Linux tail and head Commands: Viewing File Beginning and End

When working with Linux servers, administrators constantly need to view files — especially logs, configuration files, and text documents. But what do you do when a file contains thousands or millions of lines? Opening it entirely makes no sense. That's exactly why the head and tail commands exist.

In this article, we'll explore how to effectively use these commands, examine real-world scenarios, and provide practical examples for everyday tasks.

What Are head and tail?

• head — command for viewing the beginning of a file (first lines).
• tail — command for viewing the end of a file (last lines).

These utilities are part of the standard GNU coreutils package and are available by default in all Linux distributions.

Why Do You Need Them?

Typical use cases:

• Viewing the latest log entries (tail).
• Real-time log monitoring (tail -f).
• Quick file format verification (head).
• Extracting the first N lines from a large file.
• Application debugging through logs.
• Analyzing the structure of large CSV/text files.

The head Command: Viewing File Beginning

Basic Syntax

head [options] file

Main Usage Examples

1. View first 10 lines (default):

head /var/log/syslog

By default, head outputs the first 10 lines of a file.

2. Specify number of lines:

head -n 20 /var/log/syslog

Or short notation:

head -20 /var/log/syslog

Outputs the first 20 lines.

3. View first N bytes:

head -c 100 /etc/passwd

Outputs the first 100 bytes of the file (useful for binary files).

4. View multiple files

head -n 5 /var/log/syslog /var/log/auth.log

When viewing multiple files, head adds a header with the filename.

5. Remove headers when working with multiple files:

head -q -n 5 /var/log/*.log

The -q (quiet) option hides filenames.

Practical head Examples

Check CSV file format:

head -n 3 data.csv

Quickly view the first few lines to understand the data structure.

Extract headers from a large file:

head -n 1 large_data.csv > headers.txt

Quick configuration file preview:

head -20 /etc/nginx/nginx.conf

Check file encoding:

head -c 50 file.txt | hexdump -C

The tail Command: Viewing File End

Basic Syntax

tail [options] file

Main Usage Examples

1. View last 10 lines (default)

tail /var/log/syslog

2. Specify number of lines

tail -n 50 /var/log/apache2/error.log

Or short form:

tail -50 /var/log/apache2/error.log

3. View from a specific line to the end:

tail -n +100 file.txt

Shows the file starting from line 100 to the end.

4. View last N bytes:

tail -c 200 /var/log/syslog

Real-time Monitoring: tail -f

The most useful feature of tail is the follow mode.

Basic usage:

tail -f /var/log/syslog

The command will continuously output new lines as they're added to the file. Press Ctrl+C to exit.

Start with last N lines and continue following:

tail -n 20 -f /var/log/nginx/access.log

Shows the last 20 lines, then continues outputting new ones.

Follow multiple files simultaneously:

tail -f /var/log/syslog /var/log/auth.log

Follow file even when it's recreated:

tail -F /var/log/application.log

The -F option (or --follow=name) is useful when the file might be rotated or recreated. The command will continue following even after log rotation.

Practical tail Use Cases

1. Monitor web server errors:

tail -f /var/log/nginx/error.log

Perfect for debugging web server issues in real-time.

2. Track Apache requests:

tail -f /var/log/apache2/access.log | grep "404"

Filter and show only 404 errors in real-time.

3. Monitor application logs:

tail -f /var/log/myapp/app.log | grep ERROR

4. Follow Docker container logs:

docker logs -f container_name

(Docker logs uses a similar mechanism internally).

5. Show recent system events:

tail -100 /var/log/syslog

6. Extract last lines from a large file:

tail -1000 huge_log.log > last_1000_lines.txt

Combining head and tail

A very powerful technique is combining both commands through a pipe (|).

Get lines 20 through 30:

head -n 30 file.txt | tail -n 10

1. head -n 30 — takes the first 30 lines.
2. tail -n 10 — takes the last 10 from those.

Result: lines 21 through 30.

Get lines 100 through 110:

head -n 110 large_file.txt | tail -n 10

Skip first 50 lines and take next 20:

tail -n +51 file.txt | head -n 20

Useful Combinations with Other Commands

Combining with grep

Show last lines with errors:

tail -1000 /var/log/syslog | grep -i error

Monitor logs with filtering:

tail -f /var/log/nginx/access.log | grep "POST"

Combining with awk

Show only IP addresses from logs:

tail -100 /var/log/nginx/access.log | awk '{print $1}'

Combining with wc

Count errors in the last 1000 lines:

tail -1000 /var/log/application.log | grep ERROR | wc -l

Combining with less

View last lines with scrolling capability:

tail -1000 /var/log/syslog | less

Useful Options and Flags

For head

For tail

Real-World Scenarios from Practice

Scenario 1: Debugging Application Crash

View last 100 lines before the error

tail -100 /var/log/myapp/application.log

If you need more context

tail -500 /var/log/myapp/application.log | grep -A 10 -B 10 "FATAL"

Scenario 2: Deployment Monitoring

Follow logs during deployment

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Scenario 3: Peak Load Analysis

Take last 10000 requests and analyze

tail -10000 /var/log/nginx/access.log | awk '{print $4}' | cut -d: -f1-2 | sort | uniq -c | sort -rn | head -20

Scenario 4: Log Rotation Verification

Follow file even during rotation

tail -F /var/log/application.log

Scenario 5: Data Export

Extract last 1000 records from log for analysis

tail -1000 /var/log/syslog > /tmp/last_1000_syslog.txt

Common Errors and Solutions

Error: "Permission denied"

tail: cannot open '/var/log/syslog' for reading: Permission denied

Solution: Use sudo

sudo tail /var/log/syslog

Problem: tail -f doesn't show new lines

Causes:

• Application is buffering output
• File isn't being modified
• Wrong file path

Solution: Verify the file is actually being updated

Check last modification time

ls -lh /var/log/syslog

Or

stat /var/log/syslog

Problem: tail -f stops working after log rotation

Solution: Use -F instead of -f

tail -F /var/log/application.log

Performance and Optimization

For Large Files

If the file is very large (gigabytes), head and tail commands work efficiently:

• head reads the file from the top and stops after the needed number of lines
• tail reads the file from the end, which takes slightly more time for very large files

Alternatives for Extremely Large Files

For files hundreds of gigabytes in size, consider:

sed for extracting specific lines

sed -n '1000,2000p' huge_file.txt

split for dividing file into parts

split -l 1000000 huge_file.txt part_

Cheat Sheet: When to Use head vs tail

Use head when:

• Need to check file structure
• Verify CSV headers
• Quickly preview configuration file beginning
• Extract first N lines for processing

Use tail when:

• Need latest log entries
• Debugging current issues
• Real-time log monitoring (with -f)
• Analyzing recent events

Conclusion

The head and tail commands are basic but incredibly powerful tools for working with files in Linux. They're especially useful when working with logs and large text files.

Key Takeaways:

head — for file beginning, tail — for file end

tail -f — must-have for log monitoring

tail -F — for logs with rotation

Combine with grep, awk, sed for powerful processing

Mastering these commands will significantly speed up your server work and simplify application debugging.

Additional Resources

Documentation:

man head — complete head documentation

man tail — complete tail documentation

Related Commands:

less — paginated file viewing

more — simplified viewing

cat — complete file output

grep — content search

Useful Combinations:

Complex monitoring

tail -f /var/log/nginx/*.log | grep --line-buffered "ERROR"

Time statistics

tail -10000 /var/log/syslog | awk '{print $1, $2, $3}' | uniq -c

Now you're ready to work efficiently with files in Linux!

Quick Reference Card

Most Used Commands:

View first 10 lines

head file.txt

View last 10 lines

tail file.txt

View first 20 lines

head -n 20 file.txt

View last 50 lines

tail -n 50 file.txt

Follow log in real-time

tail -f /var/log/syslog

Follow with rotation support

tail -F /var/log/application.log

Get lines 100-110

head -n 110 file.txt | tail -n 10

Monitor errors only

tail -f /var/log/nginx/error.log | grep ERROR

Last 1000 lines to file

tail -1000 app.log > last_1000.txt

Pro Tips:

Always use tail -F for rotated logs

Combine with grep for filtering

Use -q to suppress headers with multiple files

tail -n +N starts from line N

Press Ctrl+C to stop tail -f

Happy Linux administration!