How to Monitor Command Output in Real-Time Using watch in Linux

When you are monitoring a slow-moving process on a Linux server, such as a massive file downloading or a database rebuilding its indexes, constantly typing the ls -l or du command over and over again to check the file size is incredibly tedious. Instead of manually hammering the Enter key to refresh the screen, you can use the watch command to force Linux to automatically re-execute the command and update the screen in real-time.

How the watch Command Works

The watch command is a wrapper. You place it in front of the command you actually want to run. When executed, watch will clear your terminal screen, run the target command, display the output, wait exactly two seconds, and then run it again, refreshing the data infinitely until you manually abort it.

For example, to monitor the size of a massive log file as it grows, open your terminal and run:

watch ls -lh /var/log/syslog

The terminal will lock into a full-screen monitoring mode. In the top left corner, it will display the command being executed and the exact refresh interval (default: 2.0s). In the top right corner, it will display the current system time. Below that, you will see the output of the ls command automatically updating every two seconds.

To exit this monitoring mode and return to your standard command prompt, press Ctrl + C.

How to Change the Update Interval

If you are monitoring a rapidly changing process, two seconds might be too slow. You can speed up the refresh rate using the -n (interval) flag.

To refresh the screen every single second, run:

watch -n 1 ls -lh /var/log/syslog

If you are monitoring a very slow process (like disk space consumption via the df -h command) and do not want to waste CPU cycles refreshing every second, you can slow it down. For example, watch -n 60 df -h will only update the screen once per minute.

Highlighting the Differences

Staring at a massive block of text and trying to spot what changed every two seconds is difficult. You can force the watch command to visually highlight the exact characters that changed since the last refresh by adding the -d (differences) flag.

watch -d -n 1 ls -lh /var/log/syslog

Now, every time the file size increases, the new byte count will flash in reverse video (white text on a black background), instantly drawing your eye to the exact data point that updated.