title: Quickly find last N occurrences of string in huge file in Linux
body: <p>I'm working with an application that generates gigantic log files (2.5GB per day). Occasionally, I need to gather info about the state of the app by searching through the log for select strings.</p>
  
  <p>This is running on a small CentOS Linux system and since it's a production environment I want to minimize the CPU load of this type of search.</p>
  
  <p>What is the most efficient way to find the last 50 occurrences of a string in a large file? The fastest I was able to come up with is this:</p>
  
  <pre><code>tac file.log | grep 'some string' -m50 | tac
  </code></pre>
  
  <p>Is that as fast as I'm going to get or are there better options? </p>
  
  <p>Also, WHY is this fast? I expected the "tac" to reverse the whole file resulting in slower performance, but that does not appear to be the case.</p>
  
  <p><strong>Update:</strong></p>
  
  <p>An example scenario: say the application logs statistics about its memory utilization every 5 minutes. If I wanted to see the trends over the past hour, I would currently do something like this:</p>
  
  <pre><code>tac file.log | grep 'Memory' -m12 | tac
  </code></pre>