Watch Log Files in Realtime

By | 2009/09/08

A very useful tool in any kind of troubleshooting is checking out the log files. Whether you’re troubleshooting a system problem, monitoring a mail server or simply checking the visitors for a web server the log files are your best friend. There are a few ways to handle this.

Probably the most common command used to keep an eye on log files is tail. Here are a few examples:

tail -f /var/log/syslog

tail -n25 /var/log/mail.log

tail -F /var/log/lighttpd/error.log

You’ll notice that each command above used a different option. Let me explain what each does.

-f, –follow : output appended data as the file grows

-n, –lines: output the last N lines, instead of the last 10; or use +N to output lines starting with the Nth

-F: same as –follow –retry

–retry: keep trying to open a file even if it is inaccessible when tail starts or if it becomes inaccessible later

Also note that ctrl-c will stop the -f or –follow options.

One thing that I’ve learned in all my troubleshooting and administration is that the system almost always tells you what the problem is. The trick is to simply know where to look. /var/log/messages, /var/log/syslog and other files in the /var/log/ directory will almost surely have the answer.

3 thoughts on “Watch Log Files in Realtime

  1. Grant

    This is not rally connected to the above post but I can't find an answer on Google for this.

    I am looking for a way to monitor email bandwidth usage on my CentOS webserver, I host about 100 websites and get the total bandwidth but this is derived from the /var/log/httpd/access_log.

    I have installed Cacti and this gives me bandwidth at eth0 or lo but I cannot differentiate what is email or web.

    Please could you advise.

  2. Myles

    Have you tried following logs using 'less'.
    use 'f' to follow.
    G to jump to the end of the log

    'less' will allow you to stop following and search the log scroll back and forth and then continue to follow.

Comments are closed.