tail -100f logback-2020-01-21.log

有没有发现tail -500f 比 tail 500 还快速，也不知道为什么。

grep 粗过滤，细过滤
043001900104
10397758
大致过滤：
grep 10397758 logback-2020-02-07.log

如果数据比较多,加 | head -n 20：
grep 10397758 logback-2020-02-07.log | head -n 20

有的时候要定位异常，加-A 打印之后n行的数据：
grep -A 10 49558542 logback_h5_error-2020-02-07.log | head -n 50

grep过滤时间

一般日志以日期为单个文件，所以其实把小时区分下即可：

grep '2020-04-16 [1][24]:*' test.log  | head -n 50

查看最后k行

注：因为n很多时候作为命令参数，所以这里用k表示变量。

tail -n 5 test.txt # 查看后5行

查看前k行

注：这个命令是错的，tail命令没有负数的概念。

tail -n -5 test.txt # 错 tail命令没有负数的概念。

这两个命令是等效的(都表示最后5行)：

tail -n -5 test.txt
tail -n 5 test.txt 

即： tail -n k 是没有-k这种用法的。

那么用+5呢?
也不对，+5表是从第5行开始输出，直到最后。

head和tail简易理解

head -n 表示从开头到k行，负数表示从开头直到从最后排除k行(不包含k行内容)。
tail -n 表示结尾开始k行，加号(不是负数也不是正数而是加号)表示从结尾直到从开头第k行(这里包含第k行内容)。

head和tail作用范围示意图(推荐)

看文字绕来绕去不易理解，用excel标个颜色立刻就明白了。如图：

一行内容比较多时查看匹配文本左右内容

例如文本为：
zhangsan调用[企业信息333]接口失败调用[企业信息4444]接口失败调用[企业信息555]接口失败
命令：

grep -b 调用 test.txt  | head -c  50 | tail -c +20

注： tail -c后面是+号，写负数不对，写正数也不对。

tail命令文档

man tail | cat 命令即可获取文档。

内容：

man tail | cat
TAIL(1)                                                User Commands                                                TAIL(1)



NAME
      tail - output the last part of files

SYNOPSIS
      tail [OPTION]... [FILE]...

DESCRIPTION
      Print the last 10 lines of each FILE to standard output.  With more than one FILE, precede each with a header giving
      the file name.  With no FILE, or when FILE is -, read standard input.

      Mandatory arguments to long options are mandatory for short options too.

      -c, --bytes=K
             output the last K bytes; or use -c +K to output bytes starting with the Kth of each file

      -f, --follow[={name|descriptor}]
             output appended data as the file grows;

             an absent option argument means 'descriptor'

      -F     same as --follow=name --retry

      -n, --lines=K
             output the last K lines, instead of the last 10; or use -n +K to output starting with the Kth

      --max-unchanged-stats=N
             with --follow=name, reopen a FILE which has not

             changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case
             of rotated log files); with inotify, this option is rarely useful

      --pid=PID
             with -f, terminate after process ID, PID dies

      -q, --quiet, --silent
             never output headers giving file names

      --retry
             keep trying to open a file if it is inaccessible

      -s, --sleep-interval=N
             with  -f, sleep for approximately N seconds (default 1.0) between iterations; with inotify and --pid=P, check
             process P at least once every N seconds

      -v, --verbose
             always output headers giving file names

      --help display this help and exit

      --version
             output version information and exit

      If the first character of K (the number of bytes or lines) is a '+', print beginning with  the  Kth  item  from  the
      start  of each file, otherwise, print the last K items in the file.  K may have a multiplier suffix: b 512, kB 1000,
      K 1024, MB 1000*1000, M 1024*1024, GB 1000*1000*1000, G 1024*1024*1024, and so on for T, P, E, Z, Y.

      With --follow (-f), tail defaults to following the file descriptor, which means that  even  if  a  tail'ed  file  is
      renamed,  tail will continue to track its end.  This default behavior is not desirable when you really want to track
      the actual name of the file, not the file descriptor (e.g., log rotation).  Use --follow=name in  that  case.   That
      causes tail to track the named file in a way that accommodates renaming, removal and creation.

      GNU coreutils online help: <http://www.gnu.org/software/coreutils/> Report tail translation bugs to <http://transla‐
      tionproject.org/team/>

AUTHOR
      Written by Paul Rubin, David MacKenzie, Ian Lance Taylor, and Jim Meyering.

COPYRIGHT
      Copyright  ©  2013  Free   Software   Foundation,   Inc.    License   GPLv3+:   GNU   GPL   version   3   or   later
      <http://gnu.org/licenses/gpl.html>.
      This is free software: you are free to change and redistribute it.  There is NO WARRANTY, to the extent permitted by
      law.

SEE ALSO
      The full documentation for tail is maintained as a Texinfo manual.  If the  info  and  tail  programs  are  properly
      installed at your site, the command

             info coreutils 'tail invocation'

      should give you access to the complete manual.



GNU coreutils 8.22                                      August 2019                                                 TAIL(1)