How to Monitor Linux Logs in Real Time with Tail, Multitail, Lnav, and Less

1. tail Command – Monitor Logs in Real Time

The most common way to follow a growing log file is the tail command. It has two variants: tail -f /var/log/apache2/access.log follows the file using the -f flag. tailf /var/log/apache2/access.log is a built‑in version that implicitly includes -f.

When logs are rotated, use -F so that tail switches to the newly created file: sudo tail -F /var/log/apache2/access.log If you only need the last few lines while following, combine -n with -f:

sudo tail -n2 -f /var/log/apache2/access.log

2. Multitail Command – Monitor Multiple Log Files in Real Time

Multitail can display several logs side by side and lets you scroll back through each file.

Installation commands:

$ sudo apt install multitail      # Debian & Ubuntu
$ sudo yum install multitail      # RedHat & CentOS
$ sudo dnf install multitail      # Fedora 22+

Example to watch both access and error logs simultaneously:

sudo multitail /var/log/apache2/access.log /var/log/apache2/error.log

3. lnav Command – Monitor Multiple Log Files in Real Time

Lnav provides similar multi‑file monitoring with a built‑in viewer.

Install it with:

$ sudo apt install lnav      # Debian & Ubuntu
$ sudo yum install lnav      # RedHat & CentOS
$ sudo dnf install lnav      # Fedora 22+

To open two logs at once:

sudo lnav /var/log/apache2/access.log /var/log/apache2/error.log

4. less Command – Display Real‑Time Output of Log Files

The less pager can also follow a file. Press Shift+F inside less, or start it with +F:

sudo less +F /var/log/apache2/access.log