How do I watch a Linux log file as new events are written?
tail can print a recent excerpt and continue showing new lines. Use -F when a log may be renamed and recreated during rotation, because it follows the filename and retries. Watching a file does not change the application’s logging level or guarantee that buffered messages are written immediately.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Choose the exact application log
Confirm the application’s configured log path and your permission to read it. The sample path must be replaced with a real, authorised log.
sudo tail -n 50 -F -- /var/log/example/application.log-n 50 begins with a bounded excerpt. -F continues by name across normal log rotation. Use sudo only when the approved log permissions require it.
2. Reproduce one controlled event
While watching, perform the intended application action once, note its timestamp and correlate the new lines. Press Ctrl+C to stop tail when enough evidence has been captured; this does not stop the logged application.
Check the result
- The expected new event appears with a matching timestamp, and the watcher is stopped after the investigation.
Troubleshooting
- No new lines appear
- The application may log elsewhere, buffer output or be failing before it reaches that code path.
- tail reports the file is missing and keeps waiting
- -F deliberately retries. Verify the configured path rather than leaving a watcher on a guessed filename.
- The same error repeats rapidly
- Capture a short sample and investigate the cause; do not let an unbounded terminal stream substitute for log-rate monitoring.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.