I wanted the few remaining advantages of tail -f without leaving my beloved less; so I finally knuckled down and wrote a lightweight, portable sh function to handle the downsides - the key is to use tail to do the file-reading (to interleave multiple files and avoid reading hundred-gigabyte log files into memory), redirect into a temporary file, and then less +F that tempfile.

Here's my robust version; it also moves the filenames from interleaved (as tail -f prints them) up to the start of the logline. To avoid buffering, you'll need either unbuffer from 'expect', or stdbuf from 'coreutils' (although the function works without either):

https://gist.github.com/ELLIOTTCABLE/1c5afda811c1c4b822cf75361e8ded2f

Great tip, thanks :)

Thank you. Very usefull.

Super helpful

Wow... i found this article today and hell yeah this rocks!

Ah! This is awesome.

That's a great article!
Personally, I'm stick to the lnav tool (http://lnav.org/)
That's brilliant tool to dig into logs.

Could you update with a comparison to "tailf" which can watch files without causing disk usage in the way "tail -f" does? Does "less +F" also avoid the disk usage?

Hi Brian Storti.
I got a lot of good information.
I am working in Korea.
Can I translate and write on my company's tech blog?
Of course, I will reveal the source.
Thanks.

Sure, no problem.

Actually found it really useful, especially the comparison to 'tail -f' and the recommended use cases for each command. Thanks!

Great points shared in your post. Thanks for sharing this.

Very educative post. Thanks for taking the time to share this.

less do not pipe like this:
less +F /var/log/exim_mainlog | grep "something"

tail will, tail win

Agree

&something in less (can be combined with +F as well)

Open the file in emacs. Execute auto-revert-tail-mode (if it is not your default). Done.

OK, I tried that. Now how do I exit emacs?

Great article, thanks! http://histoire-bateaux-aviron.fr/

This will cause disasters for many cases for me, because I usually tail -f large log files.

less -W +F somelogfile

Using -W highlights the first (unread) new line after any forward movement such as scrolling to the next page.

Great article, thanks!

Fantastic article, thanks!

And also one should use -n with less, because counting lines in a 3GB log file could take more time than you want.

I switched back from less to tail recently as the default tool because tail is less prone to get messed up by terminal issues.

What do you mean by "terminal issues"?

Sometimes, when you are logged in remotely somewhere, and you scroll around in less, "weird things" happen. The cursor jumps around, key presses are not recognized properly, or something like that. It doesn't happen very often, but even 1 out of 100 made me annoyed enough that I went back to the simpler tool by default.

hm, it never really happened to me, but it's good to know. Thanks for sharing.

This is very cool. One issue I haven't resolved yet is that tailing (or should I say lessing) my rails development log is kind of wonky because less isn't handling the colors very well. I haven't tried to debug it yet but that would be a problem.

OK, 2 seconds of googling and I found the -r flag:

less -r +F log/development.log

-r tells less to always try to interpret color output.

To make things easier, you can also define the 'LESS' environment variable with some default options. e.g.: echo "export LESS=-R" >> ~/.bashrc"

Note tail -f will be more responsive (due to using inotify), but more importantly tail supports a -F mode which is what you probably want by default so that rotated log files are followed

You can use --follow-name with less. About the responsiveness, it was never really an issue for me, less' pooling works well enough for my needs, but if that's not your case, as I said, use the best tool for the job at hand.

I have same behavior in tmux+tail. Also please don't forget about ctrl+s/q in tail.

This is great, but if I want to execute this on a remote machine via a script (I'm using tail -f for viewing that machine's logs right now), it does not register the +F part... :-( any suggestions for that?

This is really helpful, I'm using tailf all day long and this is cool.

Another important consideration would be the slightly different `tail -F` which will survive log rotations.

Check out less' --follow-name

You cours use multitail which is Nice to use

If you use a screen multiplexer such as tmux, you can also delegate the scrolling and searching functions to it, allowing you to go back to basic tools such as cat and tail.

tail -F

Dig this! Question: any idea about the memory use of `less +F` vs `tail -f`? Little nervous about `less` keeping a couple gigs of logs in working memory.

Or, you could run tail -f in your shell mode in emacs, and then use your normal keybindings to search...

well, the biggest + for tail is: you can prese enter to insert empty lines on the screen, thenyou trigger a action and you can quickly see where the logs of your action started

don't tell me how to run my life, devil woman!

Maybe i am wrong but with less cant you pipe data into it so u can solve the other issue with multiple files like.

tail -f * | less +F

i don't have a shell in-front of me to test but if i am wrong please feel free to correct me.

Mac users: iTerm2 lets you scroll back indefinitely, and regex search the buffer. So if you find yourself in tail -f, then you can still find your way around.

when I do tail -f |less, that makes changing it to tail -f | grep or tail -f | awk sth faster. That is why people use it

For random browsing less +F is nice, and is my first use for seeing logs. However, most of the time the logs are way too verbose, so 'tail -f foo.log | grep bar | grep -v baz.com' is what I usually end up creating in short order.

tldr; you need to know both

And when you're already in less, you can turn on follow mode with F.