The watch command in Linux is a versatile tool for viewing live system output. The watch is invaluable to both those users in VPS and those who don’t want to run commands over and over in order to see dynamic data such as memory, CPU usage, disk space, and network connections.

This guide will walk you through everything you need to know about the watch command, from basic syntax to advanced usage, all with practical examples and a focus on VPS (Virtual Private Server) management.
The watch command is a utility in Linux that repeatedly executes a given command at specified intervals. By default, the watch refreshes every two seconds, but you can change this interval based on your needs. Each time it runs, the watch clears and re-displays the command’s output, providing you with live feedback on what’s happening on your system.
When managing a VPS, live monitoring can prevent unexpected issues from escalating. A VPS typically has limited resources, so tracking usage and other key metrics allows for quick adjustments before running into critical problems. With the watch, you can monitor processes, connections, and logs in real time, making it easier to manage server load, catch resource bottlenecks, and troubleshoot issues as they occur.
Before we get to the real-world examples, let’s dissect the syntax of the watch command and important options.
The general syntax of the watch command is as follows:
watch [options] <command>
The command you specify after watch will be re-run repeatedly, with results displayed at the specified interval.
Using -n will control how often watch refreshes, using the interval (in seconds), for example, for every five seconds of CPU usage, use.
watch -n 5 uptime

The -d option highlights any changes in the output between intervals. Such functionality is useful for identifying fluctuations, like variations in memory usage or system load.
watch -d free -m

By default, the watch displays a header with information about the command and interval. Using -t removes the header, so you only see the command’s output. This option is useful when you want a cleaner view, such as when displaying data on a larger screen or sending output to a file.
watch -t df -h
The watch may remove the color code that your command creates by default if yours generates color-coded output. –color can provide help for these commands that are color readable, such as ps or ls.
watch --color "ps aux | grep nginx"
You can combine these options for tailored monitoring. For example:
watch -n 10 -d --color "df -h | grep '/dev/sda1'"

This command will check disk usage every 10 seconds, highlight changes, and retain any color in the output.
The watch command shines in a VPS environment, where you often need to monitor and manage system resources and services. Here are some practical ways to leverage watches for many tasks.
The uptime command displays how the wound system has been running, how many active users are there, and the load averages. Running it with the watch helps you see real-time changes in system load:
watch uptime

Such a feature is especially beneficial on a VPS, where high loads can impact performance.
Disk space on a VPS can quickly run out when dealing with frequent uploads, backups, or large log files. Using df -h with watch provides a live view of disk usage:
watch df -h

If you want to monitor a specific disk or partition, you can combine it with grep:
watch "df -h | grep '/dev/sda1'"

Memory and CPU are one of the biggest resources on a VPS. With free -m, you can monitor memory in real-time to catch any memory spikes:
watch free -m

To observe CPU load, you can use:
watch "top -b -n 1 | head -n 10"

Monitoring network activity is also important when watching traffic or preventing any networking activity you don’t want. Running netstat with watch provides a live view of all open network connections:
watch netstat -tuln

The system logs tell you what’s happening on your server. Using the tail command along with the watch you can display the new logs as they’re created.
watch tail -n 10 /var/log/syslog

For targeted monitoring, you can filter log entries with grep:
watch netstat -tuln

To keep tabs on specific processes, use ps aux with grep:
watch "ps aux | grep nginx"

Such functionality is valuable for monitoring server software or services to ensure they are operating as expected.
It is important from a security point of view because you should know who is logged into your server. Keeping track of active user sessions is crucial for security:
watch who

Once you know the basics, you can build up stringing the watch with more complex commands.
The watch is equally effective When using complex commands with pipes; for example, to filter disk usage for a specific partition, you can use:
watch "df -h | grep '/dev/sda1'"

Creating custom scripts tailored to your VPS needs and running them with a watch adds flexibility. For instance, a simple script to check system load and free memory could look like this:
#!/bin/bash
echo "System Load:"
uptime
echo "Memory Usage:"
free -m

Save it as system_check.sh and make it executable with chmod +x system_check.sh.

Then, monitor it with a watch:
watch ./system_check.sh

Using grep to filter specific output is helpful in many scenarios. For example, to monitor error messages in your system log:
watch "tail -n 20 /var/log/syslog | grep 'error'"

To keep a watch command running while freeing up the terminal, run it in the background by appending &:
watch -n 30 "free -m" &

Awk and sed can be combined with watch to clean up and format output. For example, to display only the CPU usage from the top, you could use the following:
watch "top -b -n 1 | grep 'Cpu(s)' | awk '{print $2}'"

For commonly used commands, consider adding them as aliases in your .bashrc file. For example:
alias watchcpu="watch -n 5 free -m"

After adding the alias, you can type watch CPU to run it.

You want to get updates but not overwhelm the server, so be careful in choosing the appropriate interval. For fast-changing data, intervals from 5 to 10 seconds are useful. A 30-second interval is sufficient for less dynamic monitoring.
The colorized output is displayed by commands such as ps or ls, and thus, results are much simpler to interpret. It is possible to keep these colors using the –color option when loading large or complex outputs.
watch --color "ps aux | grep nginx"

Difference highlighting with -d is beneficial for spotting quick changes in dynamic data, such as CPU load or network traffic:
watch -d "ps aux | grep nginx"

For commands with excessive output, combining a watch with awk or sed can reduce clutter. For example:
watch "ps aux | grep apache | awk '{print $2, $3, $4}'"

The watch command is a simple tool you can use + for anyone managing a Linux VPS. Features include monitoring CPU and memory usage to monitoring log files and current active connections, making real-time system checks simple and uncluttered.
Try different watch commands to see which fits best for your VPS situation. You can maintane your server health and alert you to any potential problems before they occur with the right set of options.

Vinayak Baranwal wrote this article. Use the provided link to connect with Vinayak on LinkedIn for more insightful content or collaboration opportunities.