Follow a Linux application log with tail

Detailed practical guide

Prepare your workspace and inputs

Open two terminals on a test machine. In terminal A create a new temporary file and note its printed path. In terminal B use that exact path. Never substitute a real production file into the sample write or truncate operations.

Platform context: Linux with GNU tail and Bash. The first steps use a temporary synthetic log; production diagnostics are read-only.

Scenario to reproduce or investigate

An operator follows a rotated file descriptor and misses events in the newly created log path. A controlled fixture makes the difference between following a descriptor and a filename observable.

1. Create a synthetic append-only observation target

   Run the first two commands in terminal A and copy the resulting path. In terminal B start tail with zero historical lines and follow-by-name behavior. The one-second retry interval is expected behavior, not a guarantee of instant collection.

   Command, configuration or input

   Terminal A:
   practice_log=$(mktemp /tmp/sorlavit-tail.XXXXXX)
   printf "%s\n" "$practice_log"
   
   Terminal B, using the printed path:
   tail -n 0 -F /tmp/sorlavit-tail.REPLACE_ME

   Expected result · ผลที่ควรเห็น

   Terminal B waits without displaying earlier content. Its target is the newly created temporary file.

   If it fails · เมื่อไม่ผ่าน

   If tail reports a missing file, compare the complete temporary filename. Do not create a guessed production log path.

2. Append a recognizable event and test rotation

   In terminal A append the first event. Then move this synthetic log to a .1 name and create a new file at the original path with a second event. Follow-by-name mode should eventually reopen the new file and show the second event. These writes are only for the temporary fixture.

   Command, configuration or input

   printf "%s\n" "2026-11-04T09:00:00Z request=r1 outcome=ok" >> "$practice_log"
   mv -- "$practice_log" "$practice_log.1"
   printf "%s\n" "2026-11-04T09:01:00Z request=r2 outcome=denied" > "$practice_log"

   Expected result · ผลที่ควรเห็น

   Terminal B displays both r1 and, after reopening, r2. It may also report that the file was replaced.

   If it fails · เมื่อไม่ผ่าน

   If the new event is not visible, verify -F rather than only -f, the actual path and directory permissions. Check whether the application uses copy-truncate rotation, which has different timing and loss considerations.

3. Collect the actual incident evidence without modifying it

   For the real service, obtain its documented log path and use tail -n 100 for a bounded recent excerpt or tail -n 0 -F for a live observation interval. Record the start and end times and request IDs. Use the application or journal source if the service writes to stdout rather than a file.

   Command, configuration or input

   tail -n 100 -- /approved/application/log/path
   tail -n 0 -F -- /approved/application/log/path

   Expected result · ผลที่ควรเห็น

   The incident excerpt includes a known time window and can be correlated with the application request; no log clearing or restart is needed.

   If it fails · เมื่อไม่ผ่าน

   If expected events are missing, check the configured log destination and collector retention. An empty file is not evidence that the application processed no requests.

Recovery and cleanup

Stop tail with Ctrl+C. Delete only the two temporary files whose exact paths you recorded after the fixture; never remove the real log as cleanup. No production log needs restoration.

Apply to actual work and known limits

Use follow-by-name only when it matches the application’s rotation method. A local tail session is an observation tool, not a durable collector or a guarantee against log loss.

Authored against the cited documentation. Execution on the stated vendor product or physical equipment remains to be verified.