Tail More Than One File at a Time

MultiTail is an improvement on the well-known program tail, which allows you to view multiple files at the same time in the same window. It colorizes them, making viewing much easier. MultiTail is available as a package for most distros, and you can also install it from source.

By default MultiTail does the same thing as tail -f, i.e. watches files in real time. To watch two files at once, the basic usage is:

multitail /var/log/messages /var/log/auth.log

To scroll through the files, press ‘b’ and pick the file you want from the list. You’ll then get the last 100 lines of that file to scroll through using the cursor keys. You can also use ‘gg’/’G’ to go to the top/bottom of the scroll window. If you want more lines, exit the scroll window with ‘q’, hit ‘m’, and enter a new value for the number of lines to store.

Even better, instead of viewing the files in separate windows, you can merge them:

multitail -I /var/log/apache2/access.log /var/log/apache2/error.log

This makes it much easier to spot what’s going on just before and after an error occurs.

Another use of multitail is to view the output of commands, using -l. This works best with commands that you want to run repeatedly. For example, the manual suggests this for monitoring TCP connections:

multitail -R 3 -l "netstat -p tcp"

-R 3 sets the command to be rerun every three seconds, and displays only the difference between each run and the previous run (-r just reruns every 3 seconds, so you’ll just get the new output tacked onto the end of the screen every time).