System monitoring from the command line

Command Line – watch and fswatch

© Lead Image © Shao-Chun Wang,

© Lead Image © Shao-Chun Wang,

Article from Issue 257/2022

Two monitoring tools, watch and fswatch, let you gather system information from the command line.

Most users familiar with Linux have probably used cron or at to schedule the running of commands. Both can be useful in their place: cron for repeated scheduling of events and at for scheduling an event once. However, what both lack is the ability to gather system information and respond to it unless you write a specific script. Usually, it is much easier to use watch [1] and fswatch [2] to do both these things. While watch and fswatch can be used simply to gather information or to check for possible security incursions, both can be tweaked to act like a scheduler with little effort and minimal script-writing ability.


The purpose of watch is to follow how a command's output changes over time (Figure 1). This information can be used for troubleshooting, as well as for keeping a root or regular user informed about system changes as new packages are installed or updated. In limited circumstances, it could also be used as a simpler replacement for at or cron. Several other common uses are shown in Table 1. By default, watch runs every two seconds until closed or interrupted. The basic command structure is:



Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Motion Sensor

    Inotify lets applications subscribe to change notifications in the filesystem. Mike Schilli uses the cross-platform fsnotify library to instruct a Go program to detect what's happening.

  • iWatch

    Why wait for cron? iWatch monitors critical files and directories in realtime. This handy Perl script then notifies the user or runs a configurable command when change occurs.

  • Perl: Monitoring MAC Addresses

    They say darkness is the friend of thieves, but the Perl daemon in this month’s column illuminates dastardly deeds, exposing hidden activities and alerting the admin when things seem to be going awry.

  • Charly's Column: iWatch

    Recently, sys admin Charly was faced with the task of synchronizing a directory on a server with two NFS-mounted clients. He wanted the whole thing to happen quickly and to be easily manageable, which ruled out DRBD and GlusterFS.

  • Command Line: MultiTail

    MultiTail is not only more powerful than Tail, it's also easier to use.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95

Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs