If you want to watch a log file and have it update when ever new content is added the "tail" command is an easy on-the-fly tool to use.
Ofcourse for long term use other implementations of log file analyzers or syslog services would be better.
Here is a short example and some sample output showing a failed root login attempt.

# tail -n 20 -f -s 5 /var/log/auth.log
Feb 17 04:11:09 testbox login[4822]: pam_unix(login:auth): authentication failure; logname=LOGIN...