Linux: Cat And Tac – Reverse File Browsing

I always wind up forgetting the “tac” command, but it is definitely useful! Normally when I am trying to track down issues, the command usually winds up looking like

[root@tsthost01 log]# tail -50 /var/log/messages | more
Apr 21 14:27:58 t1ps-db01 snmpd[2936]: Received SNMP packet(s) from UDP: [127.0.10.77]
Apr 21 14:28:13 127.0.10.99 last message repeated 9 times
Apr 21 14:28:13 127.0.10.99 snmpd[2291]: Connection from UDP: [127.0.10.77]
Apr 21 14:28:13 127.0.10.99 snmpd[2291]: Received SNMP packet(s) from UDP: [127.0.10.77]
Apr 21 14:28:13 127.0.10.99 snmpd[2291]: Connection from UDP: [127.0.10.77]
Apr 21 14:28:13 127.0.10.99 snmpd[2291]: Received SNMP packet(s) from UDP: [127.0.10.77]
Apr 21 14:28:13 127.0.10.99 snmpd[2291]: Connection from UDP: [127.0.10.77]
Apr 21 14:28:19 127.0.10.81 last message repeated 18 times
Apr 21 14:28:25 127.0.10.26 MultiModemiSMS last message repeated 2 time(s)
... truncated
--More--

Then I scroll through the results and how what I am looking for is in those 50 linues. Unfortunately the information nornally is not and I re-run the command adding “-100″ or “-200″ to replace the “-50″. That is definitely not the best way to do it.

The better way for searching from the end of large files is to use “tac” instead of “cat” or tail. It might be obvious, but “tac” is just “cat” reversed. Bellow are from the man pages of each command

NAME       cat - concatenate files and print on the standard output

NAME       tail - output the last part of files

NAME       tac - concatenate and print files in reverse

Below is an example of cat used to read a file.

root@kdesk-l:~# cat GreenEggs
Do you like
green eggs and ham?
I do not like them, Sam-I-am.
I do not like
green eggs and ham.

Would you like them
here or there?

I would not like them
here or there.
I would not like them anywhere.

Next is tac reading the same file. Notice the content has been read in reverse.

root@kdesk-l:~# tac GreenEggs
I would not like them anywhere.
here or there.
I would not like them

here or there?
Would you like them

green eggs and ham.
I do not like
I do not like them, Sam-I-am.
green eggs and ham?
Do you like

Hopefully you can see some benefit to using this, especially in conjunction with the “more” command.

[root@tsthost01 log]# tac messages | more

Below are some schenarios that tac would be good for
- Going through log files from newest events to old
- Reviewing Java error log files (normally waaayyyyy to much information in those)
- Checking mailserver or DNS server logs
- When needing to go through a file without knowing exactly what you need to use “grep” to search for

Notes:  The “tac” command is pretty much standard issue on Linux based systems. I tested this on RedHat, CentOS, and Ubuntu