The watch and tail commands can help monitor activity on Linux systems. This post looks at some helpful ways to use these commands. Credit: Loops7 / Getty Images The watch and tail commands provide some interesting options for examining activity on a Linux system in an ongoing manner. That is, instead of just asking a question and getting an answer (like asking who and getting a list of currently logged in users), you can get watch to provide you with a display showing who is logged in along with updates as users come and go. With tail, you can display the bottoms of files and see content as it is added. This kind of monitoring is often very helpful and requires less effort than running commands periodically. Using watch One of the simplest examples of using watch is to use the command watch who. You should see a list showing who is logged in along with when they logged in and where they logged in from. Notice that the default is to update the display every two seconds (top left) and that the date and time (upper right) updates itself at that interval. The list of users will grow and shrink as users log in and out. $ watch who This command will dissplay a list of logins like this: Every 2.0s: who dragonfly: Thu Feb 27 10:52:00 2020 nemo pts/0 2020-02-27 08:07 (192.168.0.11) shs pts/1 2020-02-27 10:58 (192.168.0.5) You can change the interval to get less frequent updates by adding a -n option (e.g., -n 10) to select a different number of seconds between updates. $ watch -n 10 who The new interval will be displayed and the time shown will change less frequently, aligning itself with the selected interval. Every 10.0s: who dragonfly: Thu Feb 27 11:05:47 2020 nemo pts/0 2020-02-27 08:07 (192.168.0.11) shs pts/1 2020-02-27 10:58 (192.168.0.5) If you prefer to see only the command’s output and not the heading (the top 2 lines), you can omit those lines by adding the -t (no title) option. $ watch -t who Your display will then look like this: nemo pts/0 2020-02-27 08:07 (192.168.0.11) shs pts/1 2020-02-27 10:58 (192.168.0.5) If every time the watched command runs, its output is the same, only the title line (if not omitted) will change. The rest of the displayed information will stay the same. If you want your watch command to exit as soon as the output of the command that it is watching changes, you can use a -g (think of this as the “go away”) option. You might choose to do this if, for example, you are simply waiting for others to start logging into the system. You can also highlight changes in the displayed output using the -d (differences) option. The highlighting will only last for one interval (2 seconds by default), but can help to draw your attention to the changes. Here’s a more complex example of using the watch command to display services that are listening for connections and the ports they are using. While the output isn’t likely to change, it would alert you to any new service starting up or one going down. $ watch 'sudo lsof -i -P -n | grep LISTEN' Notice that the command being run needs to be enclosed in quotes to ensure that the watch command doesn’t send its output to the grep command. Using the watch -h command will provide you with a list of the command’s options. $ watch -h Usage: watch [options] command Options: -b, --beep beep if command has a non-zero exit -c, --color interpret ANSI color and style sequences -d, --differences[=] highlight changes between updates -e, --errexit exit if command has a non-zero exit -g, --chgexit exit when output from command changes -n, --interval seconds to wait between updates -p, --precise attempt run command in precise intervals -t, --no-title turn off header -x, --exec pass command to exec instead of "sh -c" -h, --help display this help and exit -v, --version output version information and exit Using tail -f The tail -f command has something in common with watch. It will both display the bottom of a file and additional content as it is added. Instead of having to run a “tail” command again and again, you run one command and get a repeatedly updated view of its output. For example, you could watch a system log with a command like this: $ tail -f /var/log/syslog Some files, like /var/log/wtmp, don’t lend themselves to this type of handling because they’re not formatted as normal text files, but you could get a similar result by combining watch and tail like this: watch 'who /var/log/wtmp | tail -20' This command will display the most recent 5 logins regardless of how many of the users are still logged in. If another login occurs, a line will be added and the top line removed. Every 60.0s: who /var/log/wtmp | tail -5 dragonfly: Thu Feb 27 12:46:07 2020 shs pts/0 2020-02-27 08:07 (192.168.0.5) nemo pts/1 2020-02-27 08:26 (192.168.0.5) shs pts/1 2020-02-27 10:58 (192.168.0.5) nemo pts/1 2020-02-27 11:34 (192.168.0.5) dory pts/1 2020-02-27 12:14 (192.168.0.5) Both the watch and tail -f commands can provide auto-updating views of information that you might at times want to monitor, making the task of monitoring quite a bit easier whether you’re monitoring processes, logins or system resources. Related content how-to How to examine files on Linux Linux provides very useful options for viewing file attributes, such as owners and permissions, as well as file content. By Sandra Henry Stocker Oct 24, 2024 6 mins Linux how-to 8 easy ways to reuse commands on Linux Typing the same command again and again can become tiresome. Here are a number of ways you can make repeating commands – or repeating commands but with some changes – a lot easier than you might expect. By Sandra Henry-Stocker Oct 15, 2024 5 mins Linux news SUSE Edge upgrade targets Kubernetes and Linux at the edge SUSE Edge 3.1 includes a new stack validation framework and an image builder tool that are aimed at improving the scalability and manageability of complex Kubernetes and Linux edge-computing deployments. By Sean Michael Kerner Oct 15, 2024 6 mins Edge Computing Linux Network Management Software how-to Lesser-known xargs command is a versatile time saver Boost your Linux command line options and simplify your work with xargs, a handy tool for a number of data manipulation tasks. By Sandra Henry Stocker Oct 11, 2024 6 mins Linux PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe