Use Linux `watch` for Live Command Snapshots

Need to check whether disk space is changing, or see which process is using CPU without rerunning a command by hand? Linux watch repeatedly runs a command and refreshes its output in the terminal.

watch -n 5 df -h

This runs df -h every five seconds. By default, watch refreshes every two seconds. Press Ctrl+C to stop it and return to your shell.

Think snapshots, not streams

watch starts a command again at each interval; it does not leave one command running and display its ongoing output. That makes it useful for checking changing system state, but not for reading new lines as they are appended to a log.

For example, use watch for a refreshed process listing or filesystem summary. For a growing log file, use tail -f or tail -F instead. The right tool depends on whether you want repeated snapshots or a stream of new output.

Practical checks

Refresh memory usage every five seconds:

watch -n 5 free -h

Refresh uptime and load averages:

watch -n 5 uptime

Show a short process snapshot, sorted by CPU use:

watch -n 2 'ps -eo pid,comm,%cpu --sort=-%cpu | head'

The quotes around the last command matter: they pass the whole pipeline to watch, so it reruns both ps and head. Without them, your current shell may interpret the pipe outside watch.

These examples redraw the terminal; they do not save a history of earlier results. If you need interactive process inspection, top is usually a better fit because it lets you navigate and sort a continuously updated view.

Make changes easier to spot

The -d option highlights differences between successive outputs:

watch -d -n 2 free -h

To hide the header that shows the command, interval, and time, use -t:

watch -t -n 5 df -h

Some implementations support -c to interpret color sequences from the command output:

watch -c -n 2 'ls --color=always'

Color depends on both watch and the command producing it. If you see garbled characters, remove color-forcing options or try without -c. Options can vary by implementation and version, so check watch --help if an option is rejected.

Quoting and shell behavior

Pipelines and shell operators need to reach watch as part of the command it repeats. Put a pipeline in quotes, as in the process example above.

Also, do not assume that aliases or shell functions from your interactive session are available to the command watch runs. Prefer the executable name and its full options. If a command depends on a particular shell's syntax, invoke that shell explicitly and test the command by itself first.

When watch is the wrong tool

Use watch when you want to rerun a command and see its latest output. Choose something else when the task differs:

• Follow appended log lines: use tail -f or tail -F.
• Follow systemd journal messages: use journalctl -f.
• Inspect processes interactively: use top.
• Run a task on a schedule: use a scheduler rather than treating watch as a background monitoring service.

watch is an interactive terminal utility. It redraws the available screen, so long output may be truncated or difficult to read. Narrow the command's output or enlarge the terminal if needed. For more options when inspecting processes, see this guide to listing Linux processes with ps, top, and pgrep.

A quick troubleshooting checklist

If you get watch: command not found, check whether it is available:

command -v watch

If it is missing, install the package that provides it using your distribution's package manager; both the package name and install command depend on the distribution.

If the repeated command behaves unexpectedly, run it once without watch first. That makes command errors easier to see. Then check that pipelines are quoted and that the command does not rely on an interactive alias or function.

For an unrecognized option, consult watch --help on that system. And when all you need is one current result, run the command directly—there is no benefit to refreshing a snapshot you only need once.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.