Master Real-Time Log Monitoring on Linux with tail, multitail, lnav & less

1. tail Command – Monitor Logs in Real Time

The most common way to view logs as they grow is the tail command. It has two variants.

Basic usage with -f:

$ sudo tail -f /var/log/apache2/access.log

Using tailf (which has -f built‑in):

$ sudo tailf /var/log/apache2/access.log

When logs are rotated, use -F to follow the file descriptor across rotations:

$ sudo tail -F /var/log/apache2/access.log

To view only the last two lines in real‑time, combine -n and -f:

$ sudo tail -n2 -f /var/log/apache2/access.log

2. Multitail Command – Monitor Multiple Log Files in Real Time

Multitail can watch several logs simultaneously and lets you scroll back and forth.

Installation:

$ sudo apt install multitail   [On Debian & Ubuntu]
$ sudo yum install multitail   [On RedHat & CentOS]
$ sudo dnf install multitail   [On Fedora 22+]

Example – display Apache access and error logs together:

$ sudo multitail /var/log/apache2/access.log /var/log/apache2/error.log

3. lnav Command – Monitor Multiple Log Files in Real Time

lnav offers similar multi‑file monitoring capabilities.

Installation:

$ sudo apt install lnav   [On Debian & Ubuntu]
$ sudo yum install lnav   [On RedHat & CentOS]
$ sudo dnf install lnav   [On Fedora 22+]

View two logs at once:

$ sudo lnav /var/log/apache2/access.log /var/log/apache2/error.log

4. less Command – Display Real Time Output of Log Files

You can also use less and press Shift+F to follow a file, or start it with +F directly.

sudo less +F /var/log/apache2/access.log

These commands provide flexible ways to watch logs live, handle log rotation, and monitor multiple files simultaneously.