tee — write a stream to disk without stopping it

$ df -h | tee disk-usage.txt | tail -4

tmpfs                              5.0M     0  5.0M   0% /run/lock
/dev/nvme0n1p2                     2.0G  220M  1.6G  13% /boot
/dev/nvme0n1p1                     1.1G  6.2M  1.1G   1% /boot/efi
tmpfs                              1.6G   56K  1.6G   1% /run/user/1000

Real output from this host. The terminal shows the last four mounts; disk-usage.txt holds all nine — `wc -l < disk-usage.txt` prints 9. That is the whole idea in one line: tail is the viewfinder, tee is the recorder. Without tee you would re-run df and lose the first capture.

$ echo "level=info  boot ok" | tee boot.log
echo "level=warn  disk 95%" | tee boot.log
echo "level=error io timeout" | tee -a boot.log
cat boot.log

level=info  boot ok
level=warn  disk 95%
level=error io timeout

level=warn  disk 95%
level=error io timeout

Every line above is real, and the point is the second half: only two lines survived in the file. Plain `tee boot.log` truncates, so the third command's output is all that is left of the first two. `wc -l < boot.log` prints 2. Use -a the moment a file is meant to accumulate; use bare tee only when you want a fresh copy each run.

$ journalctl -u docker.service -n 200 --no-pager | grep -iE 'healthcheck|only one connection' | tee ~/docker-health.log | tail -2

Oct 07 07:07:32 nuc dockerd[1297]: time="2026-10-07T07:07:32.775642553+02:00" level=warning msg="healthcheck failed" actualDuration="226.78µs" error="Unavailable: connection error: desc = \"transport: Error while dialing: only one connection allowed\"" timeout=15s
Oct 07 07:07:37 nuc dockerd[1297]: time="2026-10-07T07:07:37.775840042+02:00" level=error msg="healthcheck failed fatally" error="session healthcheck failed fatally: Unavailable: connection error: desc = \"transport: Error while dialing: only one connection allowed\""

Filter first, tee second, view last — that order is what keeps the file complete. Real triage from this box: 75 matching lines and 20,087 bytes written to ~/docker-health.log, while the terminal shows only the newest warning and the fatal error that followed it five seconds later. Put tail before tee and you get a truncated file instead.

$ echo "vm.swappiness=10" >> /etc/sysctl.conf
echo $?

bash: line 1: /etc/sysctl.conf: Permission denied
1

The classic. The shell opens /etc/sysctl.conf for append before echo ever runs, so wrapping it in sudo changes nothing — sudo would only fix the echo. tee opens the file itself, so `echo "vm.swappiness=10" | sudo tee -a /etc/sysctl.conf` puts the privileged open in the right process. The failing redirect writes nothing at all, which is the one mercy here.

$ for i in $(seq 1 2000); do echo "compiled module_$i.ts"; done | tee build.log build.copy.log | tail -2
wc -l build.log build.copy.log

compiled module_1999.ts
compiled module_2000.ts

 2000 build.log
 2000 build.copy.log
 4000 total

One stream, two destinations, both complete — `cmp build.log build.copy.log` exits 0. This is how you keep an immutable raw log and a working copy you can edit or truncate later: `... | tee raw.log work.log`. tee takes any number of file operands and writes each byte to all of them in the same pass.

$ ls -l /etc/hosts /no/such/path > >(tee out.log) 2> >(tee err.log >&2)
cat out.log
cat err.log

ls: cannot access '/no/such/path': No such file or directory
-rw-r--r-- 1 root root 218 Jan  6  2026 /etc/hosts

-rw-r--r-- 1 root root 218 Jan  6  2026 /etc/hosts
ls: cannot access '/no/such/path': No such file or directory

Real output. Process substitution runs each tee in the background, so stdout still reaches the terminal and stderr still reaches it in the right place, while each stream is captured on its own. Compare that with `cmd > all.log 2>&1`, where the two streams are interleaved and you can no longer grep for errors without also matching success lines.