로그 실시간으로 확인하는 법 (tail -f)

리눅스 컴퓨터에서 실행시키는 프로그램들은 로그가 파일에 쌓이는 경우가 대부분이다. 이 로그들이 실시간으로 찍히는 것을 확인해본다.


1. 로그 실시간으로 확인하는 법 (tail -f)
AWS EC2 에서 만든 Ubuntu 컴퓨터에는 접속할 때마다 로그가 쌓이는 /var/log/auth.log 라는 파일이 있다. 이 파일을 먼저 열어본다.

- Ubuntu

ubuntu@ip-172-31-39-75:~$ cd /var/log
ubuntu@ip-172-31-39-75:/var/log$ ls
README              alternatives.log.2.gz  apt         auth.log.2.gz  btmp    cloud-init-output.log  dmesg       dpkg.log.2.gz   kern.log       kern.log.3.gz  lastlog  syslog.1     syslog.4.gz          wtmp
alternatives.log    amazon                 auth.log    auth.log.3.gz  btmp.1  cloud-init.log         dpkg.log    fontconfig.log  kern.log.1     kern.log.4.gz  private  syslog.2.gz  sysstat
alternatives.log.1  apport.log             auth.log.1  auth.log.4.gz  chrony  dist-upgrade           dpkg.log.1  journal         kern.log.2.gz  landscape      syslog   syslog.3.gz  unattended-upgrades
ubuntu@ip-172-31-39-75:/var/log$ cat auth.log
...
ubuntu@ip-172-31-39-75:/var/log$ vi auth.log

cat 명령어로 파일을 열면 내용이 많기 때문에 렉이 걸린다. 새로고침 후 다시 접속하여 vim 에디터로 살펴본다.

- Ubuntu vim

2025-11-29T00:32:25.275730+00:00 ip-172-31-39-75 sshd[411446]: Received disconnect from 38.19.156.18 port 47786:11: Bye Bye [preauth]
...
2025-11-29T01:20:47.762021+00:00 ip-172-31-39-75 sshd[412707]: Connection closed by 39.183.168.15 port 45146
                                                                                                                                                                                                 11101,1       Bot
:q

 

· ctrl + f : 한 페이지 내려감
· ctrl + b : 한 페이지 올라감
· shift + g : 가장 마지막 페이지
· gg : 첫 페이지

cat 명령어나 vim 에디터로 보는 방식은 지금까지 쌓인 로그만 볼 수 있고 실시간으로 확인할 수 없다.
실시간으로 쌓이는 로그를 보기 위해 tail -f 명령어를 입력한다.

# tail -f [파일명] : 파일의 마지막 10줄 출력 + 실시간으로 파일에 추가되는 내용 출력

- Ubuntu

ubuntu@ip-172-31-39-75:/var/log$ tail -f auth.log
2025-11-29T01:34:17.049293+00:00 ip-172-31-39-75 sshd[412764]: Disconnected from invalid user master 14.29.212.131 port 63968 [preauth]
2025-11-29T01:34:41.582573+00:00 ip-172-31-39-75 sshd[412766]: Received disconnect from 190.97.235.88 port 36468:11: Bye Bye [preauth]
2025-11-29T01:34:41.582728+00:00 ip-172-31-39-75 sshd[412766]: Disconnected from authenticating user root 190.97.235.88 port 36468 [preauth]
2025-11-29T01:35:01.102416+00:00 ip-172-31-39-75 CRON[412768]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2025-11-29T01:35:01.105290+00:00 ip-172-31-39-75 CRON[412768]: pam_unix(cron:session): session closed for user root
2025-11-29T01:35:44.190141+00:00 ip-172-31-39-75 sshd[412772]: Invalid user teste from 103.172.204.4 port 45232
2025-11-29T01:35:44.275891+00:00 ip-172-31-39-75 sshd[412772]: Received disconnect from 103.172.204.4 port 45232:11: Bye Bye [preauth]
2025-11-29T01:35:44.276107+00:00 ip-172-31-39-75 sshd[412772]: Disconnected from invalid user teste 103.172.204.4 port 45232 [preauth]
2025-11-29T01:36:07.926227+00:00 ip-172-31-39-75 sshd[412774]: Received disconnect from 190.97.235.88 port 48240:11: Bye Bye [preauth]
2025-11-29T01:36:07.926340+00:00 ip-172-31-39-75 sshd[412774]: Disconnected from authenticating user root 190.97.235.88 port 48240 [preauth]

tail -f 명령어를 입력해둔 채로 새로운 브라우저 창에서 Ubuntu 컴퓨터에 접속한다.

- Ubuntu

ubuntu@ip-172-31-39-75:/var/log$ tail -f auth.log
2025-11-29T01:34:17.049293+00:00 ip-172-31-39-75 sshd[412764]: Disconnected from invalid user master 14.29.212.131 port 63968 [preauth]
2025-11-29T01:34:41.582573+00:00 ip-172-31-39-75 sshd[412766]: Received disconnect from 190.97.235.88 port 36468:11: Bye Bye [preauth]
2025-11-29T01:34:41.582728+00:00 ip-172-31-39-75 sshd[412766]: Disconnected from authenticating user root 190.97.235.88 port 36468 [preauth]
2025-11-29T01:35:01.102416+00:00 ip-172-31-39-75 CRON[412768]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2025-11-29T01:35:01.105290+00:00 ip-172-31-39-75 CRON[412768]: pam_unix(cron:session): session closed for user root
2025-11-29T01:35:44.190141+00:00 ip-172-31-39-75 sshd[412772]: Invalid user teste from 103.172.204.4 port 45232
2025-11-29T01:35:44.275891+00:00 ip-172-31-39-75 sshd[412772]: Received disconnect from 103.172.204.4 port 45232:11: Bye Bye [preauth]
2025-11-29T01:35:44.276107+00:00 ip-172-31-39-75 sshd[412772]: Disconnected from invalid user teste 103.172.204.4 port 45232 [preauth]
2025-11-29T01:36:07.926227+00:00 ip-172-31-39-75 sshd[412774]: Received disconnect from 190.97.235.88 port 48240:11: Bye Bye [preauth]
2025-11-29T01:36:07.926340+00:00 ip-172-31-39-75 sshd[412774]: Disconnected from authenticating user root 190.97.235.88 port 48240 [preauth]





2025-11-29T01:36:41.640766+00:00 ip-172-31-39-75 ec2-instance-connect[412888]: Querying EC2 Instance Connect keys for matching fingerprint: SHA256:uHyGMwcBLu29pq0rc6ZYTEX2NSYfk4jQFhJ7Pw7E5/o
2025-11-29T01:36:41.672695+00:00 ip-172-31-39-75 ec2-instance-connect[412920]: Providing ssh key from EC2 Instance Connect with fingerprint: SHA256:uHyGMwcBLu29pq0rc6ZYTEX2NSYfk4jQFhJ7Pw7E5/o, request-id: 0e70ffc0-29c0-4d5f-837a-a8ccc47c1d80, for IAM principal: arn:aws:iam::984622551099:root
2025-11-29T01:36:42.760888+00:00 ip-172-31-39-75 ec2-instance-connect[413037]: Querying EC2 Instance Connect keys for matching fingerprint: SHA256:uHyGMwcBLu29pq0rc6ZYTEX2NSYfk4jQFhJ7Pw7E5/o
2025-11-29T01:36:42.793016+00:00 ip-172-31-39-75 ec2-instance-connect[413069]: Providing ssh key from EC2 Instance Connect with fingerprint: SHA256:uHyGMwcBLu29pq0rc6ZYTEX2NSYfk4jQFhJ7Pw7E5/o, request-id: 0e70ffc0-29c0-4d5f-837a-a8ccc47c1d80, for IAM principal: arn:aws:iam::984622551099:root
2025-11-29T01:36:43.246618+00:00 ip-172-31-39-75 sshd[412779]: Accepted publickey for ubuntu from 13.209.1.61 port 15290 ssh2: ED25519 SHA256:uHyGMwcBLu29pq0rc6ZYTEX2NSYfk4jQFhJ7Pw7E5/o
2025-11-29T01:36:43.248941+00:00 ip-172-31-39-75 sshd[412779]: pam_unix(sshd:session): session opened for user ubuntu(uid=1000) by ubuntu(uid=0)
2025-11-29T01:36:43.253586+00:00 ip-172-31-39-75 systemd-logind[621]: New session 15493 of user ubuntu.
^C

새로운 브라우저 창에서 Ubuntu 컴퓨터에 접속하는 순간 로그가 실시간으로 쌓이는 것을 확인할 수 있다. 새로운 브라우저 창에서 새로고침을 할 때마다 로그가 쌓이는 것도 확인할 수 있다.
tail -f 명령어를 종료하고 싶을 때 ctrl + c 를 누르면 된다.


참고링크 : https://www.inflearn.com/course/%EB%B9%84%EC%A0%84%EA%B3%B5%EC%9E%90%EB%8F%84-%EC%9D%B4%ED%95%B4%ED%95%A0-%EC%88%98-%EC%9E%88%EB%8A%94-%EB%A6%AC%EB%88%85%EC%8A%A4-%EC%9E%85

비전공자도 이해할 수 있는 리눅스 입문/실전| JSCODE 박재성 - 인프런 강의