How do I watch a log file live as it is written on Linux?

What this covers

Guessing at a problem from a stale log is slow. Watching the file while the event happens shows you the exact line, in order, at the moment it is produced. The three commands below cover the whole job: check whether the file is being written at all, stream it live without interruption, and cross-check the same events through systemd's journal.

Symptom

Open the log and check that it is actually being written to

Open the file with the pager in follow mode: it shows the last screenful immediately and then keeps appending new lines, so you can tell at a glance whether anything is arriving at all. Press Ctrl+C to stop following, use the arrow keys to scroll back through earlier entries and read the context around the failure, then press F to resume following. Point it at your own log path — Debian/Ubuntu keep the system log at /var/log/syslog, RHEL/Fedora at /var/log/messages, and application logs usually under /var/log/<name>/. If no new line ever appears while you reproduce the problem, the process may be buffering output or writing somewhere else entirely.

$ less +F /var/log/syslog

Stream new lines live with tail -f

This is the actual fix: a plain, non-interactive stream that prints each new line as it lands. Run it in its own terminal or in a tmux/screen window and leave it open while you reproduce the problem, so nothing slips between manual refreshes. Substitute the path with the log file you are actually chasing. Success looks like a new line appearing within a second or two of the event you triggered; if the terminal stays empty, re-check that you are following the file the program writes to (many daemons have their own log path) and remember that some programs only flush their buffers when they exit.

$ tail -f /var/log/syslog

Cross-check the same events through the journal

If the log belongs to a systemd service, follow it from the journal at the same time. The journal prints the same messages with precise timestamps and unit metadata, which confirms you are watching the right source and that nothing is being dropped or rotated away mid-stream. Replace the unit name with the service you are debugging — list the candidates with systemctl list-units --type=service. If the journal shows lines that never appeared in your tail -f stream, the two are not looking at the same file, and the file you were following is the wrong one.

$ journalctl -u nginx.service -f

How to confirm it worked

New lines appear in the terminal within a second or two of the event you triggered, and the timestamps keep advancing while you watch. If a systemd service is involved, the journal shows the same messages with matching timestamps.

Sources

• less(1) — Linux manual page
  man7.org · community · 2026-09-17
  Evidence: less pages through a file with scroll, search (/), and navigation; +F follows appended data and -N shows line numbers.
• tail(1) — Ubuntu manpage
  Ubuntu · community · 2026-09-17
  Evidence: Ubuntu manpage describes --follow (-f) and -F, which follows the file by name and handles rotation
• tail(1) — man7.org
  man7.org · community · 2026-09-17
  Evidence: Man page documents tail's -f option to follow a file as it grows and -n to select the number of lines
• journalctl(1) - Query the systemd journal
  Ubuntu Manpages · technical · 2026-09-17
  Evidence: -f, --follow shows only the most recent journal entries, and continuously prints new entries as they are appended; -u filters by unit.

Last verified: 2026-09-22

Related guides