System administrators live in a world where things can change in seconds: a disk fills up suddenly, a service starts consuming all available sockets, or a runaway process pushes the server load sky-high. In such situations, you need tools that let you observe what’s happening in real time—and that’s exactly where the watch command shines.
At its core, watch repeatedly executes a command at regular intervals and displays the output on the screen, refreshing automatically. It’s simple, but invaluable when you need to keep an eye on critical metrics.
What does watch do?
The idea is straightforward:
- Runs the specified command.
- Refreshes the output at a chosen interval (default: 2 seconds).
- Keeps updating the terminal until you stop it (Ctrl + C).
With -n you define the interval. Using -n 1 runs the command every second, giving you near real-time updates.
Practical examples for sysadmins
1. Monitor disk usage
watch -n 1 'df -h'Code language: JavaScript (javascript)Shows free space across mounted filesystems, refreshing every second.
Typical use: tracking a log file or temp directory that’s eating up space quickly.
2. Watch open ports and network connections
watch -n 1 'ss -tulpn'Code language: JavaScript (javascript)Displays TCP/UDP connections and listening sockets.
Typical use: check if a service is listening, see if ports free up after restarting a daemon, or detect sudden connection floods.
3. Spot CPU hogs
watch -n 1 'ps aux --sort=-%cpu | head -10'Code language: JavaScript (javascript)Lists the top 10 CPU-consuming processes, refreshing every second.
Typical use: identifying runaway processes during a load spike.
4. Keep an eye on a directory
watch -n 1 'ls -lh /etc/nginx/conf.d/'Code language: JavaScript (javascript)Shows changes in a config directory in real time.
Typical use: verifying if configs are being updated or files generated by a process.
Disaster mode or recovery mode
Sysadmins often joke that watch is perfect for:
- Watching the disaster grow: a filesystem filling up, thousands of sockets spawning…
- Or watching yourself fix it: once logs rotate, services restart, or cleanup scripts run, you can see the impact immediately.
That quick feedback loop is priceless in crisis mode.
Handy watch options
-d: highlights differences between updates (great for spotting what changes).watch -d -n 1 'df -h'-t: hides the header that shows refresh interval and timestamp.-g: stopswatchwhen output changes.
Best practices
- Choose the right interval: not everything needs
-n 1. Sometimes every 5–10 seconds is enough. - Filter the output: pipe into
greporawkto focus only on what matters.watch -n 1 "ss -tulpn | grep 443" - Don’t overload production: avoid running heavy commands every second on critical servers.
Quick cheat sheet for sysadmins
| Command | What it does | When to use it |
|---|---|---|
watch -n 1 'df -h' | Monitor disk space in real time | Spot growing logs or temp files |
watch -n 1 'ss -tulpn' | Watch open ports and connections | Check if services are listening or detect floods |
| watch -n 1 ‘ps aux –sort=-%cpu head -10’ | See top CPU processes | Need monitor CPU processes |
watch -n 1 'ls -lh /path/' | Monitor directory changes | Confirm config or file updates |
watch -d -n 2 'free -m' | Highlight changes in memory usage | Detect leaks or memory spikes |
Conclusion
watch isn’t a replacement for full monitoring stacks like Prometheus, Nagios, or Zabbix. But when you need immediate, interactive feedback on what’s happening in your system, it’s one of the most powerful tools in your belt.
Whether it’s for spotting trouble as it unfolds—or confirming that your fix actually works—watch -n 1 is a sysadmin’s best friend for real-time troubleshooting.
FAQ
What’s the difference between watch and a while loop in bash?
Both can run commands repeatedly, but watch handles screen refreshing, highlighting changes, and is simpler to use interactively.
Can I script with watch?
Yes, though it’s mostly for interactive use. For automated monitoring, other tools are more appropriate.
Is watch available on all systems?
It’s standard in most Linux distros and Unix-like systems. On Windows, you can use it through WSL or similar tools.
Can watch cause performance issues?
Yes, if you run resource-intensive commands every second. Always balance interval and system load.
