The head & tail command in Linux
head prints the first lines of a file and tail the last ones — ten by default. They are the natural tools for peeking at large files without loading them entirely, and tail in particular is a daily companion for anyone who works with servers, because tail -f follows a log file live as new lines are written to it.
How head & tail works
head is trivial: read from the start, stop after N lines — on a pipe or a file alike. tail on a regular file is cleverer: it seeks to the end and reads backwards until it has counted N newlines, so tailing the last lines of a multi-gigabyte log costs almost nothing. On a pipe, where seeking is impossible, tail must buffer as it reads — one of the few places the file-vs-stream distinction shows through.
Follow mode adds a loop: print the current end, then wait for the file to grow (via inotify on Linux, falling back to polling) and print the new bytes. The rotation trap lives here — plain -f follows the file descriptor, so when logrotate renames the file and creates a fresh one, -f keeps watching the old, now-renamed file in silence. -F follows the name, notices the swap and reopens. For anything long-running, -F is the correct spelling.
Syntax
head [-n N] FILE | tail [-n N] [-f] FILECommon options
| Option | What it does |
|---|---|
-n N | Print N lines instead of the default 10 (e.g. head -n 25 file). |
-c N | Print N bytes instead of lines. |
-f (tail) | Follow: keep the file open and print new lines as they are appended. Stop with Ctrl+C. |
-n +N (tail) | Start from line N to the end — tail -n +2 file skips a header line. |
How to use head & tail: examples
$ head server.logThe first 10 lines of the file.
$ head -n 3 data.csvJust the first 3 lines — perfect for checking a CSV header.
$ tail server.logThe last 10 lines — usually the most recent events in a log.
$ tail -n 100 app.log | grep ERRORSearch only the most recent part of a log.
$ tail -f /var/log/nginx/access.logWatch requests arrive in real time. The single most used debugging command on web servers.
$ tail -n +2 data.csvEverything except the first line — strip a CSV header before processing.
Real-world use cases for head & tail
Watching a deployment live
tail -f /var/log/app/deploy.log during a release shows each step as it happens; piped through grep --line-buffered ERROR it becomes a live failure detector. For anyone operating servers, tail -f is as fundamental as the prompt itself.
Sampling data files
A 10 GB CSV arrives. head -n 5 big.csv reveals the header and format instantly, without loading anything. head for the schema, tail for the freshest rows, wc -l for the size — the standard first contact with any large dataset.
Try head & tail yourself
This is a live sandbox with a small filesystem (documents/, notes.txt,
backup.sh…). Nothing you do here can break anything — experiment freely.
Try: head -n 2 notes.txt
Pro tips and common mistakes
- Prefer tail -F (capital) for logs: it survives log rotation by re-opening the file, where -f goes silent.
- Follow multiple logs at once: tail -f access.log error.log labels each chunk with its filename.
- Slice line ranges by combining: head -n 30 file | tail -n 11 prints lines 20–30.
- tail -n +2 data.csv skips the header row — the idiomatic prelude to piping a CSV into sort or awk.
Frequently asked questions about head & tail
What does tail -f do?
It prints the last lines of the file and then keeps waiting: every new line appended to the file appears immediately. It is the standard way to watch logs live. Press Ctrl+C to stop.
How do I see lines 20 to 30 of a file?
Combine both: head -n 30 file | tail -n 11 prints lines 20 through 30.
What is the difference between tail -n 5 and tail -n +5?
tail -n 5 prints the last five lines; tail -n +5 prints from line five to the end of the file.
Related commands
Print file contents, number lines, and join multiple files together.
grepFind lines matching a pattern in files or piped input — the workhorse of text search.