watch Command in Linux — Run Commands Periodically

The watch command runs a command repeatedly at a fixed interval, displaying its output on screen — like a live dashboard for the terminal. It’s the simplest way to monitor changing system state without installing monitoring agents.

What You’ll Learn

By the end of this tutorial, you’ll run commands on a timer, highlight what changed between runs, suppress headers, run as different users, monitor disk/processes/networks in real-time, and exit automatically on state changes.

Why watch Matters

System state changes constantly — disk usage grows, processes appear and disappear, network connections fluctuate. watch refreshes your view automatically, so you can spot anomalies as they happen. DodaZIP uses watch to monitor compression queue depth. Durga Antivirus Pro uses it during scans to show file-processing progress in real-time.

Learning Path

    flowchart LR
  A[Essential Commands] --> B[System Monitoring]
  B --> C[watch Command<br/>You are here]
  C --> D[Log Monitoring]
  C --> E[Performance Tuning]
  style C fill:#f90,color:#fff
  

Syntax Overview

watch [options] command

Options Table

Examples

Example 1: Basic watch

$ watch date

Every 2.0s: date                                    Sat Jun 20 10:00:00 2026

Sat Jun 20 10:00:00 UTC 2026

Updates the date every 2 seconds (default interval).

Example 2: Custom Interval (-n)

$ watch -n 5 free -h

Every 5.0s: free -h                                  Sat Jun 20 10:00:10 2026

              total        used        free      shared  buff/cache   available
Mem:           7.7G        2.1G        3.2G        245M        2.4G        5.1G
Swap:          2.0G        0.0B        2.0G

Shows memory usage every 5 seconds — the default 2s is too fast for long-running monitoring.

Example 3: Highlight Differences (-d)

$ watch -d -n 1 ls -l /tmp/

Every 1.0s: ls -l /tmp/                               Sat Jun 20 10:01:00 2026

total 8
-rw-r--r-- 1 user user  0 Jun 20 10:01:00 newfile.txt
drwx------ 2 user user 40 Jun 20 10:00:55 tempdir

Lines that change between refreshes are highlighted (inverted colors). Perfect for spotting new files appearing or growing log sizes.

Example 4: Remove Title (-t)

$ watch -t -n 1 who

user     pts/0        2026-06-20 09:55 (192.168.1.5)

Hides the header line — useful for embedding watch output in terminal dashboards (tmux panes).

Example 5: watch with Quotes (Multiple Commands)

$ watch -n 3 'df -h / | tail -1; echo "---"; free -h | grep Mem'

Every 3.0s: df -h / | tail -1; echo "---"; free -h | grep Mem             Sat Jun 20 10:02:00 2026

/dev/sda1        98G   45G   53G  46% /
---
Mem:           7.7G        2.1G        3.2G        245M        2.4G        5.1G

Wrap multiple commands in quotes to create a custom dashboard.

Example 6: watch with grep

$ watch -d 'ps aux --sort=-%mem | head -10'

Every 2.0s: ps aux --sort=-%mem | head -10            Sat Jun 20 10:03:00 2026

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     1234  0.5 15.2 1234567 123456 ?      Ssl  Jun19  45:02 mysqld
nginx     5678  0.1  2.1 456789  23456 ?        S    Jun19  12:30 nginx
user      9012  0.0  0.5 123456  7890 pts/0    S    09:55   0:02 bash

Shows top 10 memory-consuming processes, refreshing every 2 seconds with changes highlighted.

Example 7: Watch Disk Usage

$ watch -d -n 5 'df -h | grep -E "^/dev|Filesystem"'

Every 5.0s: df -h | grep -E "^/dev|Filesystem"        Sat Jun 20 10:04:00 2026

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        98G   45G   53G  46% /
/dev/sdb1       500G  320G  180G  64% /data

Monitors only physical filesystems, updating every 5 seconds with change highlighting.

Example 8: Watch Network Connections

$ watch -d -n 2 'ss -tunapl | head -20'

Every 2.0s: ss -tunapl | head -20                      Sat Jun 20 10:05:00 2026

Netid  State   Recv-Q  Send-Q  Local Address:Port    Peer Address:Port
tcp    ESTAB   0       0       192.168.1.5:22         192.168.1.100:54321
tcp    LISTEN  0       128     0.0.0.0:80            0.0.0.0:*
tcp    LISTEN  0       128     0.0.0.0:22            0.0.0.0:*

Monitors active network connections and listening ports — essential for spotting unauthorized connections.

Example 9: Exit on Change (-g)

$ watch -g 'pgrep -x some-process' && echo "Process finished!"

watch exits when the output of pgrep changes — when some-process finishes. Useful in scripts to wait for a condition.

#!/bin/bash
echo "Waiting for backup to complete..."
watch -g 'ps aux | grep -c rsync'
echo "Backup finished at $(date)"

Example 10: Watch with Specific User

$ sudo -u www-data watch -n 5 'ls -la /var/www/uploads'

Run watch as another user to see filesystem state from that user’s perspective.

Common Use Cases

Common Errors

• watch: command not found: Install with apt install procps or yum install procps-ng.
• Quoting errors: If your command has pipes or special characters, wrap it in quotes: watch 'df -h | grep sda'.
• Too fast interval: -n 0.1 (10 times/second) will flood your terminal. Minimum useful interval is 0.5s.
• watch doesn’t work with aliases: watch runs in a sub-shell where aliases aren’t expanded. Use the full command path.
• Terminal resize issues: If watch output looks broken, resize the terminal or use -t to remove the header.

Practice Exercises

1. Basic watch: Run watch date and observe it changing.
2. Disk monitor: Watch disk usage with -d and create/delete a file to see highlighting.
3. Process watch: Monitor all running bash processes.
4. Custom dashboard: Create a watch command showing date, disk, and memory in one screen.
5. Exit on condition: Write a script that waits for a process to finish using watch -g.

Challenge

Create a complete system monitoring dashboard using watch that displays:

• Current date/time
• CPU load (first minute)
• Memory usage (used/total)
• Disk usage of root partition
• Top 3 memory-consuming processes
• Active SSH connections

Durga Antivirus Pro uses a similar watch-based dashboard during live system audits.

watch -d -t -n 2 '
echo "=== System Dashboard ==="
echo "Time: $(date)"
echo "Load: $(uptime | grep -oP "load average: \K.*")"
echo "Mem: $(free -h | grep Mem | awk "{print \$3\"/\"\$2}")"
echo "Disk: $(df -h / | tail -1 | awk "{print \$3\"/\"\$2 \" (\"\$5\")\"}")"
echo ""
echo "--- Top Processes ---"
ps aux --sort=-%mem | head -4 | awk "{print \$11, \$4\"%\"}"
echo ""
echo "--- SSH Sessions ---"
who | grep pts
'

Real-World Task

A production server is running out of disk space intermittently. Use watch to monitor multiple mount points, highlight changes, and identify which directory is growing.

Solution: watch -d -n 3 'df -h; echo; du -sh /var/log/* | tail -10'

What is watch?

The watch command executes a program periodically (every 2 seconds by default), clears the screen, and displays the output — enabling continuous monitoring of changing system state.

Related Tutorials

• Essential Linux Commands — system monitoring tools
• Linux Administration Basics — foundational administration
• head and tail Commands — combine with watch for log monitoring
• Bash Scripting Guide — automate watch in monitoring scripts