tail -f: watch your system talk, live

tail -f /var/log/syslog

What it does

tail shows the end of a file. -f keeps following it as new lines arrive. On some systems the file is /var/log/auth.log, or you use journalctl -f.

Why it matters

Defenders watch logs live to catch failed logins and strange activity as it happens.