Commands using watch (154)

  • Maybe this will help you to monitor your load balancers or reverse proxies if you happen to use them. This is useful to discover TIME OUTS and this will let you know if one or more of your application servers is not connected by checking. Show Sample Output

    watch -n 1 "/usr/sbin/lsof -p PID |awk '/TCP/{split(\$8,A,\":\"); split(A[2],B,\">\") ; split(B[1],C,\"-\"); print A[1],C[1],B[2], \$9}' | sort | uniq -c"
    ideivid · 2011-08-12 19:16:38 0
  • In certain cases you mighy need to monitor the server load caused by certain process. For example HTTP, while stress testing apache using ab (apache benchmark) you may want to monitor the server status,load, # of spawned HTTP processes, # of established connections, # of connections in close wait state, apache memory footprint etc. Show Sample Output

    watch -n1 "uptime && ps auxw|grep http|grep -v grep | grep -v watch|wc -l && netstat -ntup|grep :80 |grep ESTABLISHED|wc -l && netstat -ntup|grep :80|grep WAIT|wc -l && free -mo && ps -ylC httpd --sort:rss|tail -3|awk '{print \$8}'"
    rockon · 2012-06-06 12:12:10 1
  • This handles when you have a single call or channel. Other commands will strip out the result if there is a single channel or call active because the output changes the noun to be singular instead of plural. Show Sample Output

    watch "asterisk -vvvvvrx 'core show channels' | egrep \"(call|channel)\""
    rowshi · 2012-08-29 13:40:45 0
  • Sends the "USR1" signal every 1 second (-n 1) to a process called exactly "dd". The signal in some systems can be INFO or SIGINFO ... look at the signals list in: man kill

    watch -n 1 pkill -USR1 "^dd$"
    ivanalejandro0 · 2012-08-31 05:15:45 0
  • Sometimes top/htop don't give the fine-grained detail on memory usage you might need. Sum up the exact memory types you want

    watch "awk '/Rss/{sum += \$2; } END{print sum, \"kB\"}' < /proc/$(pidof firefox)/smaps"
    gumnos · 2015-09-19 00:36:34 5

  • 2
    watch grep \"cpu MHz\" /proc/cpuinfo
    wuziduzi · 2018-11-11 00:45:28 0

  • 2
    $ watch -c "netstat -natp 2>/dev/null | tail -n +3 | awk '{print \$6}' | sort | uniq -c"
    emanuele · 2018-11-22 10:37:48 1

  • 2
    watch ss -stplu
    wuziduzi · 2019-07-16 20:41:36 0
  • Use the command watch, which is really hard to pass nested quotes to, and insert newlines where they are supposed to go in the HTTP request. that is after 1.1 after the host and two newlines at the end before the EOF. i use this all day what? no support for HEREDOCs on commandlinefu's interface? need more fu. Show Sample Output

    watch -n 1 nc localhost 80 '<<EOF GET / HTTP/1.1 Host: tux-ninja Connection: Close EOF'
    JustinHop · 2009-08-06 23:20:31 0
  • If you're like some individuals who rely on ndiswrapper and cannot use kismet, this command may be of service. watch -n .5 "iwlist wlan0 scan | egrep 'ESSID|Encryption'" Or... watch -n .5 "iwlist wlan0 scan | egrep 'ESSID|Encryption' | egrep 'linksys'" :-) Hopefully you'll find some dd-wrt compatible routers.

    watch -n .5 "iwlist wlan0 scan"
    Abiden · 2009-08-20 23:05:04 0
  • If you need to keep an eye on a command whose output is changing, use the watch command. For example, to keep an eye on your load average

    watch 'cat /proc/loadavg'
    0disse0 · 2009-09-03 20:10:46 0
  • This time I added a print to reemaining energy, every minute, time stamped. The example shown here is complete and point to large discrepancies as time passes, converging to accuracy near the end. Show Sample Output

    echo start > battery.txt; watch -n 60 'date >> battery.txt ; acpi -b >> battery.txt'
    m33600 · 2009-10-19 05:28:15 0

  • 1
    watch -n 60 du /var/log/messages
    rbossy · 2009-10-27 14:53:41 0
  • If you just executed some long command, like "ps -aefww | grep -i [m]yProcess", and if you don't want to retype it or cycle backwards in history and waste time quoting it, then you can use history substitution.

    watch -n1 -d !!
    TeacherTiger · 2009-11-24 21:01:14 0

  • 1
    watch -n 1 -d "finger"
    tsiqueira · 2009-12-08 14:53:18 0
  • To monitor .vmdk files during snapshot deletion (commit) on ESX only (ESXi doesn't have the watch command): 1. Navigate to the VM directory containing .vmdk files. # watch "ls -tough --full-time *.vmdk" where: -t sorts by modification time -o do not list group information (to narrow the output) -u sorts by access time -g only here for the purpose to easily remember the created mnemonic word 'tough' -h prints sizes in human readable format (e.g., 1K 234M 2G) --full-time sets the time style to full-iso and does not list user information (to narrow the output) optionally useful parameters to the watch command: -d highlight changes between updates -n seconds to wait between updates (default is 2) -t turn off printing the header

    watch 'ls -tough --full-time *.vmdk'
    vRobM · 2010-08-20 17:28:28 0
  • Note: 1) -n option of watch accepts seconds 2) -t option of notify-send accepts milliseconds 3) All quotes stated in the given example are required if notification message is more than a word. 4) I couldn't get this to run in background (use of & at the end fails). Any suggestions/improvements welcome.

    watch -n 900 "notify-send -t 10000 'Look away. Rest your eyes'"
    b_t · 2010-10-05 09:39:31 1
  • Great for watching things like Maildir's or any other queue directory.

    watch "cat `ls -rcA1 | tail -n1`"
    donnoman · 2011-03-25 01:22:05 3

  • 1
    watch !!
    wincus · 2011-07-05 12:50:56 0
  • If you add the -d flag each difference in the command's output will be highlighted. I also monitor individual drives by adding them to df. Makes for a nice thin status line that I can shove to the bottom of the monitor.

    watch -d -n 5 df
    pcphillips · 2011-08-24 19:45:36 1

  • 1
    watch -n 1 "netstat -ntu | sed '1,2d' | awk '{ print \$6 }' | sort | uniq -c | sort -k 2"
    facecool · 2011-09-30 09:04:14 0

  • 1
    watch -t -c -n30 'wget -q -O- "" | html2text | sed -n "/Shipment Progress/,/Shipping Information/p" | grep -v "*" | ccze -A'
    mfr · 2013-06-20 06:01:25 1
  • Starts and shows a timer. banner command is a part of the sysvbanner package. Instead of the banner an echo or figlet commands could be used. Stop the timer with Ctrl-C and elapsed time will be shown as the result. Show Sample Output

    alias timer='export ts=$(date +%s);p='\''$(date -u -d @"$(($(date +%s)-$ts))" +"%H.%M.%S")'\'';watch -n 1 -t banner $p;eval "echo $p"'
    ichbins · 2013-08-24 16:18:45 1
  • Like top, but for files

    watch -d -n 2 'df; ls -FlAt;'
    G2G · 2013-09-17 05:44:47 0
  • Watch a dig in progress Show Sample Output

    watch -n1 dig
    ene2002 · 2013-12-26 19:23:27 3
  •  < 1 2 3 4 5 >  Last ›

What's this? is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Create a mirror of a local folder, on a remote server
Create a exact mirror of the local folder "/root/files", on remote server 'remote_server' using SSH command (listening on port 22) (all files & folders on destination server/folder will be deleted)

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Unite pdf files
pdfunite is a part of the poppler-utils. poppler-utils package is only 150KB. The alternative - pdftk package is 14MB! Install poppler-utils if you need simple pdf operation commands like unite, separate, info, text/html conversions

nmap fast scan all ports target

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

check open ports
Tested in Linux and OSX

Show every subdirectory (zsh)

Printable random characters
Reads psuedorandom bytes from /dev/urandom, filtering out non-printable ones. Other character classes can be used, such as [:alpha:], [:digit:] and [:alnum:]. To get a string of 10 lowercase letters: $ tr -dc '[:lower:]' < /dev/urandom | head -c 10

Delete all aliases for a network interface on a (Free)BSD system
The example command deletes all aliases for network interface 'em0' assuming that the aliases have netmask of and the master IP has some other netmask (such as See here -> for more on the rationale of this command.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.


Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: