tail -n ?

[Gary Yu]

Hi all,

I'm trying to use "tail -1000 logfile" to get the last 1000 lines of a huge logfile. But I only got 310 lines, when I ran the same command on another file I only got 150 lines, is it a buffer size related issue or something else?

BTW, I don't want to use awk to get the result, because it takes long time to go through such huge file.

thanks,
Gary

[Darrell Allen]

Hi Gary,

From "man tail"...
"Tails relative to end-of-file are stored in a 20-Kbyte buffer, and thus are limited in length."

Search the forums for "tail limit" and you'll find a number of threads concerning this.

Darrell

[Martin Johnson]

"tail -1000 logfile" is obsolete. Try "tail -n 1000 logfile".

HTH
Marty

[Clemens van Everdingen]

Hi,

Since the answer is already there I can only add a hint.

Why not rotating the log file so you keep it small enough to search through.

See the example scripts at

http://www.introcomp.co.uk/examples/index.html

C.

[Darrell Allen · Accepted solution]

Although it's still best for you to search the forums, here's one I found:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x6cc8d06ed8c8d4118fef0090279cd0f9,00.html

Darrell

[Gary Yu]

thanks guys for the replies, I'm sure now that it's a buffer related problem. By searching the archived threads I found sed -n is a good workaround, it seems to be faster than 'awk NR > ??? ' But why HP won't upgrade the tail command to solve the 20k buffer issue?

[Helen French]

This issue has been solved on 11.11 version with patch - PHCO_24707. Check this document (TKB# DMLCNCKBRC00008118):
http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000063218431

[Helen French]

This is the patch description:
http://www1.itrc.hp.com/service/cki/patchDocDisplay.do?patchId=PHCO_24707

[paul fritzsche]

more | tail -1000

thats how you do it! =)

Regards Paul