Custom file monitoring
Command Line – tail

© Lead Image photo by Andre Mouton on Unsplash
When it comes to file monitoring, tail's replacements, colortail and MultiTail, offer more sophisticated control over how your information is displayed.
Pagers are a basic necessity for administering a system. That necessity is especially strong in Linux, where configuration settings are stored in text files. The best-known pagers, of course, are cat
, less
, and more
, all of which present the entire contents of a file. However, if you want to monitor a file over time, such as the logs in /var/log
or /tmp
, the required tool is one that displays the lines at the end of the file, where new information is appended. The original tool for this purpose is tail
, but, these days, it is increasingly being replaced by colortail
or MultiTail. All these commands share the same basic functionality, but the replacements offer more control over how information is displayed (Figure 1).
tail and colortail
The original command, of course, is tail
[1] (not to be confused with Tails Linux, which is used for secure browsing). By default, tail
displays the last 10 lines of a file that it is monitoring. However, you can use
--lines=NUMBER (-n NUMBER)
to change the number of lines to display. Alternately, you can use
--bytes=NUMBER (-c NUMBER)
to set the number of kilobytes to display. However, because you are dealing with text files, fine-tuning can be difficult. In addition, rather than counting from the end of the file, you can set where to start the display with c +KILOBYTES
.
Other options for tail
are few. With --max-unchanged-stats=REITERATIONS
, you can stop following a file if it remains unchanged after the defined number of updates. You can also use
--follow=NAME / DESCRIPTOR (-f)
to save output to a file.
This is a very limited set of options, which is probably why the latest release of Debian does not even bother to include the original command. Instead, it includes colortail
(Figure 2). Like the original tail
, colortail
[2] allows users to set the number of lines to display, although it dispenses with setting the display in kilobytes. It also includes the -f
option, which immediately displays any change in the hardware that a logfile is monitoring.
However, colortail
's main advantage is that it color codes each column in the display with the option:
--config=CONFIG-FILE (-k CONFIG-FILE)
For many, this color coding can make data easier to locate. If no configuration file is specified with the option, the default one is used. If you prefer, though, each file being viewed can use its own configuration file.
To create a colortail
configuration file, open a plain text file and create a map of the columns, using square brackets and hyphens to indicate the total number of spaces in the column. Somewhere in the map must be a color code (Listing 1). For example, the first column of the file is often a three letter abbreviation for the date, followed by the day, and then the time. In this case,
Mar 8 8:41 [-1--][--2--]
Listing 1
colortail Color Code Map
1 = magenta 2 = cyan 3 = green 4 = yellow 5 = brightblue 6 = brightred
this map would color the month magenta, and the day and time cyan.
MultiTail
Of all the tail
commands, MultiTail [3] is by far the most full-featured. Like tail
, it lets you view multiple files, but, unlike tail
, it uses ncurses to create sub-windows in the terminal window. In addition, it monitors wildcards intelligently, using the most recently modified match by default, which helps to monitor a directory of files. The command can also update the status line to show the arrival of new information, and, like colortail
, can be color-coded. The command can either display specific files, or, with the use of regular expressions, files in a specific directory (Figure 3).
Since MultiTail runs from the command line, it uses keyboard shortcuts to navigate the display. These shortcuts can select the active window, scroll and search, and change the display. The controls are not those used by most programs – for example, the arrow keys have no effect whatsoever within a file, although they do function in pop-up windows. However, a list of the available shortcuts is available when you press F1 (Table 1). Other pop-up windows, such as lists of files and windows, display when you need to make a choice (Figure 4).
Table 1
Selected Keyboard Shortcuts for MultiTail
Shortcut | Description |
---|---|
q |
Quit |
/ |
Search in all windows |
Shift + / |
Search in all windows and highlight results |
b |
Scroll back |
B |
Scroll back in all windows when merged into a single window |
e |
Enter a regular expression |
I |
Toggle case sensitivity in a search |
a |
Add a new file in a new window |
d |
Delete a file and its window from a display |
c |
Set or change colors |
C |
Edit RGB definition for a color |
b |
Scroll back in window buffer |
v |
Toggle vertical arrangement of windows |
0-9 |
Add bookmark to window |
R |
Reset a window |
y |
Set line wrap |
o |
Clear a window |
O |
Clear all windows |
g |
Take screenshot |
l |
List keybindings |
j |
Set window sizes |
z |
Hide window |
U |
Unhide all hidden windows |
P |
Toggle pause in window |
Other behaviors in MultiTail are set using command options. The default number of lines displayed depends on the window's size, but can be set precisely with -n <number of lines>
. Similarly, rather than have the same line repeated, you can set MultiTail to print the number of times that a message is repeated using –no repeat
, or indicate the lack of new messages with an "x" by adding --mark-interval x
. Alternatively, using --closeidle <number of seconds>
, you can set a window to close if no information is given in the time specified. Should you want to stop and restart the display of a file, you can use -r <number of seconds>
to set the interval before restarting. If you do restart, -R <number of seconds>
will show the difference between the current reading and the previous one.
Still other commands modify the display once it is running. For example, -q <number of seconds> "<path to files>"
allows new files to be added to a running display in separate windows, while -Q <number of seconds> "<path to files>"
displays them in a single window. These options are especially well-suited for watching a directory of files and for making full use of regular expressions. However, note that the path must be placed in quotation marks, so that the shell does not try to parse it.
Output from MultiTail can also be directed by options. The option -a FILE
saves the output. The file can be further defined by -S
, which prepends the file name with the window's sub-number. You can also send output directly to a command using -g COMMAND
for further editing or, perhaps, to take advantage of advanced search and replace tools like those in an advanced text editor like Bluefish or Kate.
Throughout MultiTail, standard regular expressions can be used. However, regular expressions are especially useful for scanning a directory of files for specific content. When a regular expression follows -e
, you can search for a specific string in the files listed in MultiTail. With -ex
, you can search for a command mentioned in a file and then execute it. More simply, you can use -ec
to generate a list of matches on the regular expression. Such commands can make analyzing the output of files much easier.
Customizing the Display
Many users may be content to use MultiTail's default display parameters. However, you can choose to customize the display as part of the command. Using -s NUMBER
, you can set the number of default columns. More specifically, you can follow -sw
with a comma-separated list that specifies the number of pixels in each column – for instance:
-sw 20, 30, 10, 10
The number of vertical rows can be set in the same way with the option -sn
. More generally, MultiTail's window height can be set with -wh NUMBER
; although if you specify a height greater than your screen, the height will be automatically adjusted.
Specific parts of the window can also be customized. Some users might want to add -ts
to give each line a time stamp, configuring the format in /etc/multitail.conf
(Figure 5). Other users might add -D
so as not to display the status line, or -du
to position the status line at the top of the window.

Numerous options for coloring different aspects of MultiTail and the contents of files can be set at the command line. However, since many color options depend on color schemes defined in /etc/multitail.conf
, you might prefer to edit that file directly instead. If nothing else, the comments in the file give detailed instructions about how to write a color scheme and the available colors and fields. Very likely, the only time you might want to override multitail.conf
from the command line is when you want to suppress the use of color altogether, either in a single file (-c
) or in a list of files (-C
).
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
Linux Kernel Reducing Long-Term Support
LTS support for the Linux kernel is about to undergo some serious changes that will have a considerable impact on the future.
-
Fedora 39 Beta is Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.
-
UbuntuDDE 23.04 Now Available
A new version of the UbuntuDDE remix has finally arrived with all the updates from the Deepin desktop and everything that comes with the Ubuntu 23.04 base.
-
Star Labs Reveals a New Surface-Like Linux Tablet
If you've ever wanted a tablet that rivals the MS Surface, you're in luck as Star Labs has created such a device.