Unix Third Edition: Visual Quickstart Guide

Keeping Up with watch

As a system administrator, you practically have to have eyes in the back of your head and be aware of all kinds of activities that might be going on. The watch command is your friend. It keeps an eye on pretty much anything (users, system, or files) you want to monitor.

To watch:

• watch last

  Use watch to monitor the output of a specific command. When something changes, you’ll see it in the watch output (Figure 16.5). In this case, we’re monitoring who logged in and when.

  Figure 16.5. Use watch to keep an eye on the system.

  [View full size image]

  

  Or

• watch --differences=cumulative → ls -l /var/spool/mail

  You can watch to see ...