CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Scheduling / watch

watch

Re-run a command every few seconds, full screen

Beginnermonitoringtroubleshooting

watch runs a command repeatedly (every 2 seconds by default) and shows its latest output full screen, optionally highlighting what changed. It's the quick way to watch memory, connections, a queue depth or a file grow during an incident or a deploy.

Syntaxwatch [-n SECONDS] [-d] [-t] [-g] [-e] [-x] COMMAND

Watch it run

A load test is running and you suspect a memory leak. Watch free memory live.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
watch -n 2 free -h

The header shows the interval, the command, the host and the time of the last run. The screen refreshes in place every 2 seconds until you press Ctrl+C.

Anatomy of a command

$
commandwatch

Clears the screen, runs the command, shows the output, sleeps, and repeats until Ctrl+C.

How it works

watch (procps-ng) takes over the terminal with ncurses. Every interval it forks and runs your command through /bin/sh -c (or execs it directly with -x), reads its stdout and stderr through a pipe, and redraws the screen with a header showing the interval, the command, the hostname and the current time. With -d it compares the new screen buffer with the previous one and highlights the cells that changed. Output is cut to the terminal's size, so long output scrolls off the bottom. Because it uses sh -c, your shell's aliases and functions don't exist inside watch, and quoting decides what's part of the watched command. The interval is measured from the end of one run to the start of the next unless you use -p (--precise). -g exits as soon as the output changes, and -e stops when the command fails, which turns watch into a simple 'wait until' tool.

Options you'll actually use

-n SECSInterval between runs (default 2)
-dHighlight differences from the previous run (-d=permanent keeps them)
-tNo header line
-gExit when the output changes
-eFreeze and exit on a non-zero exit status
-xexec the command directly instead of via sh -c
-cInterpret ANSI colour codes in the output
-pPrecise: try to start every run exactly N seconds apart

Common mistakes

watch kubectl get pods | grep api

The pipe is applied to watch's screen output, not to each run.

watch 'kubectl get pods | grep api' # or kubectl get pods -w
watch -n 0.1 'expensive query'

watch reruns the command every interval; a heavy command in a tight loop can become the load you're investigating.

Use -n 5 or more for anything that hits a database or API
Using watch in a script or cron job

It needs an interactive terminal; non-interactively it fails with 'Error opening terminal' or spins forever.

A while loop with sleep, or watch -g in an interactive session only
watch ll or watch k get pods with your aliases

Commands run in sh -c, which doesn't have your bash aliases.

watch 'ls -lh' / watch 'kubectl get pods'

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Watch the newest lines of ~/logs/app.log every 2 seconds.

  2. 2

    In one terminal-only check, watch the size of /tmp/grow.txt with differences highlighted while a background loop appends to it.

  3. 3

    Make watch exit by itself as soon as the file /tmp/flag appears.

Related commands

sleepPause for a set time (retries, polling, containers)freeShow used, free and available memoryssSee listening ports and open connectionsdfReport used and free space per filesystem
PrevioussleepNextchmod
Linux / Scheduling / watch

watch

Re-run a command every few seconds, full screen

Beginnermonitoringtroubleshooting

watch runs a command repeatedly (every 2 seconds by default) and shows its latest output full screen, optionally highlighting what changed. It's the quick way to watch memory, connections, a queue depth or a file grow during an incident or a deploy.

Syntaxwatch [-n SECONDS] [-d] [-t] [-g] [-e] [-x] COMMAND

Watch it run

A load test is running and you suspect a memory leak. Watch free memory live.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
watch -n 2 free -h

The header shows the interval, the command, the host and the time of the last run. The screen refreshes in place every 2 seconds until you press Ctrl+C.

Anatomy of a command

$
commandwatch

Clears the screen, runs the command, shows the output, sleeps, and repeats until Ctrl+C.

How it works

watch (procps-ng) takes over the terminal with ncurses. Every interval it forks and runs your command through /bin/sh -c (or execs it directly with -x), reads its stdout and stderr through a pipe, and redraws the screen with a header showing the interval, the command, the hostname and the current time. With -d it compares the new screen buffer with the previous one and highlights the cells that changed. Output is cut to the terminal's size, so long output scrolls off the bottom. Because it uses sh -c, your shell's aliases and functions don't exist inside watch, and quoting decides what's part of the watched command. The interval is measured from the end of one run to the start of the next unless you use -p (--precise). -g exits as soon as the output changes, and -e stops when the command fails, which turns watch into a simple 'wait until' tool.

Options you'll actually use

-n SECSInterval between runs (default 2)
-dHighlight differences from the previous run (-d=permanent keeps them)
-tNo header line
-gExit when the output changes
-eFreeze and exit on a non-zero exit status
-xexec the command directly instead of via sh -c
-cInterpret ANSI colour codes in the output
-pPrecise: try to start every run exactly N seconds apart

Common mistakes

watch kubectl get pods | grep api

The pipe is applied to watch's screen output, not to each run.

watch 'kubectl get pods | grep api' # or kubectl get pods -w
watch -n 0.1 'expensive query'

watch reruns the command every interval; a heavy command in a tight loop can become the load you're investigating.

Use -n 5 or more for anything that hits a database or API
Using watch in a script or cron job

It needs an interactive terminal; non-interactively it fails with 'Error opening terminal' or spins forever.

A while loop with sleep, or watch -g in an interactive session only
watch ll or watch k get pods with your aliases

Commands run in sh -c, which doesn't have your bash aliases.

watch 'ls -lh' / watch 'kubectl get pods'

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Watch the newest lines of ~/logs/app.log every 2 seconds.

  2. 2

    In one terminal-only check, watch the size of /tmp/grow.txt with differences highlighted while a background loop appends to it.

  3. 3

    Make watch exit by itself as soon as the file /tmp/flag appears.

Related commands

sleepPause for a set time (retries, polling, containers)freeShow used, free and available memoryssSee listening ports and open connectionsdfReport used and free space per filesystem
PrevioussleepNextchmod