How to Tail a Log File on Mac

You have a log that is still being written — a server that is running, a build that is churning, a script you started ten minutes ago — and you want to watch the lines arrive. Reopening the file every few seconds is not watching it.

What you want is an editor that stays pinned to the end of the file and shows you every line that lands there, without asking you anything and without counting those lines as edits of yours. That is what View ▸ Follow Tail does in Note My. Here is how to turn it on, what you see while it runs, how it behaves when the log rotates, and how to search a file that is still filling up.

Note

Follow Tail watches a file on disk, so point it at the path the output is landing in — the log a server appends to, the file a build writes, the output you redirected from a script. Whatever produced the lines, they arrive in the tab the same way.

Turn on Follow Tail

Open the log

Press ⌘O and choose the file, or drag it from the Finder onto the tab bar. A rotated file with an awkward name — access.log.1, or one with no extension at all — opens with ⇧⌘O, File ▸ Open Anything as Text….
Choose View ▸ Follow Tail

The editor pins itself to the end and stays there as new lines arrive. It is off until you ask for it, and one trip to the View menu is all it takes. The setting is per tab, so two logs open in two tabs are followed independently, and an ordinary document you have open alongside them carries on behaving like an ordinary document.

✎ Note My | build.log

…4122026-09-02T14:02:11Z INFO compiling module 41 of 96

…4132026-09-02T14:02:12Z INFO compiling module 42 of 96

…4142026-09-02T14:02:12Z WARN deprecated flag ignored

…4152026-09-02T14:02:13Z INFO compiling module 43 of 96

…4162026-09-02T14:02:14Z ERROR undefined symbol _pad_main

…4172026-09-02T14:02:14Z INFO compiling module 44 of 96

▍ Following

Lines 417 Aa UTF-8 Plain Text

Follow Tail pins the editor to the end of a growing file. Scroll up and it lets go so you can read; scroll back to the bottom and it resumes.
Read the status-bar badge

The file-monitor badge in the status bar tells you what the tab is doing: that the file is missing, that an external change is waiting for you, that monitoring is off, that the tab is following tail, auto-reloading, or simply watching. Glance at it when you are unsure you are still following. Every tab with a file on disk behind it carries the badge, and its menu puts Monitor File for Changes and Auto-Reload External Changes one click away for that tab alone — save a scratch tab once and it joins in.
Turn it off by choosing it again

Follow Tail is a toggle. Choose it a second time and the tab stops chasing the end and stays where you are reading, with everything that has arrived still in front of you. Each session also starts clean: a log you followed yesterday opens today as an ordinary tab and waits until you ask for it again.

What you see while it runs

New lines appear at the bottom of the tab as the other process writes them. You press nothing and reopen nothing. Our large-file engine keeps a log that has already grown enormous feeling much like a small one, so you can leave a busy server log following all afternoon and still scroll it comfortably.

If the Mac is briefly busy, nothing is lost. Whatever was written while you were not looking turns up at the end, in order. A pause in the flow is a pause in the writing, not a hole in what you are shown.

All of this happens on your Mac. Nothing is uploaded, there is no account, and the log never leaves the machine.

Scrolling back without losing the end

The editor stays pinned to the bottom only if you were already at the bottom. Scroll up to read the lines that just went past and the view stops chasing the end: new lines keep arriving at the end of the tab, you are simply not dragged along with them. Scroll back down to the bottom and it resumes. You toggle nothing, and you do not lose the tail by looking away from it.

That gives you the rhythm you want: let it run while you wait, scroll up when something catches your eye, then return to the bottom to rejoin the live end.

When the log rotates or is truncated

Rotation reaches you in one of two shapes: the file you are watching suddenly gets shorter, or a different file turns up at the same path. Neither one leaves you stranded, and the table says what to expect from each.

How **Note My** responds to each kind of change to a followed file
What happened to the file	What the tab does
Grew — appended	The new lines appear at the end. Stays at the bottom if you were there.
Truncated — shorter than it was	In tail mode, the tab starts again with the shorter file. This is the rotation case.
Replaced by a different file at the same path	Always prompts, whatever your change mode is set to.
Modified in place	Follows your File Monitor mode — Ask, Auto-Reload or Never.
Deleted	"«X» was deleted from disk." with Keep in Editor or Close Tab.
Attributes changed only	Ignored. A permissions change is not new content.

One detail is worth knowing about the "modified in place" row. With the change mode left on Ask — the default — a log you have not edited yourself keeps streaming quietly instead of stopping you with a sheet every time it grows. An ordinary working document such as server-log-notes.txt asks first before it reloads, which is exactly what you want for something you might be part-way through editing. If you would rather that tab did not ask either, set its change mode to Auto-Reload from the badge menu.

Undo stays yours while you follow

Watching a log fill up costs you nothing in undo history. ⌘Z never walks backwards through text a build server wrote. Undo steps through what you typed, in the order you typed it, however many thousands of lines have landed in the tab in the meantime.

Saving is quiet too. Save your own edit to a followed file and you are not then told that the file changed on disk — you already know. The prompts are kept for changes that came from somewhere else.

Encoding: settle it before you start watching

Our encoding handling keeps the arriving lines reading the same way as the rest of the document, which matters when the log is not UTF-8 — a legacy Western log full of Windows-1252 bytes, or CJK output in Shift JIS or GB18030.

The choice is yours to make, and one move settles it for the whole watch. File ▸ Encoding ▸ Reload with Encoding… reopens the file in the encoding you name, and every line that lands afterwards reads the same way. A legacy log tells you it wants this on the very first screen — accented letters arriving as pairs of symbols, or a run of question marks where the words should be — so settle it there and then, and the rest of the afternoon reads cleanly. Reach for Reload with Encoding… rather than Convert to Encoding…, which is the one that changes what would be written: reloading never changes the file on disk.

Tailing on a network volume or a slow mount

Following a log on a mounted share works the way it does on an internal drive. New lines keep arriving, the view stays pinned to the end, and our large-file engine keeps a share-hosted log scrolling comfortably however long it has been running. Over a slow mount the lines arrive in slightly larger batches, and the view holds its place either way.

One setting is worth knowing here. Settings ▸ File Monitor governs how often files that are watched but not followed are checked — 3 seconds by default, adjustable from 1 to 600. Raise it if you are working over a slow share and would rather leave the volume alone between looks.

Colour and error jumping while you follow

A tail is far easier to read with the severities picked out. Turn on View ▸ Enable Log Highlighting, or click the Log pill in the status bar. Our syntax engine gives each severity keyword its own colour and colours HTTP status codes by class — 2xx green, 3xx teal, 4xx orange, 5xx red — while ISO-8601 timestamps stay deliberately muted so they recede, IPv4 addresses are purple, UUIDs indigo, and URLs take the link colour. A wall of identical lines becomes something you can skim. None of it is written into the file: the colour is for reading only, and the file on disk is untouched.

Once something has gone wrong, ⌥⌘E and ⌥⇧⌘E jump to the next and previous error. They take you to lines carrying FATAL, CRITICAL, SEVERE, ERROR, WARNING or WARN in any capitalisation, and wrap around at the end of the document. ⌘L goes to a line number, and ⌘F2 drops a bookmark on the current line so you can come back to it with F2.

Troubleshooting

Follow Tail is on but nothing arrives

Check that file monitoring is switched on in Settings ▸ File Monitor. Turn it on there and open the log again: the fresh tab takes the setting straight away, and from then on it is watched. Then confirm the process really is appending to the path you opened, rather than writing a new file each run — if it starts a new file each time, open that one and follow it instead.

The view keeps jumping to the bottom while I am reading

You are still close enough to the end for the view to stay pinned there. Scroll up a little further and it lets go, and you can read in peace while the lines keep landing below you.

New lines appear in bursts rather than continuously

Lines appear as soon as the writing process commits them, so the rhythm you watch is the rhythm the program produced — and plenty of programs hold their output back and release it in clumps. If yours has an option to flush or to write unbuffered output, turning that on smooths the flow, and the tab keeps pace with whatever it sends. The interval in Settings ▸ File Monitor is a separate matter: it governs files that are watched but not followed.

Where "Monitor File for Changes" and "Auto-Reload External Changes" live

Click the file-monitor badge in the status bar and both are on its menu, one click from the tab they apply to. The same choices are in Settings ▸ File Monitor, and Follow Tail itself is in the View menu, where you would expect it.

Following carried on but the tab is nearly empty now

That is rotation: the file at that path really is the new, nearly-empty one. If your rotation scheme renames the old file instead of emptying it, open the renamed file in a second tab to read the history while the first tab keeps following the new one.

The log opened as an ordinary tab after I quit and came back

Every session starts clean, tab by tab. Choose View ▸ Follow Tail again and the tab pins itself to the end and picks up wherever the log has got to in the meantime.

Searching a log while it keeps filling

Following gives you the live end of the file. Searching gives you everything that came before it, and the two sit happily in the same tab: look something up in the lines already on screen, and the new ones carry on landing at the bottom while you read.

Find the request id or the stack frame. Our find and replace opens from its toolbar button and works across the whole document, so a transaction id you noticed an hour ago is one search away from the line that produced it.
Widen the search to the whole folder. Search ▸ Find in Folder… (⇧⌘F) looks through a tree of files and leaves every file exactly as it found it, which is how you catch a message that landed in yesterday's rotated file rather than the one in front of you.
Mark the moment it went wrong. ⌘F2 drops a bookmark on the line you are looking at, and F2 brings you straight back to it however many thousands of lines have arrived since.
Keep the history beside the live end. When your rotation scheme renames the old file rather than emptying it, open the renamed one in a second tab: one holds the history, the other keeps following, and each carries its own Follow Tail setting.
Read it all on your Mac. Nothing is uploaded, there is no account and no telemetry, and the log never leaves the machine — the property that matters most when the file is a production log.

The file on disk is untouched by any of this. Searching, bookmarking and colouring are for reading; the log keeps its exact bytes, which is what you want from something you may have to hand to somebody else later.

Frequently asked questions

How quickly do new lines show up?

Fast enough to watch a build or a request log in real time. Any delay you notice is usually the writing program deciding when to commit its output. For files that are watched but not followed, the check interval is yours to set in Settings ▸ File Monitor — 3 seconds by default, anywhere from 1 to 600.

Does following a huge log slow the app down?

Leaving a busy log following all afternoon is a normal thing to do — our large-file engine is built for exactly this, so the tab stays responsive as the file grows. What you gain from that is the whole history: scroll back hours later and the earlier lines are still there to read.

Can I follow two logs at once?

Yes. Follow Tail is a per-tab setting, so each log you open can be following independently. Multi View gives each open tab its own pane if you want to watch them side by side, each pinned to the end of its own log.

Will tailing mark the file as edited, or fill my undo stack?

Your undo history stays yours alone. It steps back through what you typed, in the order you typed it, and content another process wrote never enters it. Anything you type yourself is a normal edit with normal undo, however long the tab has been following.

Can I edit the file while following it?

Yes — a followed tab is a full editor, so you can annotate the line that broke, trim a section down to the part you want to pass on, or copy the interesting minute into a fresh tab with ⌘N and hand that on instead of the whole log. Your own work is looked after while you do: if the file changes on disk while you have unsaved edits in the tab, you are always prompted first, whatever the change mode is set to. Nothing of yours is overwritten behind your back.