ttsnoop: use tail arg -f rather than +0f