The watch and tail commands provide some interesting options for examining activity on a Linux system in an ongoing manner.\nThat is, instead of just asking a question and getting an answer (like asking who and getting a list of currently logged in users), you can get\u00a0watch\u00a0to provide you with a display showing who is logged in along with updates as users come and go.\n\nWith tail, you can display the bottoms of files and see content as it is added. This kind of monitoring is often very helpful and requires less effort than running commands periodically.\nUsing watch\nOne of the simplest examples of using watch is to use the command watch who. You should see a list showing who is logged in along with when they logged in and where they logged in from. Notice that the default is to update the display every two seconds (top left) and that the date and time (upper right) updates itself at that interval. The list of users will grow and shrink as users log in and out.\n$ watch who\nThis command will dissplay a list of logins like this:\nEvery 2.0s: who dragonfly: Thu Feb 27 10:52:00 2020\n\nnemo pts\/0 2020-02-27 08:07 (192.168.0.11)\nshs pts\/1 2020-02-27 10:58 (192.168.0.5)\n\nYou can change the interval to get less frequent updates by adding a -n option (e.g., -n 10) to select a different number of seconds between updates.\n$ watch -n 10 who\nThe new interval will be displayed and the time shown will change less frequently, aligning itself with the selected interval.\nEvery 10.0s: who dragonfly: Thu Feb 27 11:05:47 2020\n\nnemo pts\/0 2020-02-27 08:07 (192.168.0.11)\nshs pts\/1 2020-02-27 10:58 (192.168.0.5)\n\nIf you prefer to see only the command's output and not the heading (the top 2 lines), you can omit those lines by adding the -t (no title) option.\n$ watch -t who\nYour display will then look like this:\nnemo pts\/0 2020-02-27 08:07 (192.168.0.11)\nshs pts\/1 2020-02-27 10:58 (192.168.0.5)\n\nIf every time the watched command runs, its output is the same, only the title line (if not omitted) will change. The rest of the displayed information will stay the same.\nIf you want your watch command to exit as soon as the output of the command that it is watching changes, you can use a -g (think of this as the "go away") option. You might choose to do this if, for example, you are simply waiting for others to start logging into the system.\nYou can also highlight changes in the displayed output using the -d (differences) option. The highlighting will only last for one interval (2 seconds by default), but can help to draw your attention to the changes.\nHere's a more complex example of using the watch command to display services that are listening for connections and the ports they are using. While the output isn't likely to change, it would alert you to any new service starting up or one going down.\n$ watch 'sudo lsof -i -P -n | grep LISTEN'\n\nNotice that the command being run needs to be enclosed in quotes to ensure that the watch command doesn't send its output to the grep command.\nUsing the\u00a0watch -h command will provide you with a list of the command's options.\n$ watch -h\n\nUsage:\n watch [options] command\n\nOptions:\n -b, --beep beep if command has a non-zero exit\n -c, --color interpret ANSI color and style sequences\n -d, --differences[=]\n highlight changes between updates\n -e, --errexit exit if command has a non-zero exit\n -g, --chgexit exit when output from command changes\n -n, --interval seconds to wait between updates\n -p, --precise attempt run command in precise intervals\n -t, --no-title turn off header\n -x, --exec pass command to exec instead of "sh -c"\n\n -h, --help display this help and exit\n -v, --version output version information and exit\n\nUsing tail -f\nThe tail -f command has something in common with watch. It will both display the bottom of a file and additional content as it is added. Instead of having to run a "tail" command again and again, you run one command and get a repeatedly updated view of its output. For example, you could watch a system log with a command like this:\n$ tail -f \/var\/log\/syslog\n\nSome files, like \/var\/log\/wtmp, don't lend themselves to this type of handling because they're not formatted as normal text files, but you could get a similar result by combining watch and tail like this:\nwatch 'who \/var\/log\/wtmp | tail -20'\n\nThis command will display the most recent 5 logins regardless of how many of the users are still logged in. If another login occurs, a line will be added and the top line removed.\nEvery 60.0s: who \/var\/log\/wtmp | tail -5 dragonfly: Thu Feb 27 12:46:07 2020\n\nshs pts\/0 2020-02-27 08:07 (192.168.0.5)\nnemo pts\/1 2020-02-27 08:26 (192.168.0.5)\nshs pts\/1 2020-02-27 10:58 (192.168.0.5)\nnemo pts\/1 2020-02-27 11:34 (192.168.0.5)\ndory pts\/1 2020-02-27 12:14 (192.168.0.5)\n\nBoth the watch and tail -f commands can provide auto-updating views of information that you might at times want to monitor, making the task of monitoring quite a bit easier whether you're monitoring processes, logins or system resources.