How do you watch a log file grow in real time?
Use tail -f file to print the last lines and keep following new lines as they are written. tail -F also survives log rotation by reopening the file when it is replaced, and Ctrl+C stops it.
Explain it simply
Think of watching a live cricket scoreboard: you do not reread the whole record book, you just look at the newest line as it appears. tail -f does that for a file.
tail alone prints the last 10 lines. -n 50 changes the count. -f (follow) keeps the command running and prints every new line appended to the file, until you press Ctrl+C.
Logs are often rotated: the old file is renamed and a new one is created. Plain -f follows the original file and goes silent after rotation, while tail -F (same as --follow=name --retry) keeps watching the name and picks up the new file.
You can follow several files at once, and pipe to grep to filter: tail -f app.log | grep ERROR.
Example
tail -n 20 /var/log/nginx/access.log
tail -F /var/log/nginx/error.log | grep --line-buffered "upstream"--line-buffered makes grep print each match straight away instead of waiting to fill a buffer.
What to say in the interview
"tail -f follows a file and prints appended lines live. I use -F in production so it keeps working after log rotation, and I combine it with grep to filter. For systemd services I would use journalctl -f instead."
Common mistakes
- Using -f on a rotated log and wondering why output stopped.