Linux Tee Command Explained: Syntax, Examples & Use Cases

Linux provides a vast array of tools for everyday use. While some may not be as prominent or widely used as others, they play a vital role in simplifying or automating tasks. One such tool is the tee command.

The Linux tee command is a powerful CLI tool that does a couple of things simultaneously. First, it reads from standard input (stdin). It then writes to a specified file(s) before streaming the output to standard output (stdout) - in this case, your terminal shell.

In this tutorial, we will look at the Linux tee command. For better context, let’s have an overview with some practical command use cases.

#Syntax

In its simplest form, the Linux tee command takes the following syntax:

command | tee [options] file

#Prerequisites

To make the most of this guide, ensure you have the following list of prerequisites:

• A Linux system, whether a VPS or on-premise. (Any distribution will do just fine)

• A sudo user configured on the system for carrying out privileged tasks.

Let’s get started.

#Basic tee command usage

At the most basic level, the tee command writes to a file and also prints the output to the terminal.

In this example, the command saves the output of the uptime command to a file named results.txt and also streams it to the screen.

uptime | tee results.txt

You will get the uptime statistics displayed on your shell.

Output 14:00:03 up 3 days,  1:31,  2 users,  load average: 0.00, 0.00, 0.00

You can use the cat command to verify the content of the results.txt file.

cat results.txt

Output 14:00:03 up 3 days,  1:31,  2 users,  load average: 0.00, 0.00, 0.00

As you have noted, the output streamed to the terminal matches the content saved to the file.

#Write to multiple files

The tee command also enables you to write to multiple files. In the next example, the command reads input from the echo command and writes the string Good morning to files file1.txt and file2.txt before streaming the output to the terminal.

echo "Good Morning" | tee file1.txt file2.txt

Once again, you can use the cat command to verify the contents of the files.

cat file1.txt && cat file2.txt

Good Morning
Good Morning

NOTE

If the specified file does not exist, one is automatically created before it is written to.

#Append content to a file

The default behavior of the tee command is to overwrite an existing file. This implies you will lose the original content if you run it against the same file. The -a flag enables you to add or append content to an already existing file.

In this command, we are adding the string I hope you are having a nice day to the file file1.txt.

echo "I hope you are having a nice day" | tee -a file1.txt

When you view the file again using the cat command, you will see two lines.

cat file1.txt 

OutputGood Morning
Let’s learn tee command

#Suppress terminal output

By default, the tee command typically acts as a T-junction. It takes input and splits it into two parts - the file and the standard out, in this case, your terminal shell.

If you don’t want the output displayed on the terminal, you can suppress it by redirecting it to /dev/null, a virtual filesystem.

In this example, the output of the free -h command, which checks memory usage, is logged to a file called stats.txt, but the shell output is suppressed.

free  -h  | tee stats.txt > /dev/null

No output appears on the terminal since it is discarded once redirected to /dev/null.

#tee command with sudo

More often than not, you will be required to work with files owned by root and that require elevated privileges to access and modify. sudo is a utility that grants regular users temporary access to perform root-level tasks.

To use tee with sudo, you need to ensure that the user you are currently logged in as belongs to the sudo group. You can confirm this by running:

groups username

The command prints out the groups the user is part of, and sudo should be one of the groups listed.

Let’s take an example of using tee alongside sudo. Let’s say you want to install Docker on Ubuntu 24.04, and part of the installation requires you to add the Docker repository to your system. To do so, you need to run the command:

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

The command adds the specified repository to the /etc/apt/sources.list.d/docker.list file and suppresses the output from appearing on the terminal using the /dev/null directive.

When dealing with configuration files, you will often use tee to append lines of code. In that regard, you will be using the append option -a.

For example, to update the /etc/hosts file with the IP and hostname mapping of a new host, run:

echo "84.32.59.208 node-2.local" | sudo tee -a /etc/hosts > /dev/null

In this example, the -a option adds a new host entry 84.32.59.208 node-2.local to the file as opposed to overwriting it.

#Using the tee command with multiple pipes

As we have seen, pipes combine the functionality of two or more commands. The output of one command is passed to another command for further processing.

So far, we have been using a single pipe with the tee command to read input from a previous command. You can incorporate additional commands, including grep, awk, and sed, to carry out more complex tasks.

For example, you can use the grep command to filter output that appears on the screen. Say you want to log all network interfaces on your system, but only stream the details of an interface named eth0 on the terminal. To achieve this, run the command:

ip address | tee results.txt | grep eth0

The command has three sections:

ip address: Gets the details of all network interfaces.

tee results.txt: Writes all the interface information to a text file called results.txt.

grep -i eth0: Filters out the interface details to print only those of the eth0 interface to the shell.

Here’s the expected output.

Output2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 84.32.59.206/32 scope global eth0

You can also perform log analysis using tee in conjunction with other commands. The following command streams failed login attempts in real time and saves raw logs in a file called all.log.

tail -f /var/log/auth.log | tee  all.log | grep -i Failed

The tail -f command watches the logs from the /var/log/auth/log log file in real time. The results are piped to the tee command, which saves the logs in the all.log file. The output is then filtered with grep, showing only the failed SSH login attempts.

In Kubernetes, you can perform live log analysis of a pod by streaming error logs to standard out.

kubectl logs -f  pod-name | tee -a pod.log |  grep -i error

From the examples we have just looked at, the tee command can be used in DevOps environments to provide both real-time visibility of events and applications, and preserve a persistent copy of logs for later audit.

#Getting help with more options

To acquaint yourself further with the tee command, you can view the help page.

tee --help

Alternatively, you can peek at the man pages.

man  tee

#Conclusion

The tee command is a simple yet effective tool in the Linux ecosystem. It provides persistent logging of the task being carried out while simultaneously streaming the output to standard output.

It's used in sysadmin operations to modify configuration files and capture command output during workflows. It's also an essential tool for monitoring services and complex log analysis when used with other CLI tools like grep.

In this guide, we have looked at various use cases of the tee command. From performing basic operations such as writing to one or more files to monitoring authentication logs in real-time, there's no doubt about the flexibility of the command. With the examples provided, we hope you have a firm grasp of the command usage.