead of files. The equivalent of tail -f there is journalctl -f, or journalctl -u nginx -f for one service. See journalctl.

Combining with other tools

sed -n '20,30p' file.txt                 # lines 20 to 30 (instead of head | tail)
tail -n 1000 access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head   # top client IPs

When piping a followed log into grep, use --line-buffered so matches appear immediately.