watch

watch - a hands-on Linux lab on a real virtual machine.

Turn any command into a live, full-screen dashboard with watch. The header-and-output frame, the -n heartbeat with fractions, -d to highlight changes, -t to drop the header, quoting for pipelines, and -g to exit on change. watch refreshes in place, so the drills teach the shape of the frame; your clock and hostname vary.

Something on the machine is changing on its own. A file is being written to. A counter is climbing. A copy is filling the disk. You want to see it change, live, without babysitting the keyboard.

So you do what everyone does: run a command, read it, press the up-arrow, press Enter, read it again. Up, Enter. Up, Enter. Over and over. There is a command whose entire job is to end that. You give it one command and a heartbeat, and it re-runs that command for you, forever, until you stop it. It is called watch.

The black boxes below are a practice terminal: a safe sandbox that checks the one command each step teaches. One honest catch, unique to this lesson: watch takes over the WHOLE screen and refreshes it in place, like a live dashboard. A sandbox can only show you a single frozen frame of that moving picture. So read each output as one snapshot of a display that keeps updating on the real machine, and know that the clock and the machine name in it will read differently for you.

watch runs a command again and again on a timer and shows you only the latest result. It clears the screen between runs, so instead of a scrolling wall of repeated output you get one clean panel that updates in place. Think of a security camera feed: you do not walk to the door every two minutes, the screen just shows you the door, refreshing on its own.

By default watch re-runs your command every two seconds. You will change that timer soon, but two seconds is the starting heartbeat every time you type watch with no timer set.

watch is part of a toolkit called procps-ng. That is the same package that gives you ps and top, the tools engineers reach for to see what a running system is doing right now. watch is the general-purpose member of that family: point it at any command and it becomes a live view of that command.

The simplest way to feel watch is to point it at date, which prints the current time. On its own, date prints once and stops. Wrapped in watch, it becomes a ticking clock. And rather than accept the two-second default, set the heartbeat yourself with the -n flag: -n stands for the number of seconds between runs, so -n 1 means re-run once every second.

Before you run it, commit to a picture. date prints one line of text. watch puts a header bar above it. So you are about to see two things stacked: a header line, then the date underneath, and the date will tick forward every second.

watch -n 1 date

prompt: student@linuxcamp:~$ answer: watch -n 1 date output: Every 1.0s: date linuxcamp: Sat Jul 5 14:23:07 2026

Sat Jul 5 14:23:07 2026 hint: Type watch, then the -n flag, then how many seconds (1), then the command: watch -n 1 date

That is one frame of a screen that keeps refreshing every second on the real machine. The clock in the header, the machine name (linuxcamp here), and the date line underneath are all this machine's, at that one second. Yours will show your own hostname and your own moment, and both timestamps will keep climbing while watch runs. What never changes is the SHAPE, described next.

Read the frame top to bottom. The first line is the header watch adds for you. On the left it reads Every 1.0s: date, which tells you the heartbeat (every 1.0 seconds) and the command being run (date). On the right it shows the machine's hostname and the current time. Below the header is a blank line, and below that is the actual output of your command, the date line. That three-part shape (header, gap, live output) is every watch screen you will ever see. To stop it and get your normal prompt back, press Ctrl+C.

The number after -n does not have to be a whole number. watch accepts fractions, so -n 0.5 re-runs the command twice a second. That is useful when something changes fast and you want a near-live feel, though anything much quicker than half a second becomes a blur that is hard to read.

Point it at date again, but this time at half-second speed:

watch -n 0.5 date

prompt: student@linuxcamp:~$ answer: watch -n 0.5 date output: Every 0.5s: date linuxcamp: Sat Jul 5 14:23:07 2026

Sat Jul 5 14:23:07 2026 hint: Same as before, but the seconds can be a fraction: watch -n 0.5 date

Only one number changed from the last frame: the header now reads Every 0.5s instead of Every 1.0s. Everything else is the same live, machine-specific frame, refreshing here at twice the rate. Your hostname and timestamps will differ, and on the real screen the clock is moving.

When you are watching a command whose output barely moves, the one thing that changed can be hard to spot. The -d flag fixes that. -d stands for differences, and it highlights whatever changed since the last refresh. It draws the changed part in reverse video: the text and its background swap, so it stands out against the rest.

Run the clock again, this time with -d. On the real screen, the digits of the second that just ticked will be the highlighted part.

watch -d date

prompt: student@linuxcamp:~$ answer: watch -d date output: Every 2.0s: date linuxcamp: Sat Jul 5 14:23:07 2026

Sat Jul 5 14:23:07 2026 hint: Add the -d flag to highlight differences: watch -d date

The sandbox shows plain text, but on a real terminal the parts of the date line that changed since the last tick appear in reverse video. Notice the header here reads Every 2.0s: you dropped -n, so watch fell back to its two-second default. The highlight is what your eye is meant to catch, and it is invisible in a single still frame like this one.

Sometimes you want only the command's output and none of the chrome. The -t flag, short for no title, removes that top header line entirely. No heartbeat readout, no hostname, no clock, just the raw output of your command refreshing on a bare screen.

You have watched date with the header three times now. Watch it once with the header gone:

watch -t date

prompt: student@linuxcamp:~$ answer: watch -t date output: Sat Jul 5 14:23:07 2026 hint: Add the -t flag to drop the title line: watch -t date

Same live display, one difference: the header line is gone, so all that remains is the date output itself, still refreshing on the real machine. The timestamp shown is illustrative and will read as your own current moment. -t is handy when you are piping the display into something else or just want a cleaner panel.

Here is the mistake nearly everyone makes with watch at least once. You want to watch a command that contains a pipe, like counting the files in a folder with ls | wc -l. So you type watch ls | wc -l and it does something baffling.

The problem is who reads the pipe. Without quotes, the shell splits the line at the | FIRST, before watch ever sees it. So it runs watch ls on the left and feeds that full-screen watch display into wc -l on the right. You are no longer watching a file count. You are counting the lines of watch's own screen.

The fix is quotes. Wrap the whole pipeline in quotes and watch receives it as one unit, then re-runs the entire thing each tick. Any command with a pipe (|), a redirect (>), or a semicolon (;) needs to be quoted for watch.

watch 'ls | wc -l'

prompt: student@linuxcamp:~$ answer: watch 'ls | wc -l' output: Every 2.0s: ls | wc -l linuxcamp: Sat Jul 5 14:23:07 2026

7 hint: Put the whole pipeline in quotes so watch runs it as one command: watch 'ls | wc -l'

The quotes are the whole point of this frame. Because they are there, the header shows the full pipeline ls | wc -l as the command being watched, and the output is the single number of files, refreshing on the real screen as files come and go. The count 7 and the header clock are this machine's; yours will differ. Drop the quotes and you would be watching the wrong thing entirely.

Scaffolding off. No command is printed this time. You have every piece you need.

You are waiting for a file to change, and you do not want to sit staring at the screen or remember to press Ctrl+C. You want watch to keep an eye on the output of date and then quit ON ITS OWN the very first time that output is different from the run before. There is a single flag for exactly this: it stands for exit on change, and it is the letter after -d in the alphabet.

prompt: student@linuxcamp:~$ answer: watch -g date output: Every 2.0s: date linuxcamp: Sat Jul 5 14:23:07 2026

Sat Jul 5 14:23:07 2026 hint: The flag stands for exit on change and comes right after -d in the alphabet. Combine it with the command: watch -g date

The flag is -g. It tells watch to run normally, but the instant the command's output differs from the previous run, watch exits by itself and hands you back your prompt. No Ctrl+C needed. With date that happens almost immediately, since the time changes every second. -g is the move whenever you are waiting for a condition to flip: a deployment to finish, a file to appear, a process count to hit zero. You recalled a flag from its meaning alone, which is exactly the recall the real machine will ask of you.

Two failures are worth recognising on sight, because the fix is different for each.

watch: command not found. This one is not about your command, it is about watch itself: the shell cannot find the watch program at all. It means the procps-ng package that ships watch is not installed on that machine. What to check first: try ps or top; if those are missing too, the whole package is absent and needs installing.

watch: cannot allocate memory, or a pipeline that just behaves wrong. This is almost always the quoting mistake from earlier: an unquoted pipe or redirect let the shell hand watch only the first fragment and pipe watch's own full-screen output into the rest. What to check first: did you wrap a command containing |, >, or ; in quotes? watch 'ls | wc -l', not watch ls | wc -l.

The unquoted-pipe trap is the single most common watch bug, and it rarely gives a clean error, it just quietly watches the wrong thing. Whenever your command has a pipe, a redirect, or a semicolon in it, quote the whole command. That one habit prevents most watch confusion.

You earned this cheat sheet. Every row is a form of watch you just ran:

And the shape you can now read on any watch screen: a header line (heartbeat, command, hostname, clock), a blank line, then your command's live output underneath.

The flags stack. watch -d -n 1 'ls | wc -l' highlights changes, refreshes every second, and watches a quoted pipeline all at once. Reach for -d the moment you are hunting for the one value that moved in a busy screen.

The practice terminal has shown you the shape of watch: the header-and-output frame, the -n heartbeat with fractions, -d to highlight changes, -t to strip the header, quoting for pipelines, and -g to exit on change. Every one of those you typed yourself, and one you recalled from its meaning alone.

The Time module ends with one real Linux machine, the Time capstone mission, and that is where you run watch for real, against output that actually moves while you look at it. A VM boots just for you. It hands you objectives that use exactly what you practiced across this module: timing commands, repeating them, pausing between them, and watching them live. One difference from here: the mission shows no commands. You read the objective, you recall the command, you type it. That recall is what makes it stick.

Finish the other Time lessons, then go watch a real machine change in front of you.

Practice watch in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.