How to Use the Watch Command in Linux: Monitor Commands in Real Time

I’ll be honest: the watch command is one of those utilities I use constantly but rarely talk about. It’s not flashy like top or complex like awk. But after 10+ years of systems work, I can tell you that watch has saved me from countless “let me SSH back in and check that again” moments.

If you’ve ever found yourself running the same command over and over just to see if something changed, you need watch. It runs any command repeatedly and displays the output, so you can monitor changes in real time without lifting a finger.

What is the Watch Command?

The watch command is part of the procps-ng package that ships with pretty much every Linux distribution. It executes a specified command at regular intervals and shows you the full-screen output, continuously updating until you tell it to stop.

By default, it refreshes every 2 seconds. That’s it. Simple, effective, and surprisingly powerful when you combine it with other commands.

Here’s the basic syntax:

watch [options] command

The command will run in your terminal, taking over the screen, and you’ll see the output refresh at your specified interval. Press Ctrl+C to exit.

Why Watch Matters for System Administration

Let me paint a picture. You’re troubleshooting a disk space issue on a production server. You run df -h to check available space, then wait a minute, run it again, wait another minute, run it again. Sound familiar?

Or maybe you’re watching memory usage while a batch process runs. You could keep typing free -m every few seconds, or you could use watch and actually see the changes happen in real time.

This is where watch shines. It turns any command into a monitoring tool. Whether you’re tracking disk usage, observing network connections, monitoring process status, or checking system load, watch gives you continuous visibility without manual repetition.

Essential Watch Command Options

The watch command keeps things simple, but it has a few key options worth knowing:

Change the Interval (-n)

The -n flag lets you specify how many seconds between updates:

watch -n 5 df -h

This checks disk space every 5 seconds instead of the default 2. I typically use longer intervals (5-10 seconds) for disk checks and shorter intervals (1-2 seconds) for active processes.

Highlight Differences (-d)

This is my favorite option. The -d flag highlights what changed between updates:

watch -d free -m

When memory values change, watch highlights them so you can instantly spot what’s different. It’s incredibly useful when you’re waiting for a specific value to change.

No Header (-t)

The -t flag removes the header that shows the interval, command, and timestamp:

watch -t uptime

I don’t use this often, but it’s handy when you want a cleaner display or you’re piping output elsewhere.

Exit on Error (-e)

The -e flag makes watch stop if the command exits with an error:

watch -e 'systemctl is-active nginx'

This is useful for monitoring service status. If the service goes down, watch stops and freezes the output so you can see exactly when it failed.

Real-World Examples That Actually Matter

Let me share some scenarios where I use watch regularly:

Monitoring Disk Space During Large Operations

When I’m running rsync to copy massive amounts of data, I always have a separate terminal open monitoring disk usage:

watch -n 10 -d 'df -h | grep /data'

This checks the /data partition every 10 seconds and highlights changes. I can see exactly how fast the disk is filling up and whether I’m going to run out of space.

Tracking Memory Usage

When troubleshooting memory leaks or watching resource-intensive processes, I use:

watch -n 2 -d 'free -m'

The -d flag highlights memory changes, making it obvious when a process starts consuming more RAM. For more detailed memory analysis, check out my guide on how to check memory usage in Linux.

Observing Active Processes

Sometimes I want to see if a specific process is running without the full overhead of the top command:

watch -n 3 'ps aux | grep nginx'

This shows me all nginx processes every 3 seconds. Simple and focused.

Monitoring System Load

When I suspect a server is under heavy load, I monitor load average in real time:

watch -n 1 uptime

This refreshes every second, showing me how load average changes as processes start and stop. If you want to dive deeper into what those load numbers actually mean, I’ve written a complete guide on checking load average in Linux.

Watching Network Connections

To keep an eye on active network connections without constantly rerunning commands:

watch -n 2 'ss -tuln | grep LISTEN'

This shows listening ports every 2 seconds. It’s particularly useful when you’re testing firewall rules or verifying that a service bound to the correct port.

Monitoring Service Status

When I’m waiting for a service to come online after changes, I use:

watch -n 1 'systemctl status nginx | head -n 10'

I limit the output with head because full systemd status can be verbose. This gives me the key information without overwhelming the screen. For more on working with systemd services, see my guide on checking systemd service status.

Watch vs Other Monitoring Tools

You might wonder: why use watch when tools like top, htop, or netdata exist?

Here’s the thing: watch is not a replacement for dedicated monitoring tools. It’s a utility that makes any command repeatable. top gives you an interactive process viewer. watch lets you monitor anything you can express as a command.

I use top when I need interactive process management. I use watch df -h when I specifically want to track disk space without all the process information. Different tools for different jobs.

Some scenarios where watch wins:

• Custom monitoring: You can watch the output of your own scripts or specific command combinations
• Lightweight: It doesn’t consume resources like full monitoring dashboards
• Flexibility: Works with any command, not just built-in system metrics
• Simplicity: No configuration files, no setup, just run it

That said, for comprehensive system monitoring, especially in production environments, you’ll want proper tools like Netdata or Prometheus with Grafana. watch is for quick checks and focused monitoring sessions.

Common Pitfalls and How to Avoid Them

After years of using watch, here are the mistakes I see people make:

Not Quoting Complex Commands

If your command has pipes, redirects, or shell operators, wrap it in quotes:

watch 'df -h | grep /dev/sda'

Without quotes, the shell interprets the pipe before watch sees it, and you get unexpected behavior.

Using Too Short Intervals for Heavy Commands

Running resource-intensive commands every second can actually impact system performance:

watch -n 1 'find / -name "*.log"'

This hammers your disk every second. Be smart about interval timing. For disk operations, 5-10 seconds is usually fine.

Forgetting About the Output Size

Watch displays whatever fits on your screen. If a command produces 500 lines of output, you’ll only see what fits in your terminal. Use head, tail, or grep to filter output:

watch 'ps aux | head -n 20'

When NOT to Use Watch

Let me be clear about where watch isn’t the right tool:

Long-term monitoring: If you need to track metrics over hours or days, use proper monitoring tools. watch doesn’t save history or send alerts.

Automated responses: watch just displays output. If you need to take action based on what you see, write a proper monitoring script with conditional logic.

Production alerting: Don’t rely on someone staring at a watch terminal for critical systems. Use monitoring platforms that can alert on-call engineers.

watch is for interactive troubleshooting and short-term observation, not permanent infrastructure monitoring.

Practical Tips from the Trenches

Here are a few tricks I’ve picked up over the years:

Combine with tmux or screen: Run watch in a dedicated pane while you work in another. I frequently have a watch df -h running in one tmux pane while I work in another.

Use color output: Some commands support color output that works with watch. For example, watch --color 'ls -la --color' preserves color in ls output.

Monitor log tails: While tail -f is better for continuous log watching, watch works well for periodic sampling: watch 'tail -n 20 /var/log/nginx/access.log'

Getting Started Today

The watch command is almost certainly already installed on your Linux system as part of the procps-ng package. Just start using it:

watch date

Watch the clock update every 2 seconds. Simple, right?

Now try something useful:

watch -n 5 -d df -h

You’re now monitoring disk space with change highlighting every 5 seconds.

The beauty of watch is its simplicity. You don’t need to learn complex syntax or configuration files. If you can run a command once, you can watch it continuously.

For complete reference, check out the official watch man page for all available options and detailed usage information.

Final Thoughts

I use watch almost every day, usually multiple times. It’s not the most sophisticated monitoring tool, and that’s exactly why it’s so valuable. It does one thing well: it runs commands repeatedly and shows you the output.

Whether you’re monitoring disk space during a backup, tracking memory usage while debugging, or observing network connections during testing, watch saves you from the tedious cycle of running the same command over and over.

Start small. Next time you find yourself running the same command multiple times, add watch in front of it. You’ll quickly find it becomes an indispensable part of your Linux toolkit.

For more Linux system administration guides, check out my tutorials on checking CPU usage and using the nohup command to keep processes running after logout.