Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

2026-01-17T08:12:50Z

Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

← Older revision		Revision as of 08:12, 17 January 2026
Line 1:		Line 1:
	[[Category:Wiki]]		[[Category:Wiki]]

			'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''


	== Common watch Command Use Cases ==		== Common watch Command Use Cases ==

Admin: Created page with "Category:Wiki == Common watch Command Use Cases == === Monitor Command Output at Regular Intervals === To run a command at regular intervals (default: every 2 seconds) and display the output: watch df -h This command runs `df -h` every 2 seconds, showing disk usage in human-readable format. === Monitor a Specific File for Changes === To monitor a file for changes, such as its content or size: watch ls -l /var/log/syslog Th..."

2026-01-12T20:14:34Z

Created page with "Category:Wiki == Common watch Command Use Cases == === Monitor Command Output at Regular Intervals === To run a command at regular intervals (default: every 2 seconds) and display the output: <nowiki> watch df -h</nowiki> This command runs `df -h` every 2 seconds, showing disk usage in human-readable format. === Monitor a Specific File for Changes === To monitor a file for changes, such as its content or size: <nowiki> watch ls -l /var/log/syslog</nowiki> Th..."

New page

[[Category:Wiki]]

== Common watch Command Use Cases ==

=== Monitor Command Output at Regular Intervals ===
To run a command at regular intervals (default: every 2 seconds) and display the output:

<nowiki>
watch df -h</nowiki>

This command runs `df -h` every 2 seconds, showing disk usage in human-readable format.

=== Monitor a Specific File for Changes ===
To monitor a file for changes, such as its content or size:

<nowiki>
watch ls -l /var/log/syslog</nowiki>

This command runs `ls -l` on the specified file (`/var/log/syslog`), displaying its file attributes and any changes every 2 seconds.

=== Change the Interval Between Command Executions ===
To change the default 2-second interval between executions:

<nowiki>
watch -n 5 df -h</nowiki>

This runs `df -h` every 5 seconds instead of the default 2-second interval.

=== Monitor Multiple Commands Simultaneously ===
To execute multiple commands in sequence and monitor their output:

<nowiki>
watch 'date; uptime; free -h'</nowiki>

This command runs `date`, `uptime`, and `free -h` sequentially every 2 seconds, showing the current time, system uptime, and memory usage.

=== Run a Command Once and Exit after a Period ===
To run a command only for a specified duration and then exit:

<nowiki>
watch -t -n 10 df -h</nowiki>

This command will run `df -h` every 10 seconds for a total of 10 seconds, then exit.

=== Highlight Changes in Command Output ===
To highlight the differences between successive outputs:

<nowiki>
watch -d df -h</nowiki>

The `-d` option highlights the differences in the output between each execution, making it easy to track changes.

=== Monitor File System Usage with Specific Criteria ===
To check for file system usage and highlight any changes in real-time:

<nowiki>
watch -d 'df -h | grep /dev/sda1'</nowiki>

This runs `df -h`, but filters for the file system mounted on `/dev/sda1`, highlighting any changes.

== Advanced watch Command Options ==

=== Watch for Output of a Command with Color ===
To display the output with color support (if supported by the command):

<nowiki>
watch -c ls --color=auto</nowiki>

This command will execute `ls --color=auto`, which displays files and directories with color in the output.

=== Customize the Watch Header ===
To customize or disable the header (showing the interval and command being executed):

<nowiki>
watch -t df -h</nowiki>

The `-t` option disables the default header in the output, showing only the results of the command.

=== Use watch with Complex Commands or Scripts ===
To execute and watch complex shell commands or scripts:

<nowiki>
watch 'echo "Disk space:"; df -h'</nowiki>

This command executes a more complex script or series of commands, displaying both text (`Disk space:`) and command output.

=== Monitor System Processes or Specific Process Information ===
To monitor the output of process-related commands:

<nowiki>
watch -n 1 'ps aux | grep apache2'</nowiki>

This runs `ps aux | grep apache2` every second to monitor the `apache2` process.

=== Watch System Resource Usage with Graphical Representation ===
To monitor resource usage with a graphical representation:

<nowiki>
watch -n 1 'vmstat 1'
</nowiki>

This command continuously runs `vmstat 1`, showing a real-time snapshot of system performance.

== Security Concepts ==

=== Monitoring System Resources for Security Threats ===
The `watch` command can be used to monitor system resources, such as CPU, memory, and disk usage, which is useful for detecting unusual activity indicative of a security breach.

For example, checking for high memory usage can help detect potential DDoS attacks or resource exhaustion:

<nowiki>
watch free -h</nowiki>

This command monitors memory usage in real-time, helping identify unusual consumption patterns that might indicate a security issue.

=== Monitoring Running Processes for Malicious Activity ===
By monitoring running processes, you can identify any unusual or unauthorized processes that might indicate a system compromise. For instance, watching the output of `ps aux` can reveal suspicious processes.

Example:

<nowiki>
watch 'ps aux | grep root'</nowiki>

This command continuously checks for processes running under the `root` user, which is useful for detecting unauthorized escalations or hidden rootkits.

=== Monitor Changes in Log Files for Security Events ===
You can use `watch` to monitor log files for suspicious activity. For instance, monitoring `/var/log/auth.log` for failed login attempts:

<nowiki>
watch 'tail -n 50 /var/log/auth.log | grep "Failed password"'</nowiki>

This continuously watches the `auth.log` file for failed SSH login attempts, helping to identify brute force attacks.

=== Real-Time Monitoring of Security Tools ===
`watch` can be used to monitor outputs from security tools like `snort`, `fail2ban`, or `suricata` to track active security measures on the system.

For example:

<nowiki>
watch 'fail2ban-client status sshd'</nowiki>

This command shows the status of the `fail2ban` service for the `sshd` service, helping monitor if there are active bans on malicious IP addresses.

== Useful Links ==

* https://man7.org/linux/man-pages/man1/watch.1.html
* https://www.gnu.org/software/coreutils/manual/html_node/watch-invocation.html
* https://linux.die.net/man/1/watch
* https://www.howtogeek.com/66985/using-the-watch-command-to-monitor-linux-commands-in-real-time/
* https://opensource.com/article/19/3/monitor-linux-commands-watch

WATCH - Command Examples - Revision history

Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "