live tailing
tail needs a shell. Increasingly you don't have one.
Tailing works when you have a shell on the box. More and more often you don't — the service runs in a container you can't exec into, on a platform that only exposes logs over an authenticated HTTP endpoint, or on infrastructure that hands you a URL and nothing else.
If you do have a shell and a path to the file, use tail. This page says so four more times.
A concordance, in two halves.
The first four rows have a perfectly good CLI answer and are marked as such. The bottom five are where a pipeline runs out — not because it is badly made, but because a stream of text has no structure to filter on once it has gone past.
| Task | Shell | Logier Live Mode | Verdict |
|---|---|---|---|
| Follow a log as it's written | tail -f app.log | Connect Live Mode to a streaming endpoint | use tail |
| Follow through log rotation | tail -F app.log | The stream is the source; rotation is the server's problem | use tail |
| Only show errors | tail -f app.log | grep -i error | Toggle the error level — no reconnect | use tail |
| Work over SSH on a remote box | Already there | Not possible — desktop app | use tail |
| Change what you're filtering | Ctrl-C, edit the pipeline, run it again | Toggle a different level; the buffer is still there | use Logier |
| See how often it's happening | Not available | The timeline builds live as entries arrive | use Logier |
| Distinguish new errors from repeats | Not available | Clustering counts repeats; new signatures are flagged | use Logier |
| Keep what you saw after stopping | tail -f app.log | tee capture.log | Snapshot the buffer to the editor | use Logier |
| Authenticate to a protected source | Whatever SSH gives you | Custom request headers, including bearer tokens | use Logier |
Four rooms with a log in them and no door.
None of these are exotic. They are the ordinary shape of running software on someone else’s infrastructure.
- 01
A container you can't exec into
Locked down by policy, or running on a platform that simply doesn't offer a shell. The logs exist; the door doesn't.
- 02
A managed platform with a log URL
The provider exposes an authenticated HTTP endpoint that streams text, and considers that a complete answer. Often it is — if you have something to point at it.
- 03
A customer or vendor environment
Someone hands you an endpoint and a bearer token. You are not getting SSH access to their infrastructure, and you shouldn't expect to.
- 04
A Windows machine
tail isn't native here. The usual answers are Get-Content -Wait or a third-party binary, and neither parses levels or counts repeats.
A pipeline decides once, at the start.
tail -f app.log | grep -i error commits you to a question before you know what the answer looks like. Change your mind about the filter and you kill it, edit it, and restart — and everything that scrolled past in between is gone, because a pipe has no memory.
Live Mode holds a bounded buffer of what has arrived and parses each line into an entry as it lands. Filters run against the buffer rather than the future, so changing what you are looking at re-reads history instead of discarding it. The timeline builds while the stream runs, and clustering counts repeats as they arrive — so the fiftieth identical timeout increments a number rather than scrolling the interesting line off your screen.
Pausing records a real gap rather than stitching the chart back together, because a service that went quiet and a viewer that stopped listening are different claims.
when to just use tail
tail -f is still right more often than not.
If you have a shell on the machine and a path to the file, nothing here beats typing eleven characters. It is already installed, it composes with every other tool you have, and it works over SSH where a desktop application simply cannot follow.
The case for a GUI starts at the point where you cannot get that shell — or where you need to change what you are filtering without losing everything that already scrolled past. Outside those two situations, close this page and use tail.
faq
Common questions
keep reading
Related reading
- 01
Live Mode
The full feature: endpoints, auth headers, buffer limits, and the four things it is not.
- 02
Logier vs. lnav
lnav's follow mode survives rotation and works over SSH. The honest comparison.
- 03
Timeline view
The chart that builds itself while a stream runs, so you watch an incident form.
- 04
Logier vs. grep
The same argument for static files — when line matching is enough and when it isn't.
Tail what you can't SSH into.
Point Live Mode at any streaming endpoint you're already authorized to reach.