Custom file monitoring
Command Line – tail
![© Lead Image photo by Andre Mouton on Unsplash © Lead Image photo by Andre Mouton on Unsplash](/var/linux_magazin/storage/images/issues/2019/223/command-line-tail/photobyandremoutononunsplash_peacock-tail.png/748126-1-eng-US/PhotobyAndreMoutononUnsplash_Peacock-tail.png_medium.png)
© Lead Image photo by Andre Mouton on Unsplash
When it comes to file monitoring, tail's replacements, colortail and MultiTail, offer more sophisticated control over how your information is displayed.
Pagers are a basic necessity for administering a system. That necessity is especially strong in Linux, where configuration settings are stored in text files. The best-known pagers, of course, are cat
, less
, and more
, all of which present the entire contents of a file. However, if you want to monitor a file over time, such as the logs in /var/log
or /tmp
, the required tool is one that displays the lines at the end of the file, where new information is appended. The original tool for this purpose is tail
, but, these days, it is increasingly being replaced by colortail
or MultiTail. All these commands share the same basic functionality, but the replacements offer more control over how information is displayed (Figure 1).
tail and colortail
The original command, of course, is tail
[1] (not to be confused with Tails Linux, which is used for secure browsing). By default, tail
displays the last 10 lines of a file that it is monitoring. However, you can use
--lines=NUMBER (-n NUMBER)
to change the number of lines to display. Alternately, you can use
--bytes=NUMBER (-c NUMBER)
to set the number of kilobytes to display. However, because you are dealing with text files, fine-tuning can be difficult. In addition, rather than counting from the end of the file, you can set where to start the display with c +KILOBYTES
.
Other options for tail
are few. With --max-unchanged-stats=REITERATIONS
, you can stop following a file if it remains unchanged after the defined number of updates. You can also use
--follow=NAME / DESCRIPTOR (-f)
to save output to a file.
This is a very limited set of options, which is probably why the latest release of Debian does not even bother to include the original command. Instead, it includes colortail
(Figure 2). Like the original tail
, colortail
[2] allows users to set the number of lines to display, although it dispenses with setting the display in kilobytes. It also includes the -f
option, which immediately displays any change in the hardware that a logfile is monitoring.
However, colortail
's main advantage is that it color codes each column in the display with the option:
--config=CONFIG-FILE (-k CONFIG-FILE)
For many, this color coding can make data easier to locate. If no configuration file is specified with the option, the default one is used. If you prefer, though, each file being viewed can use its own configuration file.
To create a colortail
configuration file, open a plain text file and create a map of the columns, using square brackets and hyphens to indicate the total number of spaces in the column. Somewhere in the map must be a color code (Listing 1). For example, the first column of the file is often a three letter abbreviation for the date, followed by the day, and then the time. In this case,
Mar 8 8:41 [-1--][--2--]
Listing 1
colortail Color Code Map
1 = magenta 2 = cyan 3 = green 4 = yellow 5 = brightblue 6 = brightred
this map would color the month magenta, and the day and time cyan.
MultiTail
Of all the tail
commands, MultiTail [3] is by far the most full-featured. Like tail
, it lets you view multiple files, but, unlike tail
, it uses ncurses to create sub-windows in the terminal window. In addition, it monitors wildcards intelligently, using the most recently modified match by default, which helps to monitor a directory of files. The command can also update the status line to show the arrival of new information, and, like colortail
, can be color-coded. The command can either display specific files, or, with the use of regular expressions, files in a specific directory (Figure 3).
Since MultiTail runs from the command line, it uses keyboard shortcuts to navigate the display. These shortcuts can select the active window, scroll and search, and change the display. The controls are not those used by most programs – for example, the arrow keys have no effect whatsoever within a file, although they do function in pop-up windows. However, a list of the available shortcuts is available when you press F1 (Table 1). Other pop-up windows, such as lists of files and windows, display when you need to make a choice (Figure 4).
Table 1
Selected Keyboard Shortcuts for MultiTail
Shortcut | Description |
---|---|
q |
Quit |
/ |
Search in all windows |
Shift + / |
Search in all windows and highlight results |
b |
Scroll back |
B |
Scroll back in all windows when merged into a single window |
e |
Enter a regular expression |
I |
Toggle case sensitivity in a search |
a |
Add a new file in a new window |
d |
Delete a file and its window from a display |
c |
Set or change colors |
C |
Edit RGB definition for a color |
b |
Scroll back in window buffer |
v |
Toggle vertical arrangement of windows |
0-9 |
Add bookmark to window |
R |
Reset a window |
y |
Set line wrap |
o |
Clear a window |
O |
Clear all windows |
g |
Take screenshot |
l |
List keybindings |
j |
Set window sizes |
z |
Hide window |
U |
Unhide all hidden windows |
P |
Toggle pause in window |
Other behaviors in MultiTail are set using command options. The default number of lines displayed depends on the window's size, but can be set precisely with -n <number of lines>
. Similarly, rather than have the same line repeated, you can set MultiTail to print the number of times that a message is repeated using –no repeat
, or indicate the lack of new messages with an "x" by adding --mark-interval x
. Alternatively, using --closeidle <number of seconds>
, you can set a window to close if no information is given in the time specified. Should you want to stop and restart the display of a file, you can use -r <number of seconds>
to set the interval before restarting. If you do restart, -R <number of seconds>
will show the difference between the current reading and the previous one.
Still other commands modify the display once it is running. For example, -q <number of seconds> "<path to files>"
allows new files to be added to a running display in separate windows, while -Q <number of seconds> "<path to files>"
displays them in a single window. These options are especially well-suited for watching a directory of files and for making full use of regular expressions. However, note that the path must be placed in quotation marks, so that the shell does not try to parse it.
Output from MultiTail can also be directed by options. The option -a FILE
saves the output. The file can be further defined by -S
, which prepends the file name with the window's sub-number. You can also send output directly to a command using -g COMMAND
for further editing or, perhaps, to take advantage of advanced search and replace tools like those in an advanced text editor like Bluefish or Kate.
Throughout MultiTail, standard regular expressions can be used. However, regular expressions are especially useful for scanning a directory of files for specific content. When a regular expression follows -e
, you can search for a specific string in the files listed in MultiTail. With -ex
, you can search for a command mentioned in a file and then execute it. More simply, you can use -ec
to generate a list of matches on the regular expression. Such commands can make analyzing the output of files much easier.
Customizing the Display
Many users may be content to use MultiTail's default display parameters. However, you can choose to customize the display as part of the command. Using -s NUMBER
, you can set the number of default columns. More specifically, you can follow -sw
with a comma-separated list that specifies the number of pixels in each column – for instance:
-sw 20, 30, 10, 10
The number of vertical rows can be set in the same way with the option -sn
. More generally, MultiTail's window height can be set with -wh NUMBER
; although if you specify a height greater than your screen, the height will be automatically adjusted.
Specific parts of the window can also be customized. Some users might want to add -ts
to give each line a time stamp, configuring the format in /etc/multitail.conf
(Figure 5). Other users might add -D
so as not to display the status line, or -du
to position the status line at the top of the window.
![](/var/linux_magazin/storage/images/issues/2019/223/command-line-tail/figure-5/748144-1-eng-US/Figure-5_large.png)
Numerous options for coloring different aspects of MultiTail and the contents of files can be set at the command line. However, since many color options depend on color schemes defined in /etc/multitail.conf
, you might prefer to edit that file directly instead. If nothing else, the comments in the file give detailed instructions about how to write a color scheme and the available colors and fields. Very likely, the only time you might want to override multitail.conf
from the command line is when you want to suppress the use of color altogether, either in a single file (-c
) or in a list of files (-C
).
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.