Linux head and tail Commands: View File Beginnings and Endings

The head and tail commands are essential tools for viewing portions of files in Linux. While head shows the beginning of a file, tail shows the end, making them perfect for log analysis and file inspection.

Basic Syntax

head [options] [file(s)]
tail [options] [file(s)]

Common Options

Head Options

• -n N: Show first N lines
• -c N: Show first N bytes
• -q: Never print headers
• -v: Always print headers

Tail Options

• -n N: Show last N lines
• -c N: Show last N bytes
• -f: Follow file changes
• -F: Follow and retry if file inaccessible
• --pid=PID: Exit when PID dies
• -q: Never print headers
• -v: Always print headers

Real-World Examples

1. Basic Usage

# View first 10 lines
$ head file.txt

# View last 10 lines
$ tail file.txt

# Specify number of lines
$ head -n 5 file.txt
$ tail -n 5 file.txt

2. Log Monitoring

# Follow log updates
$ tail -f /var/log/syslog

# Follow multiple logs
$ tail -f /var/log/apache2/access.log /var/log/apache2/error.log

# Follow with retry
$ tail -F /var/log/app.log

3. Combined Usage

# View middle of file
$ head -n 20 file.txt | tail -n 5

# Skip first 10 lines
$ tail -n +11 file.txt

Common Use Cases

1. Log Analysis

   # Monitor recent log entries
   tail -f /var/log/syslog
   
   # View recent errors
   tail -n 50 /var/log/apache2/error.log
   

2. File Inspection

   # Check file headers
   head -n 5 data.csv
   
   # View recent changes
   tail -n 20 changelog.txt
   

3. Data Processing

   # Skip header row
   tail -n +2 data.csv > data_no_header.csv
   
   # Get sample of data
   head -n 1000 large_dataset.csv > sample.csv
   

Tips and Tricks

1. Multiple Files

   # View beginnings of multiple files
   head -n 1 *.txt
   
   # Monitor multiple logs
   tail -f *.log
   

2. Byte Count

   # View first 100 bytes
   head -c 100 binary_file
   
   # View last 1KB
   tail -c 1024 large_file
   

3. Follow with Grep

   # Monitor specific patterns
   tail -f log.txt | grep "error"
   
   # Count occurrences
   tail -f access.log | grep -c "404"
   

Best Practices

1. Log Monitoring

   # Follow with timestamp
   tail -f log.txt | while read line; do echo "$(date) $line"; done
   

2. Resource Management

   # Exit when process ends
   tail -f log.txt --pid=1234
   

3. Error Handling

   # Handle missing files
   tail -f log.txt 2>/dev/null || echo "File not found"
   

Common Errors and Solutions

1. File Access

   # Permission denied
   sudo tail -f /var/log/secure
   
   # File doesn't exist
   tail -F non_existent.log  # Will wait for creation
   

2. Memory Usage

   # For very large files
   tail -c 1M large_file.log  # Last megabyte
   

3. Multiple File Headers

   # Suppress headers
   tail -q *.log
   

Related Commands

• less: Interactive file viewer
• cat: Concatenate files
• grep: Pattern matching
• watch: Execute command periodically

Advanced Usage

1. Custom Line Count

# View specific line range
sed -n '5,10p' file.txt

# Skip and take lines
tail -n +5 | head -n 5

2. Real-time Monitoring

# Monitor with highlighting
tail -f log.txt | grep --color=auto 'ERROR\|$'

# Monitor multiple patterns
tail -f log.txt | grep -E 'error|warning|critical'

3. Process Management

# Monitor until process ends
tail --pid=$(pgrep process_name) -f log.txt

# Follow multiple files with identification
tail -f *.log | sed 's/^/[&] /'

Scripting Examples

1. Log Rotation Check

#!/bin/bash
# Monitor log rotation
while true; do
    tail -F /var/log/app.log 2>/dev/null
    sleep 1
done

2. Error Monitoring

#!/bin/bash
# Monitor multiple logs for errors
tail -f /var/log/*.log | while read line; do
    if [[ $line == *"ERROR"* ]]; then
        echo "[$(date)] $line" >> errors.log
    fi
done

3. Data Processing

#!/bin/bash
# Process large file in chunks
total_lines=$(wc -l < large_file.txt)
chunk_size=1000

for ((i=1; i<=total_lines; i+=chunk_size)); do
    head -n $((i+chunk_size-1)) large_file.txt | tail -n $chunk_size
    # Process chunk
done

Remember that head and tail are essential tools for file inspection and log monitoring. While simple in concept, they become powerful when combined with other commands and used in scripts. The -f option of tail is particularly useful for real-time log monitoring and troubleshooting.