How to Use the watch Command in Linux to Monitor Periodic Command Outputs in Real Time

When troubleshooting network connectivity, auditing file download progress, or monitoring fluctuating server memory consumption on Linux, repeatedly pressing the Up Arrow and Enter keys to re-run commands is inefficient. The standard watch utility, part of the core procps-ng package, automates repetitive command execution by running any designated terminal command at fixed intervals, refreshing the terminal screen, and visually highlighting differences between successive outputs in real time.

Basic Syntax and Fundamental Behavior of watch

The standard syntax for invoking the watch command is structured as follows:

watch [options] command

By default, watch executes the specified command every 2.0 seconds, clearing and rewriting the terminal screen with a top header displaying the refresh interval, the active command string, and the current system timestamp. To exit the interactive monitoring loop at any time, press Ctrl + C.

Essential Options for Real-Time Linux Auditing

1. Customizing the Refresh Interval (-n)

The -n (interval) switch accepts integer or fractional seconds down to tenths of a second. To monitor available disk space on mounted partitions every 5 seconds, run:

watch -n 5 df -h

For high-frequency polling—such as tracking packet queue bursts or rapid log writes—you can set sub-second intervals:

watch -n 0.5 free -m

2. Highlighting Differences Between Successive Runs (-d)

One of the most valuable capabilities of watch is visual diff tracking via the -d (differences) flag. When enabled, watch highlights any characters or numbers that changed since the previous iteration:

watch -d -n 1 uptime

To make changed values remain permanently highlighted across all subsequent refreshes (cumulative diff mode), pass -d=cumulative:

watch -d=cumulative netstat -s

3. Exiting Automatically on Output Changes (-g)

When waiting for an asynchronous process to complete—such as waiting for a file download to finish, a backup directory to appear, or a background worker process to terminate—use the -g (chgexit) flag:

watch -g ls -l /var/backups/db.tar.gz && echo "Backup file updated!"

As soon as the size or modification time of the target file changes, watch terminates execution immediately and hands control back to your shell.

Running Complex Pipelines and Quoting Rules

Because watch executes commands by passing them directly to /bin/sh, any shell pipeline involving pipes (|), redirects (>), or shell wildcards must be enclosed inside quotation marks to prevent the parent shell from prematurely evaluating the pipe:

Incorrect Pipeline:

watch ps aux | grep nginx

Issue: In this flawed example, the parent shell executes watch ps aux and pipes the final output of watch into grep once, causing a broken display loop.

Correct Quoted Pipeline:

watch "ps aux | grep nginx"

Enclosing the entire command string in quotes ensures that the internal shell executes the pipe afresh on every periodic interval.

Practical System Administration Watch Examples

Administrative Goal	Watch Command Template
Track Disk Queue Growth	watch -d -n 1 iostat -dx
Monitor Active Network Sockets	watch -n 2 "ss -tulpn"
Track File Download Progress	watch -d -n 1 ls -lh file.iso
Inspect Real-Time Memory Buffers	watch -n 1 cat /proc/meminfo