Master Real-Time Log Monitoring on Linux with Tail, Multitail, Lnav & Less

On Linux, you can view log files in real time using several tools; the most common is the

tail

command.

1. tail Command – Monitor Logs in Real Time

The

tail

command is the most common way to view log files as they grow. Use the

-f

option to follow a file:

<code>$ sudo tail -f /var/log/apache2/access.log</code>

Alternatively, the

tailf

command has

-f

built‑in, so you can run:

<code>$ sudo tailf /var/log/apache2/access.log</code>

When logs are rotated, use

-F

to follow the name even if the underlying file descriptor changes:

<code>$ sudo tail -F /var/log/apache2/access.log</code>

To display only the last two lines while following, combine

-n

and

-f

:

<code>$ sudo tail -n2 -f /var/log/apache2/access.log</code>

2. Multitail Command – Monitor Multiple Log Files in Real Time

Install Multitail on Debian/Ubuntu, RedHat/CentOS, or Fedora:

<code>$ sudo apt install multitail   [On Debian & Ubuntu]</code>

<code>$ sudo yum install multitail   [On RedHat & CentOS]</code>

<code>$ sudo dnf install multitail   [On Fedora 22+]</code>

Example to view two logs simultaneously:

<code>$ sudo multitail /var/log/apache2/access.log /var/log/apache2/error.log</code>

3. lnav Command – Monitor Multiple Log Files in Real Time

Install lnav similarly:

<code>$ sudo apt install lnav   [On Debian & Ubuntu]</code>

<code>$ sudo yum install lnav   [On RedHat & CentOS]</code>

<code>$ sudo dnf install lnav   [On Fedora 22+]</code>

View two logs with lnav:

<code>$ sudo lnav /var/log/apache2/access.log /var/log/apache2/error.log</code>

4. less Command – Display Real‑Time Output of Log Files

Open a log with

less

and press

Shift+F

to follow the end of the file, similar to

tail -f

. You can also start less with the

+F

option:

<code>sudo less +F /var/log/apache2/access.log</code>