Monitor Linux Server Logs in Real Time with tail

Why Real-Time Log Monitoring Matters

Server logs provide a continuous record of what is happening on a system. They capture application activity, web requests, authentication attempts, service failures, email delivery events, and much more.

While reviewing historical logs is useful for troubleshooting past incidents, monitoring logs in real time allows administrators to identify and resolve problems as they occur. This can significantly reduce downtime and help diagnose issues faster.

Linux includes several built-in tools for viewing live log activity, with the most common being the tail command.

Understanding the tail Command

The tail utility displays the end of a file. By default, it shows the last ten lines.

Example:

tail example.log

Output:

WordPress Web Hosting

Starting From $3.99/Monthly

Buy Now

Line 1
Line 2
Line 3
...
Last 10 lines of the file

This is useful when examining recently added log entries without opening an entire log file.

Following a Log File in Real Time

The most commonly used option is:

tail -f logfile.log

Example:

tail -f /var/log/messages

The -f flag means “follow”.

Instead of displaying the file once and exiting, tail remains active and continuously displays new log entries as they are written.

Example:

Cheap VPS Server

Starting From $2.99/Monthly

Buy Now

Jun 17 12:10:01 server sshd[1234]: Accepted password for admin
Jun 17 12:10:05 server sshd[1234]: Session opened
Jun 17 12:10:30 server systemd: Started backup service

As new events occur, additional lines appear automatically.

Stopping Real-Time Monitoring

To stop tail and return to the shell:

Ctrl + C

This safely terminates the monitoring session.

Displaying More Than Ten Lines

You can specify how many existing lines should be displayed before live monitoring begins.

Example:

tail -n 50 -f /var/log/messages

This displays the last 50 lines and then continues monitoring new entries.

Windows VPS Hosting

Remote Access & Full Admin

Buy Now

Common examples:

tail -n 20 -f logfile.log
tail -n 100 -f logfile.log
tail -n 500 -f logfile.log

Monitoring Apache Logs

One of the most common troubleshooting scenarios involves web server errors.

Apache Error Log

On many Linux servers:

tail -f /usr/local/apache/logs/error_log

Or:

tail -f /var/log/httpd/error_log

Or:

tail -f /var/log/apache2/error.log

depending on the distribution.

Apache Access Log

To monitor incoming website traffic:

tail -f /var/log/httpd/access_log

Or:

tail -f /var/log/apache2/access.log

Example output:

192.168.1.10 - - [17/Jun/2026:12:30:10 +0000] "GET / HTTP/1.1" 200
192.168.1.15 - - [17/Jun/2026:12:30:12 +0000] "POST /login HTTP/1.1" 302

This allows you to verify requests are reaching the server.

Troubleshooting Website Errors

Suppose a page generates a 500 Internal Server Error.

Start monitoring the error log:

tail -f /var/log/apache2/error.log

Then reproduce the issue in your browser.

A corresponding error will often appear immediately:

PHP Fatal error: Uncaught Error: Call to undefined function

This helps identify the exact cause of the problem.

Monitoring Nginx Logs

Error Log

tail -f /var/log/nginx/error.log

Access Log

tail -f /var/log/nginx/access.log

Example:

203.0.113.25 - - [17/Jun/2026:12:45:12 +0000] "GET /api/status HTTP/1.1" 200

Nginx logs are particularly useful when debugging reverse proxies, APIs, and high-traffic websites.

Monitoring Email Delivery Logs

Mail services generate detailed logs that help diagnose delivery failures.

Exim

tail -f /var/log/exim_mainlog

Example:

Completed

indicates Exim has finished handling that queue message; inspect its delivery or failure lines to establish the outcome.

Postfix

tail -f /var/log/maillog

Or:

tail -f /var/log/mail.log

Example:

status=sent

indicates acceptance by the next hop, not guaranteed placement in the recipient’s inbox.

Dovecot

tail -f /var/log/dovecot.log

Useful for troubleshooting IMAP and POP3 login issues.

Monitoring SSH Activity

To monitor SSH logins and authentication attempts:

AlmaLinux, CentOS, Rocky Linux

tail -f /var/log/secure

Ubuntu and Debian

tail -f /var/log/auth.log

Example:

Accepted password for admin

Or:

Failed password for invalid user

These logs help detect brute-force attacks and unauthorized access attempts.

Monitoring System Logs

systemd Journal

Modern Linux systems use systemd.

View live system logs:

journalctl -f

Equivalent to tailing the system journal.

Example:

Started Backup Service
Network interface eth0 up

Specific Service Logs

Monitor a single service:

journalctl -u nginx -f

Examples:

journalctl -u apache2 -f
journalctl -u mysql -f
journalctl -u sshd -f

This isolates output from a single service.

Monitoring MySQL and MariaDB Logs

Error logs are useful when diagnosing database crashes and startup failures.

Examples:

tail -f /var/log/mysqld.log

Or:

tail -f /var/log/mysql/error.log

Depending on configuration.

Example:

InnoDB: Starting crash recovery

Monitoring Multiple Logs Simultaneously

You can monitor multiple files at once.

Example:

tail -f access.log error.log

Output:

==> access.log <==
GET /index.php

==> error.log <==
PHP Fatal error

This is useful when troubleshooting web applications.

Filtering Logs with grep

Often you only want specific entries.

Example:

tail -f access.log | grep --line-buffered POST

Display only POST requests.

Monitor only errors:

tail -f error.log | grep --line-buffered -i error

Monitor a specific IP:

tail -f access.log | grep --line-buffered -F 203.0.113.25

Monitor failed logins:

tail -f /var/log/secure | grep --line-buffered Failed

Using less for Large Logs

For historical investigation:

less /var/log/messages

Search:

/error

Move forward:

n

Move backward:

Shift + N

Quit:

q

Monitoring Log Rotation Safely

Some logs are rotated automatically.

Standard tail may stop following after rotation.

To handle log rotation correctly:

tail -F /var/log/nginx/access.log

Notice the capital:

-F

Unlike -f, it automatically reconnects after log rotation.

This is generally preferred for long-term monitoring.

Advanced Real-Time Monitoring Tools

multitail

Monitor multiple logs in separate windows:

multitail /var/log/nginx/access.log /var/log/nginx/error.log

lnav

Interactive log analysis:

lnav

Provides searching, filtering, and SQL-style queries.

less +F

Follow mode inside less:

less +F logfile.log

Exit follow mode:

Ctrl + C

Common Log Locations

Paths depend on distribution and service configuration. If a file is absent, inspect the systemd journal and logging settings. Use sudo where required and protect logs that contain addresses, tokens or other sensitive data.

AlmaLinux / Rocky Linux / CentOS

/var/log/messages
/var/log/secure
/var/log/maillog
/var/log/httpd/access_log
/var/log/httpd/error_log

Ubuntu / Debian

/var/log/syslog
/var/log/auth.log
/var/log/mail.log
/var/log/apache2/access.log
/var/log/apache2/error.log

Nginx

/var/log/nginx/access.log
/var/log/nginx/error.log

Best Practices

• Use tail -F instead of tail -f for long-running sessions.
• Monitor logs while reproducing issues.
• Filter output with grep to reduce noise.
• Watch authentication logs for suspicious activity.
• Review web server logs during deployments.
• Combine journalctl and tail for complete troubleshooting.

Final Thoughts

Real-time log monitoring is one of the most effective troubleshooting techniques available to Linux administrators. Whether you are diagnosing website errors, investigating email delivery problems, monitoring authentication attempts, or verifying application deployments, tools like tail, journalctl, and grep provide immediate visibility into what is happening on your server.

Learning to monitor logs effectively allows you to identify issues faster, improve system reliability, and maintain a more secure hosting environment.