Watch under Linux: follow a command without manually re-running it

You restart df -h, ss -s Or systemctl --failed every few seconds to see if a value changes. The command watch automates this observation in the terminal: it executes the same command at regular intervals, replaces the previous display and can highlight what changes.

I use it to monitor a process, disk space usage, or the status of a service during a short intervention. However, one point must be kept in mind: watch It actually repeats the command. A slow, expensive, or destructive instruction will therefore be repeated until you stop.

Tux monitors changes to a Linux server at regular intervals — Watch repeats a command at regular intervals and highlights any observed changes.

Check that watch is available

watch part of the package procps Or procps-ng depending on the distribution. First, check for its presence and version:

command -v watch
watch --version
watch --help

If the command is missing, install the corresponding package:

sudo apt install procps
sudo dnf install procps-ng
sudo pacman -S procps-ng

The available options may vary slightly depending on the version of procps-ng. See the man page for watch remains the reference for checking the behavior installed on your machine.

Refresh a command at the chosen interval

Without options, watch The command is re-run every two seconds. This example monitors the mount point space /srv/data :

watch 'df -h /srv/data'

The header displays the interval, command, and time of the last refresh. The output is replaced on each pass; it is not added to the screen as in a log file.

Use -n to choose the interval in seconds. Here, the command is repeated every five seconds:

watch -n 5 'df -h /srv/data'

Adjust the frequency to the cost of the command. One second is suitable for a lightweight local counter. For a network request, an API, slow storage, or a command that iterates through many files, opt for five, ten, or thirty seconds. First, verify its duration without watch :

time df -h /srv/data

The option -p requires a more precise timing. Do not combine it with a command slower than the interval: some versions can quickly chain executions to make up for lost time.

Highlight the changes instead of comparing them visually

The option -d It highlights the differences between two successive displays. It is useful for tracking connections, a process queue, or system counters:

watch -d -n 1 'ss -s'
watch -d -n 2 'ps -eo pid,pcpu,pmem,comm --sort=-pcpu | head -n 12'
watch -d -n 5 'systemctl --failed --no-legend'

For CPU or memory load, watch provides a focused view but without interactive navigation. The guide on htop under Linux is more suitable if you need to sort processes, change columns and trace back to the responsible department.

-g changes usage again: watch It stops as soon as the output differs. This allows you to wait for a state change without remaining in front of the terminal:

watch -g -n 2 'systemctl is-active nginx'

This command exits when the returned text changes. Then review the full status and logs before restarting anything:

systemctl status nginx --no-pager
journalctl -u nginx -n 50 --no-pager

If you need to inventory the units before taking action, also consult the tutorial dedicated to systemctl and Linux services.

Understanding quotation marks, pipes, and the -x option

By default, watch sends the order to sh -cThis is useful for using a pipe, a redirect, or multiple instructions. Place the entire command between single quotes so that the shell, launched on each iteration, interprets the complete string:

watch -n 2 'ps -eo pid,pcpu,pmem,comm --sort=-pmem | head -n 10'
watch -n 5 'date; df -h /srv/data'

Without these apostrophes, the tube can be processed by your current shell. watch only receives part of the command, and the result no longer corresponds to what you wanted to observe.

-x executes the program directly with its arguments. This form reduces escape problems:

watch -n 2 -x df -h /srv/data

Keep all options watch before the command name. Option processing stops at the first argument that is not an option.

Do not turn watch into a destructive loop

watch Suitable for playback controls: df, free, ss, p.s., systemctl status or a health query. It should not be used in connection with an action that modifies the system.

Don’t repeat rm , chown or a partitioning command.
Do not place systemctl restart In watch : you would restart the service at each interval.
Avoid thinking about it apt update, a backup or a script that writes to the database.
For a remote API, choose an interval that does not trigger throttling or unnecessary load.

For a read-only HTTP test, use a health route designed for this purpose and exit on error with -e if your version offers it:

watch -e -n 10 'curl -fsS http://127.0.0.1:8080/health'

A shell loop of the type while true can do the same repetition, but it requires you to manage erasure, delay, errors and stopping. watch is cleaner for temporary observation. For continuous monitoring, use a monitoring tool, a systemd timer, or a script that logs the results.

Stop monitoring and choose the right tool for logs.

Press Ctrl + C to stop watchThe observed process must complete before the next refresh. If the command remains stuck, open a second terminal to identify its processes before sending a signal.

pgrep -af watch
ps -o pid,ppid,stat,etime,cmd -p PID

To follow a newspaper that receives new lines, watch Clear the history each time you visit. Prefer journalctl -f for a systemd unit or tail -F for a file that can be recreated by log rotation:

journalctl -u nginx -f
tail -F /var/log/nginx/error.log

The guide to tail and live log monitoring This difference is detailed. Therefore, use watch to compare short snapshots, then switch to a tool that keeps history as soon as the order of events becomes important.