Master Real-Time Log Monitoring on Linux with tail, multitail, lnav & less

1. tail Command – Monitor Logs in Real Time

The most common way to view logs as they grow is the tail command. It has two variants.

Basic usage with

-f

:

<code>$ sudo tail -f /var/log/apache2/access.log</code>

Using

tailf

(which has

-f

built‑in):

<code>$ sudo tailf /var/log/apache2/access.log</code>

When logs are rotated, use

-F

to follow the file descriptor across rotations:

<code>$ sudo tail -F /var/log/apache2/access.log</code>

To view only the last two lines in real‑time, combine

-n

and

-f

:

<code>$ sudo tail -n2 -f /var/log/apache2/access.log</code>

2. Multitail Command – Monitor Multiple Log Files in Real Time

Multitail can watch several logs simultaneously and lets you scroll back and forth.

Installation:

<code>$ sudo apt install multitail   [On Debian & Ubuntu]
$ sudo yum install multitail   [On RedHat & CentOS]
$ sudo dnf install multitail   [On Fedora 22+]</code>

Example – display Apache access and error logs together:

<code>$ sudo multitail /var/log/apache2/access.log /var/log/apache2/error.log</code>

3. lnav Command – Monitor Multiple Log Files in Real Time

lnav offers similar multi‑file monitoring capabilities.

Installation:

<code>$ sudo apt install lnav   [On Debian & Ubuntu]
$ sudo yum install lnav   [On RedHat & CentOS]
$ sudo dnf install lnav   [On Fedora 22+]</code>

View two logs at once:

<code>$ sudo lnav /var/log/apache2/access.log /var/log/apache2/error.log</code>

4. less Command – Display Real Time Output of Log Files

You can also use

less

and press Shift+F to follow a file, or start it with

+F

directly.

<code>sudo less +F /var/log/apache2/access.log</code>

These commands provide flexible ways to watch logs live, handle log rotation, and monitor multiple files simultaneously.