The `watch` command in Linux – a practical guide to real-time system monitoring

Have you ever wasted time manually refreshing your terminal to check a process status, disk usage, or new log entries? The `watch` command in Linux solves this problem – it runs any command periodically and displays its output in an interactive window. Learn how it works, its flags, best practices, and alternatives to effectively diagnose your system in 2026.

In the daily work of a Linux system administrator, you often need to quickly check resource status, monitor processes, or track file changes. However, it only takes a few seconds to realize that manually refreshing the terminal – for example, by repeatedly typing df -h or top – is time-consuming and inefficient. This is where the built-in watch command comes in, which automates this process and allows you to focus on what really matters.

What exactly is watch, how does it work under the hood, and what are its limitations? Which flags are the most useful, and when should you reach for alternative tools? In this guide, you will find answers to these questions – along with concrete examples that you can immediately apply in your work.

Basics of the watch command

The watch command is a tool built into most Linux distributions, acting as a wrapper for a cyclic loop that executes a given command at regular intervals. Each time it runs, it performs the following:

• Executes the command in a new process (using the fork() and exec() functions).
• Displays the output in the terminal with optional highlighting of changes.
• Refreshes the screen at a specified interval (default is 2 seconds).

Important note: watch does not monitor changes in real-time – it only displays a snapshot of the system state at the moment of refresh. If you need immediate change detection (e.g., in files), you will need to use specialized tools such as inotifywait.

Limitations to keep in mind

Although watch is extremely useful, it has a few important limitations:

• System load: High refresh frequency (e.g., -n 0.1) can generate a significant number of processes, leading to 100% CPU usage, especially with heavy commands like top or vmstat.
• No logging mechanism: The tool does not save results automatically – to keep a history, you must manually redirect the output to a file.
• Not suitable for event monitoring: It does not detect changes in files or processes in real-time – it is only intended for periodic status checks.

Basic flags and options – how to effectively use watch

The watch command offers several flags that significantly enhance its functionality. Here are the most important ones along with practical examples:

Basic flags

Examples of practical flag usage

Here are a few specific cases where watch flags work best:

• Monitoring memory usage changes every 3 seconds with change highlighting:

  watch -n 3 -d free -h

• Checking process status with filtering – only the processes we are interested in:

  watch -n 2 "ps aux | grep '[h]ttpd'"

• Monitoring system logs with highlighting of new entries:

  watch -n 2 -d "tail -n 20 /var/log/syslog"

• Checking active network connections:

  watch -n 3 -d "ss -tulnp"

Most common uses of watch in system diagnostics

The watch command is widely used for monitoring various aspects of the system. Below are the most popular usage scenarios, categorized.

A. Monitoring system resources

One of the most common uses of watch is checking the status of CPU, RAM, and disks in a continuous mode. This allows for quick identification of issues, such as sudden load spikes or running out of free disk space.

• Memory and CPU usage:

  watch -n 1 -d "top -b -n1 | head -n 12"

  The -d flag highlights changes in load, making it easier to identify spikes in usage.

• Disk occupancy:

  watch -n 5 df -h

  Regularly checking free disk space helps avoid unexpected issues with lack of space.

• Active processes:

  watch -n 2 "ps aux --sort=-%mem | head -n 10"

  Sorting processes by memory usage helps identify those consuming the most resources.

B. Monitoring system logs

Although watch does not provide true live log monitoring (for that, use tail -f), it can be useful for periodically checking new entries in log files.

• Checking the last 20 entries in system logs with change highlighting:

  watch -n 2 -d "tail -n 20 /var/log/syslog"

• Monitoring a specific error in logs:

  watch -n 5 "grep 'ERROR' /var/log/nginx/error.log"

Tip: If you need true log monitoring, it is better to use journalctl -f (for systemd) or tail -f in a separate terminal window.

C. Network monitoring

The watch command can also be useful for checking the status of network connections, open ports, and active connections.

• Active network connections:

  watch -n 3 -d "ss -tulnp"

• Port occupancy:

  watch -n 5 "netstat -tulnp | grep ':80'"

D. Monitoring file changes (semi-truth)

Although watch does not monitor file changes in real-time, it can be used for periodically checking their content.

• Checking changes in a configuration file:

  watch -n 5 "cat /etc/nginx/nginx.conf | grep 'server_name'"

• Monitoring changes in an application log file:

  watch -n 2 "grep 'user_login' /var/log/app.log"

Note: For true file change monitoring (e.g., detecting new entries or modifications), it is necessary to use tools like inotifywait from the inotify-tools package.

Alternative system monitoring tools

Although watch is extremely useful, it is not the only tool for system monitoring. Depending on your needs, it is worth considering alternatives that offer broader capabilities or are more suitable for specific tasks.

1. htop – interactive resource monitor

htop is an interactive, colorized, and sortable system resource monitor. It allows you to view processes, CPU usage, RAM, and disks in a single window, with filtering and sorting capabilities.

• Pros: Very intuitive, allows interaction with processes (e.g., sending SIGTERM signals).
• Cons: Not suitable for automation or logging results.

Example usage:

htop

2. glances – comprehensive system view

glances is a tool that combines CPU, RAM, disk, network, and process monitoring into a single view. It is more advanced than htop and offers additional features, such as monitoring CPU temperature or power consumption.

• Pros: All-in-one window, remote monitoring capability.
• Cons: Requires installation (not available by default in some distributions).

Example usage:

glances

3. tmux – multi-pane terminal environment

tmux is a terminal window manager that allows you to create multi-pane sessions. You can run watch, htop, and tail -f in a single window, which significantly facilitates monitoring.

• Pros: Stable, allows creating persistent sessions (even after logging out).
• Cons: Complex for beginners.

Example usage:

tmux new-session -s monitor

Then, in a new session, you can run different tools in separate panes.

4. inotifywait – real-time file change monitoring

If you need file change monitoring (e.g., new log entries), inotifywait from the inotify-tools package is the best choice. It allows for immediate change detection and executing actions in response.

Example usage:

inotifywait -m /var/log/ --format '%f %e'

5. journalctl – systemd log monitoring

If you use a system with systemd, journalctl allows for real-time log monitoring with the ability to filter by priority, unit, or time.

Example usage:

journalctl -f -u nginx

When to use what:

• watch: Quick, one-off system status checks.
• htop/glances: Constant, interactive monitoring with a rich interface.
• inotifywait: Precise tracking of file changes.
• tmux: Multi-pane environment for managing monitoring.

Availability of watch in various Linux distributions

The watch command is built into most popular Linux distributions, although in some cases it may require installing an additional package.

Distributions where watch is available by default

• Debian/Ubuntu: procps (installed by default).
• RHEL/centos: procps-ng.
• Arch Linux: procps-ng.

Checking the watch version

To check if watch is installed and find its version, use the command:

watch --version

The current stable version of the procps-ng package is 4.0.4 (last updated in November 2023).

Installation in distributions where it is not available by default

In distributions where watch is not installed by default, you can add it using the package manager:

• Debian/Ubuntu:

  sudo apt update && sudo apt install procps

• RHEL/centos:

  sudo yum install procps-ng

• Arch Linux:

  sudo pacman -S procps-ng

Advanced and lesser-known uses of watch

Although watch is most commonly used for monitoring resources and logs, it also has less obvious uses that can significantly facilitate a system administrator's work.

A. Running scripts in a loop

watch can be used for periodically running scripts, for example, backups or data synchronization.

Example:

watch -n 30 ./backup_script.sh

Runs the backup_script.sh script every 30 seconds.

B. Combining with other commands

You can use watch together with other tools to achieve more advanced functionalities.

• Monitoring processes with filtering:

  watch -n 2 "ps aux | grep '[n]ginx'"

• Checking service status:

  watch -n 5 "systemctl status nginx | grep 'Active:'"

• Monitoring changes in a configuration file:

  watch -n 1 "diff -u /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak"

C. Using with ts (from the moreutils package)

To add a timestamp to watch results, you can use the ts command from the moreutils package:

watch -n 5 "df -h | ts '[%Y-%m-%d %H:%M:%S]'"

This allows for logging results with an exact timestamp.

D. Monitoring network changes

watch can be used for checking changes in network status, for example, active connections or port occupancy.

Example:

watch -n 3 "ip -br addr"

Displays network interfaces with their IP addresses at regular intervals.

Security and best practices regarding watch

Although watch is a simple tool, its improper use can lead to performance or security issues. Below are the most important security rules and best practices.

A. Avoiding excessive system load

Never use watch -n 0.1 with heavy commands, such as top or vmstat. High refresh frequency can lead to 100% CPU usage, which will significantly impact system performance.

A better approach is:

• Using -n 1 or -n 2 for most cases.
• For frequent monitoring, use htop or glances, which are optimized for low load.

B. Logging results

watch does not save results automatically, so to keep a history, you must manually redirect the output to a file:

watch -n 5 "df -h" >> disk_usage.log

To add a timestamp to logs, use ts from the moreutils package:

watch -n 5 "df -h | ts '[%Y-%m-%d %H:%M:%S]'" >> disk_usage.log

C. Permission restrictions

If you are monitoring system files or sensitive resources, run watch with appropriate permissions. Use sudo if necessary:

sudo watch -n 5 "journalctl -u nginx | grep 'error'"

D. Avoiding sensitive data in logs

If you are monitoring, for example, application logs containing sensitive data (e.g., passwords), ensure that they are not saved in locations accessible to other users. You can use logger to save results to syslog:

watch -n 5 "tail -n 10 /var/log/app.log | logger -t app_monitor"

Summary: when to use watch and when to reach for alternatives

The watch command is an extremely useful tool that allows for quick and effective system status monitoring without the need for manual terminal refreshing. It is ideal for:

• Periodically checking resource status (CPU, RAM, disks).
• Monitoring logs and configuration file changes.
• Quickly diagnosing system issues.

However, it is worth remembering its limitations – it is not suitable for:

• Monitoring file changes in real-time (use inotifywait).
• Complex diagnostic tasks (use htop, glances, or tmux).
• Automating long-term monitoring (better to use cron or dedicated tools).

If you need constant, interactive monitoring, consider using htop or glances. For monitoring file changes, inotifywait is the best choice.

In summary: watch is a foundation for effective terminal work, and knowing it will significantly speed up diagnosing problems in a Linux system.

If you want to deepen your knowledge of automation in Linux, we also recommend reading our other guides:

• Automating file management in Linux: A practical guide with find, cron, and the best tools – learn how to automate routine administrative tasks.
• `at` vs `cron`: when to use which tool for one-off tasks in Linux? – a comparison of two key task scheduling tools.

Sources

• https://www.tecmint.com/watch-command-in-linux/
• https://man7.org/linux/man-pages/man1/watch.1.html
• https://www.gnu.org/software/coreutils/manual/html_node/watch-invocation.html
• https://www.tecmint.com/watch-command-examples/
• https://www.linuxjournal.com/content/advanced-linux-monitoring-tools
• https://packages.debian.org/procps
• https://askubuntu.com/questions/141223/how-to-use-watch-command
• https://access.redhat.com/articles/23608