Watch – A Useful Linux Command You May Have Never Heard Of

Posted by Artem Russakovskii on August 4th, 2007 in Linux

Updated: November 9th, 2007

How many times did I want to watch a directory waiting for a file to appear in it? Constant ls, for example, quickly got boring. A quick Perl script that would reload ls every 5 seconds… yeah it works but it takes a while to type up, and often enough I'm too lazy for that. And then I found 'watch' – a utility that comes with most *nix distros. Look at this beauty [man watch]:

watch – execute a program periodically, showing output fullscreen

watch [-dhvt] [-n ] [–differences[=cumulative]] [–help]
[–interval=] [–no-title] [–version]

watch runs command repeatedly, displaying its output (the first screen
This allows you to watch the program output change over time.
By default, the program is run every 2 seconds; use -n or –interval to
specify a different interval.

The -d or –differences flag will highlight the differences between
successive updates
. The –cumulative option makes highlighting
"sticky", presenting a running display of all positions that have ever
changed. The -t or –no-title option turns off the header showing the
interval, command, and current time at the top of the display, as well
as the following blank line.

watch will run until interrupted.

Note that command is given to "sh -c" which means that you may need to
use extra quoting to get the desired effect.

Note that POSIX option processing is used (i.e., option processing
stops at the first non-option argument). This means that flags after
command don't get interpreted by watch itself.

To watch for mail, you might do

watch -n 60 from

To watch the contents of a directory change, you could use

watch -d ls -l

If you're only interested in files owned by user joe, you might use

watch -d 'ls -l | fgrep joe'

To see the effects of quoting, try these out

watch echo $$
watch echo '$$'
watch echo "'"'$$'"'"

You can watch for your administrator to install the latest kernel with

watch uname -r

(Just kidding.)

Now if anyone knows how to make watch print the bottom part of the command output rather than the top, please post a comment.

Edit: BSD users, "watch" out. watch does something completely different on BSD (it lets you snoop on other users' ttys). The corresponding BSD command is actually cmdwatch.

● ● ●
Artem Russakovskii is a San Francisco programmer and blogger. Follow Artem on Twitter (@ArtemR) or subscribe to the RSS feed.

In the meantime, if you found this article useful, feel free to buy me a cup of coffee below.

  • Carlos from Philly

    Not sure what you mean by:
    "Now if anyone knows how to make watch print the bottom part of the command output rather than the top, please post a comment."
    But using the –no-title option eliminates the:
    Every 5.0s: ls Thu Jul 24 09:53:45 2008
    portion of the output, giving you only the result of the stuff in your quotes (at the specified interval and maintaining the specified options, of course).

  • Carlos, what I mean is, if you are trying to watch a long directory listing that doesn't fit the screen, screen would show you the top output of 'ls' for example, not the bottom.

    • duplex

      This is super super old I just was reading through while working and wanted to add this.

      watch -n1 ls -latr < will watch a and should give you the latest changes so long as they are not being -p to preserve them, or rsync -avHS'd.

      • duplex

        sorry actual is: watch -n1 ls -lat

      • Gavin Cowie

        Another alternative – pipe the output of ls through "tail":
        ls -latr|tail

  • Guy

    Just pipe it out to the tail function, try this:

    watch -d 'ls -l /usr/bin | tail -n 50'

    Works quite well. Now if it could only take an action when something changed, i.e., move files in a directory when we found changes to a directory.

  • YB

    Thanks, Guy!
    I was looking for a way to watch a certain part of a long output and your tailpipe solution was perfect!

  • Actually i have heard of the command but i must admit that i have really used it 🙂 Nice post, though !

  • redraven

    I use this quite frequently:
    watch -n 1 -d /usr/bin/sensors

  • lakshmi

    Learn something new everyday! Nice post.

  • jlampa

    While watch is pretty useful, a better solution in this case would be to use inotify / incron, which is like cron, but based on filesystem events instead of a schedule.

  • kisiel

    So you plan to become a millionaire without actually providing any value, as evidenced by this post, copied in haste from a man page. The best of luck with that.

    • Thanks for stopping by and commenting on a 3-year old article, and for your kind and not at all passive aggressive wish. I am in fact working on becoming a millionaire in this exact way. Moreover, I believe this very page will push me past the $999,999.

      • Kris

        Love the reply. I hope my comment pushes you over $999,9999.00

        • Oliver

          Replying in a 6-year old post to a 3-year old comment, woohoo !

          Simply : me, that article was plenty useful, as "watch" was exactly what I wanted, so, thank you ! 🙂
          Also, because it was simpler to google for an equivalent to inotify than to install it on my debian and read the man page to find how to make it work 😉

  • Abhiram


    Am trying to redirect the o/p of the watch command to a file.

    For ex — watch -n 10 ps >> output.txt

    This is giving the o/p in the file BUT, is adding these junk characters in addition. ALSO, it is NOT separating the outputs at different intervals. Its just mixing it all up.

    Help needed to separate the outputs at diff intervals and NOT print the special characters!!


  • Seabrook

    Type the following:

    watch 'tail -1 /var/log/secure >> /root/sechist'

    to create a cumulative file of the last line of the
    /var/log/secure file, sampling every two seconds.

    Then execute the following to see only the changes

    uniq /root/sechist

    Do an su command in another window to generate
    some changes for this command.

  • Thomas

    Nice and useful post. When I recover data from bad HDDs, I used frequent "df -h" in 2 minutes interval. So I think "watch -n 120 -d df -h" will make me free from frequent typing. Cheers!

  • soi

    Hi Artem,

    I wonder how to have "watch" execute a command or an application for me after its detection of something "new" created or changed? For example, I issue the command $watch 'ls /home/user/' and want to execute a script call upload.sh every time a new file created and detected by "watch"?

    Thank you!

    • Don't think you can do that with watch. If you want to detect file system changes, I suggest you look into lsyncd or inotify-tools.

  • Admak

    Hey Artem,
    Need to take out the single value from watch's output, I'm translating the recursive sapces & delimiting it, viz.,
    pid=`watch -n 5 –no-title
    'ps -e -o pid,uname,cmd,pcpu –sort=-pcpu | head -2 | tail -n 1 | tr -s " " | cut -d" " -f1'`,
    but when I echo my var, it's having nothing,
    simply, watch is not getting quit, so the issue.
    Please help me through, Thanks for the same.

  • Pingback: How can I monitor the memory usage?()

  • David Shenis B

    Hi Artem, NGinx does not seem to support UDP proxying. What are the options for integrating 3rd party modules that support UDP proxy.

  • Alex

    Thanks! Dint know about "-d"