Linux tail命令示例
时间：2020-02-23 14:40:00 来源:igfitidea点击:
Linux tail命令输出文件的最后一部分。
有一个选项可以使文件保持打开状态以供进一步输入。
这使得使用日志文件非常有用，在日志文件中我们可以在事件发生时实时检查日志。
1. Linux tail命令语法
tail命令的语法为：
$tail [OPTION]... [FILE]...
所有选项和文件名都是可选的。
2.如果没有提供文件，tail将如何处理？
如果您不提供文件名结尾或者将其指定为连字符(-)，则将读取标准输入。
3.读取文件的最后10行
如果我们未指定任何选项，则尾部将读取文件的最后10行。
# tail error.log 2019-10-29 11:31:09.887840 [INFO] [16169] [APVH_recipes_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_recipes_Suphp73.sock.pid]. 2019-10-29 11:31:09.887968 [INFO] [16169] [APVH_recipes_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_recipes_Suphp73.sock 2019-10-29 11:31:09.896280 [INFO] [16169] [APVH_recipes_Sulsphp73:] add child process pid: 27035, procinfo: 0x2c5e2b0 2019-10-29 11:31:09.896396 [INFO] [16169] [APVH_recipes_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_recipes_Suphp73.sock.pid]. 2019-10-29 11:31:17.182067 [INFO] [16169] [APVH_golangd_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid]. 2019-10-29 11:31:17.182116 [INFO] [16169] [APVH_golangd_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_golangd_Suphp73.sock 2019-10-29 11:31:17.182991 [INFO] [16169] [APVH_golangd_Sulsphp73:] add child process pid: 27067, procinfo: 0x447cff0 2019-10-29 11:31:17.183048 [INFO] [16169] [APVH_golangd_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid]. 2019-10-29 11:31:20.641690 [INFO] [16169] [149.56.101.239:45604] [ACL] Access to context [/] is denied! 2019-10-29 11:31:27.245789 [INFO] [16169] [198.199.83.232:46876] [ACL] Access to context [/] is denied! #
4. Linux tail命令选项
| Short Option | Long Option | Description |
|---|---|---|
| -c | –bytes=K | output the last K bytes of the file. We can use "-c +K"; to output bytes starting with the Kth of each file. |
| -f | –follow[={name | descriptor}] |
| -n | –lines=K | output the last K lines, instead of the last 10; or use '-n +K' to output starting with the Kth line. |
| -q | –quiet, –silent | never output headers giving file names |
| –retry | keep trying to open a file if it is inaccessible | |
| -s | –sleep-interval=N | used with with -f to sleep for approximately N seconds (default 1.0) between iterations. |
| -v | –verbose | always output headers giving file names |
| –version | output version information and exit. |
如果K的第一个字符(字节或者行数)是'+'，则从每个文件的开头以第K个项目开始打印，否则，打印文件中的最后K个项目。
K可以有一个乘数后缀： b 512, kB 1000, K 1024, MB 10001000, M 10241024, GB 100010001000, G 102410241024, and so on for T, P, E, Z, Y.
使用–follow(-f)，tail缺省遵循文件描述符，这意味着即使重命名已尾的文件，tail也将继续跟踪其结尾。
当您确实要跟踪文件的实际名称而不是文件描述符(例如，日志轮换)时，这种默认行为是不可取的。在这种情况下，请使用–follow = name。
这会导致尾部以适应重命名，删除和创建的方式跟踪命名文件。
5. Linux tail命令示例
让我们看一下tail命令用法的一些示例。
5.1)限制尾输出中的行数
我们可以使用-n或者–lines选项来限制尾输出中的行数。
# tail -n 5 error.log # tail --lines=5 error.log
如果我们在选项值中使用+前缀，则输出将从文件中的该行号开始。
# wc -l error.log 27360 error.log # tail -n +27358 error.log 2019-10-29 13:09:35.142604 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock 2019-10-29 13:09:35.144320 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 18132, procinfo: 0x367c520 2019-10-29 13:09:35.144389 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. # tail --lines=+27358 error.log 2019-10-29 13:09:35.142604 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock 2019-10-29 13:09:35.144320 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 18132, procinfo: 0x367c520 2019-10-29 13:09:35.144389 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. #
5.2)限制tail输出中的字节数
我们可以使用-c或者–bytes选项从文件末尾输出指定的字节。
# tail -c 100 error.log [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. # tail --bytes=100 error.log [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. #
如果我们在选项值上使用+，则该字节中的文件数据将输出到控制台。
# ls -ltr error.log -rw-r--r--. 1 nobody nobody 3475359 Oct 29 13:15 error.log # tail -c +3475350 error.log ock.pid]. #
5.3)具有多个文件的Linux tail命令
我们可以传递多个文件名，并且输出将带有一个标头，其文件名后跟输出。
# tail -n 2 error.log error.log.2019_10_27 ==> error.log <== 2019-10-29 13:17:24.356633 [INFO] [16169] [APVH_golangd_Sulsphp73:] add child process pid: 19670, procinfo: 0x27af560 2019-10-29 13:17:24.356789 [INFO] [16169] [APVH_golangd_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_golangd_Suphp73.sock.pid]. ==> error.log.2019_10_27 <== 2019-10-27 20:26:31.050022 [INFO] [16169] [176.9.99.9:34084] [ACL] Access to context [/] is denied! 2019-10-27 20:26:31.216835 [INFO] [16169] [176.9.99.9:34118] [ACL] Access to context [/] is denied! #
我们可以使用-q选项进行静默输出。
合并多个文件的输出非常有用。
# tail -n 2 -q error.log error.log.2019_10_27 2019-10-29 13:18:44.095709 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 19947, procinfo: 0x4312b50 2019-10-29 13:18:44.095766 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. 2019-10-27 20:26:31.050022 [INFO] [16169] [176.9.99.9:34084] [ACL] Access to context [/] is denied! 2019-10-27 20:26:31.216835 [INFO] [16169] [176.9.99.9:34118] [ACL] Access to context [/] is denied! #
5.4)监视文件中的更改
我们可以使用-f选项来监视文件的进一步更改。
这是tail命令中使用最广泛的选项。
实时跟踪日志并进行调试非常有用。
[root@li1197-217 logs]# tail -f error.log 2019-10-29 13:22:31.719103 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 20640, procinfo: 0x384a9a0 2019-10-29 13:22:31.719172 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid]. 2019-10-29 13:22:32.176946 [INFO] [16169] [APVH_android_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. 2019-10-29 13:22:32.176979 [INFO] [16169] [APVH_android_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_android_Suphp73.sock 2019-10-29 13:22:32.177901 [INFO] [16169] [APVH_android_Sulsphp73:] add child process pid: 20645, procinfo: 0x2df6830 2019-10-29 13:22:32.177955 [INFO] [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. 2019-10-29 13:22:39.634710 [INFO] [16169] [APVH_javastr_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. 2019-10-29 13:22:39.634755 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock 2019-10-29 13:22:39.641576 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 20677, procinfo: 0x286e3b0 2019-10-29 13:22:39.641694 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid].
我们也可以使用-f选项查看多个文件。
[root@li1197-217 logs]# tail -f error.log lsrestart.log ==> error.log <== 2019-10-29 13:22:31.719103 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 20640, procinfo: 0x384a9a0 2019-10-29 13:22:31.719172 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid]. 2019-10-29 13:22:32.176946 [INFO] [16169] [APVH_android_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. 2019-10-29 13:22:32.176979 [INFO] [16169] [APVH_android_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_android_Suphp73.sock 2019-10-29 13:22:32.177901 [INFO] [16169] [APVH_android_Sulsphp73:] add child process pid: 20645, procinfo: 0x2df6830 2019-10-29 13:22:32.177955 [INFO] [16169] [APVH_android_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_android_Suphp73.sock.pid]. 2019-10-29 13:22:39.634710 [INFO] [16169] [APVH_javastr_Sulsphp73:]: locked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. 2019-10-29 13:22:39.634755 [INFO] [16169] [APVH_javastr_Sulsphp73:] remove unix socket for detached process: /tmp/lshttpd/APVH_javastr_Suphp73.sock 2019-10-29 13:22:39.641576 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 20677, procinfo: 0x286e3b0 2019-10-29 13:22:39.641694 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. ==> lsrestart.log <== Thu Oct 10 17:45:33 UTC 2019 restart, LSWS running: 1 Wed Oct 23 08:53:16 UTC 2019 restart, LSWS running: 1 Wed Oct 23 09:03:02 UTC 2019 restart, LSWS running: 1
我们还可以使用-f选项指定输出中的行数。
# tail -2f error.log 2019-10-29 13:28:46.086130 [INFO] [16169] [APVH_cultwpc_Sulsphp73:] add child process pid: 21976, procinfo: 0xd032210 2019-10-29 13:28:46.086193 [INFO] [16169] [APVH_cultwpc_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_cultwpc_Suphp73.sock.pid].
5.5)将tail命令与pipe和grep一起使用
有时我们只对尾部输出中的特定消息感兴趣。
我们可以将tail命令与pipe和grep一起使用，以过滤输出中的特定消息。
# tail -100f error.log | grep 'denied' 2019-10-29 13:21:49.170651 [INFO] [16169] [159.65.53.153:38448] [ACL] Access to context [/] is denied! 2019-10-29 13:22:00.991330 [INFO] [16169] [182.71.209.203:22089] [ACL] Access to context [/] is denied! 2019-10-29 13:25:47.188167 [INFO] [16169] [79.137.42.145:36674] [ACL] Access to context [/] is denied! 2019-10-29 13:25:52.668213 [INFO] [16169] [162.144.60.165:52886] [ACL] Access to context [/] is denied!
5.6)使用tail命令过滤另一个命令输出
我们可以将tail命令与另一个命令一起使用来过滤输出行。
当我们只对命令输出中的几行感兴趣时，这很有用。
# ls -ltr | tail -n 3 -rw-r--r--. 1 nobody nobody 24406 Oct 23 09:08 error.log.2019_10_23.02 -rw-r--r--. 1 nobody nobody 10486279 Oct 27 20:26 error.log.2019_10_27 -rw-r--r--. 1 nobody nobody 3494794 Oct 29 13:29 error.log #
# ls -ltr | tail -n +15 -rw-r--r--. 1 nobody nobody 10490954 Oct 21 09:42 error.log.2019_10_21 -rw-r--r--. 1 nobody nobody 10485856 Oct 22 07:44 error.log.2019_10_22 -rw-r--r--. 1 nobody nobody 10485809 Oct 22 14:16 error.log.2019_10_22.01 -rw-r--r--. 1 nobody nobody 5398751 Oct 23 08:29 error.log.2019_10_23 -rw-r--r--. 1 nobody nobody 61485 Oct 23 08:58 error.log.2019_10_23.01 -rw-r--r--. 1 root root 162 Oct 23 09:03 lsrestart.log -rw-r--r--. 1 nobody nobody 24406 Oct 23 09:08 error.log.2019_10_23.02 -rw-r--r--. 1 nobody nobody 10486279 Oct 27 20:26 error.log.2019_10_27 -rw-r--r--. 1 nobody nobody 3499801 Oct 29 13:34 error.log
5.7)打印tail版本
我们可以使用–version打印tail命令的版本。
# tail --version tail (GNU coreutils) 8.22 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Paul Rubin, David MacKenzie, Ian Lance Taylor, and Jim Meyering. #
5.8)tail命令的详细输出
如果使用verbose选项，则输出将带有文件名的标头。
# tail -v -n 2 error.log ==> error.log <== 2019-10-29 13:39:30.769561 [INFO] [16169] [APVH_javastr_Sulsphp73:] add child process pid: 24454, procinfo: 0x405b840 2019-10-29 13:39:30.769618 [INFO] [16169] [APVH_javastr_Sulsphp73:]: unlocked pid file [/tmp/lshttpd/APVH_javastr_Suphp73.sock.pid]. #
