Linux watch Command Examples for Monitoring System Activity

You’ve probably run df -h, waited a few seconds, and run it again while a file copy or backup was in progress. Instead of repeating the command yourself, watch can do it automatically. It reruns the command at a fixed interval and even highlights what changed, so it’s easy to spot updates.

Linux administrators and everyday Linux users often need to run the same command repeatedly while waiting for something to change. You might be checking disk space during a file copy, waiting for a service to start, or watching network connections while troubleshooting.

Running the same command every few seconds quickly becomes repetitive, and it’s easy to miss an important change. That’s where the watch command comes in.

It automatically reruns any Linux command at regular intervals and refreshes the output on your screen. It can even highlight what changed between updates, making it easy to monitor your system in real time without writing a shell script.

For example, you’ve probably run df -h, waited a few seconds, and run it again while a large file copy or backup was in progress. Instead of doing that manually, watch can rerun the command for you and update the display automatically, so you can easily see what’s changing.

In this guide, you’ll learn how to use the watch command with practical examples to monitor disk usage, services, log files, and other system activity directly from the terminal.

What the watch Command Does?

The watch command repeatedly runs another command at a fixed interval and refreshes the terminal with the latest output. By default, it reruns the command every 2 seconds, making it useful for monitoring system activity without repeatedly typing the same command.

The watch utility is included in the procps package on Debian-based distributions and procps-ng on RHEL-based distributions. It’s installed by default on most Linux systems, but if which watch doesn’t return a path, install it using the appropriate package manager for your distribution.

On Ubuntu/Debian:

sudo apt install procps

On RHEL/Rocky Linux:

sudo dnf install procps-ng

Note: sudo runs the installation with administrative privileges, which package managers require to install software system-wide.

This guide was tested on Ubuntu 26.04 and Rocky Linux 10, but the watch command works the same way on most modern Linux distributions.

Basic Syntax

The basic syntax is:

watch [options] command

By default, watch reruns the specified command every 2 seconds and refreshes the screen with the latest output.

For example:

watch df -h

Here:

• watch starts the monitoring process.
• df -h is the command that gets rerun repeatedly.
• The -h option displays disk sizes in a human-readable format, such as MB or GB.

Press Ctrl+C at any time to stop watch.

The output is displayed only while watch is running. Because it refreshes the screen instead of keeping a history, the output isn’t saved anywhere unless you explicitly redirect it to a file or use a logging tool.

Every 2.0s: df -h                         tecmint: Wed Aug  5 10:46:34 2026

Filesystem      Size  Used Avail Use% Mounted on
tmpfs           3.2G  2.0M  3.2G   1% /run
efivarfs        374K  222K  148K  61% /sys/firmware/efi/efivars
/dev/nvme0n1p1  458G   57G  378G  14% /
tmpfs            16G  336M   16G   3% /dev/shm
tmpfs           5.0M  8.0K  5.0M   1% /run/lock
tmpfs            16G     0   16G   0% /run/qemu
/dev/sda1       511M  6.2M  505M   2% /boot/efi
tmpfs           3.2G  136K  3.2G   1% /run/user/1000

Example 1: Monitor Disk Usage During a File Copy

Suppose you’re copying a large file from /tmp to a mounted NFS share and want to monitor the available disk space on both the source and destination filesystems.

watch -n 1 df -h /tmp /mnt/nfs-share

Here:

• -n 1 refreshes the output every second instead of the default 2 seconds.
• df -h /tmp /mnt/nfs-share displays disk usage only for the source and destination filesystems.

As the copy progresses, you’ll see the Used space increase and the Avail space decrease on the destination filesystem as data is written.

Monitoring both filesystems helps you confirm that the copy is progressing and lets you spot low disk space before the operation fails.

If watching disk space in real time helped you avoid a failed copy, share this tip with your team.

Example 2: Highlight What Changed Between Refreshes

Suppose you’re troubleshooting a service that unexpectedly opens or closes network ports. Instead of manually comparing the output of ss every few seconds, you can let watch highlight the changes for you.

watch -d ss -tunlp

Here’s what the options mean:

• -d highlights any differences between the current and previous screen, making changes easy to spot.
• ss -tunlp displays active TCP and UDP sockets along with the associated process names.

As services start, stop, or open new connections, watch highlights the affected lines so you can immediately see what changed without manually comparing each refresh.

If highlighting changes helped you spot an unexpected open port, share this tip with your team.

Example 3: Change the Refresh Interval

When you’re monitoring a system under heavy load, the default 2-second refresh interval may not be frequent enough to catch rapid changes, such as CPU temperature spikes.

watch -n 0.5 sensors

• -n 0.5 refreshes the display every 0.5 seconds instead of the default 2 seconds.
• sensors displays hardware sensor information, including CPU and system temperatures.

The -n option accepts fractional seconds, allowing you to monitor changes more frequently. However, the actual refresh rate depends on how long the command takes to run.

For example, if sensors takes 400 milliseconds to complete, setting the interval to 0.1 seconds won’t make the output update any faster.

Example 4: Exit watch Automatically When Output Changes

After restarting a service, you may want to wait until it’s fully running before performing the next task. Instead of repeatedly checking its status yourself, watch can stop automatically as soon as the output changes.

watch -g -n 2 'systemctl is-active nginx'

Here’s what each option does:

• -g (or --chgexit) tells watch to exit as soon as the command’s output differs from the first run.
• -n 2 checks the command every 2 seconds.
• systemctl is-active nginx reports whether the service is active, inactive, failed, or in another state.

As soon as the service changes from its initial state, for example, from activating to active—watch exits automatically. This is useful when you want to wait for a service to become ready before running another command.

For example:

watch -g 'systemctl is-active nginx' && echo "Nginx is ready!"

Once the service becomes active, watch exits, and the next command runs automatically.

Example 5: Monitor a Log File for New Entries

After updating a web server or reverse proxy configuration, you may want to keep an eye on the error log while sending test requests. Instead of repeatedly running tail, you can use watch to refresh the latest log entries automatically.

watch -n 1 -d 'tail -n 20 /var/log/nginx/error.log'

Here’s what the command does:

• -n 1 refreshes the output every second.
• tail -n 20 displays the last 20 lines of the log file on each refresh.
• -d highlights any lines that changed since the previous update, making new log entries easy to spot.

This isn’t a replacement for tail -f, which continuously streams new log entries and preserves everything as it arrives. Instead, watch gives you a refreshed snapshot of the latest log output, making it useful for quickly checking whether new errors are appearing while you test a configuration change.

Common Mistakes with watch Command

Here are a few common mistakes to avoid when using the watch command:

• Forgetting to quote pipelines: Running watch df -h | grep sda pipes watch’s screen output to grep, which isn’t usually what you want. Instead, quote the entire command so watch executes it as a single command:

  watch 'df -h | grep sda'
  

• Using a refresh interval that’s too short: If the command itself takes longer to run than the refresh interval, watch can’t update any faster. For example, if a command takes 3 seconds to complete, setting -n 1 won’t produce updates every second.
• Expecting scrollback or command history:- watch refreshes the screen on every update, replacing the previous output instead of keeping a history. If you need to preserve every line of output, redirect the command to a file or use a tool such as tail -f for log monitoring.
• Using watch with interactive programs: Commands such as top, htop, vim, and nano manage their own full-screen interface and aren’t intended to run inside watch. Run these programs directly instead.

watch vs. a Bash Loop or Cron Job

The watch command isn’t the only way to rerun a command, but it’s often the simplest when you want to monitor something interactively.

A Bash loop such as:

while true; do
    command
    sleep 2
done

can repeatedly run a command, but it requires writing a script or typing a loop. For quick, interactive monitoring, watch does the same job with a single command.

A cron job serves a different purpose. It’s designed to run commands automatically at scheduled times, usually every few minutes or hours, even when you’re not logged in. It’s not intended for continuously refreshing output on your terminal.

Use watch when you want to monitor a command in real time and stop it as soon as you’re done. If you need to save the output, send alerts, or run commands automatically in the background, a Bash script or cron job is a better choice.

Conclusion

The watch command makes it easy to monitor changes by automatically rerunning any Linux command at regular intervals. Whether you’re checking disk usage, watching a service start, or monitoring log files, it gives you a live view without writing a script.

You also learned how to refresh commands at custom intervals with -n, highlight changes with -d, and automatically exit when the output changes using -g.

The next time you find yourself running the same command over and over, try using watch instead. It’s a simple tool that can save time and make system monitoring much easier.

How do you use the watch command in your daily workflow? Let us know in the comments if you have a favorite use case or a helpful tip to share with other Linux users.

If this article helped, share it with someone on your team.