First steps / Stage 9 of 15 · step 7 of 8

View and search inside files

~15 min

Not running Starting usually ~20 s

Situation

The backup ran overnight, and its log is ~/backup.log. In the morning a colleague asks how the backup ended and whether there were any errors. More than one program writes to this log, and each records errors in its own way.

Task

Make it so that:

~/last.txt holds the last 5 lines of ~/backup.log;
~/errors.txt holds every log line with the word error in any case, exactly as it is written in the log;
~/count.txt holds the number of those lines, a single number.

Lab goals

0 of 3

~/last.txt holds the last five log lines — not checked yet
~/errors.txt holds every line with the word error in any case — not checked yet
~/count.txt holds the number of those lines — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Text and search · picked for this lab

tail — the last lines and following a log

Cheat sheet

$_ — insert into the terminal

tail app.log the last 10 lines
tail -n 50 app.log the last 50 lines
tail -n +2 data.csv everything from line 2 on
tail -f /var/log/nginx/error.log follow; Ctrl+C to quit
tail -F app.log follow and survive log rotation
tail -n 0 -f app.log only new lines, no old ones
tail -f a.log b.log two files at once, with names
tail -f app.log | grep --line-buffered ERROR follow errors only

-n 50 and the short form -50 are the same. The +N in -n +N means "starting at line N". Full list — man tail.

Follow a log and see only errors

bash

tail -F /var/log/nginx/error.log | grep --line-buffered -i error

--line-buffered makes grep print matches right away instead of in batches.

Skip the header line

bash

tail -n +2 report.csv | sort -t, -k3 -n   # data without the header

The last lines of several logs at once

text

student@ubuntu:~$ tail -n 1 /var/log/dpkg.log /var/log/apt/history.log
==> /var/log/dpkg.log <==
2026-10-18 09:12:42 status installed man-db:amd64 2.12.0-4build2

==> /var/log/apt/history.log <==
End-Date: 2026-10-18  09:12:42

Stop following when a process ends

bash

tail -f build.log --pid=$(pgrep -n make)   # exits when make finishes

tail -f went quiet after log rotation

logrotate renamed the file and created a new one, while tail -f keeps reading the old one. Follow by name: tail -F reopens the file when it's replaced.

tail: cannot open: Permission denied

System logs are readable by root and the adm group. Use sudo tail, or check your groups: id shows whether you're in adm.

tail: cannot open 'x' for reading: No such file or directory

The file doesn't exist — maybe the service logs to journald instead of a file. Check ls /var/log/ and journalctl -u service -n 50.

New lines show up late

The program buffers its output, not tail. In a pipeline after tail -f, add --line-buffered to grep, or put stdbuf -oL before the command.

Ctrl+C doesn't bring the prompt back

Click the terminal so it has focus and press Ctrl+C again: without focus the browser gets the keystroke.

View and search inside files

Situation

Task

Signing in is needed to start the machine

Follow a log and see only errors

Skip the header line

The last lines of several logs at once

Stop following when a process ends

tail -f went quiet after log rotation

tail: cannot open: Permission denied

tail: cannot open 'x' for reading: No such file or directory

New lines show up late

Ctrl+C doesn't bring the prompt back