watchtee, one lesson per page
Thirty lessons for the two small tools that let you observe a command repeating and capture a stream while it flows: watch intervals and differences, precise timing and exit traps, tee append and multi-file copies, writing as root, process substitution fan-outs, pipe verdicts and broken pipes, and the watch-plus-tee recipe from the manual itself.
A diagram, the map, and one thing to try this week. That's a page.
watchtee, one lesson per page
Thirty lessons for the two small tools that let you observe a command repeating and capture a stream while it flows: watch intervals and differences, precise timing and exit traps, tee append and multi-file copies, writing as root, process substitution fan-outs, pipe verdicts and broken pipes, and the watch-plus-tee recipe from the manual itself.
Set in Space Grotesk, Inter and JetBrains Mono (SIL Open Font License).
Every fact in this book is as the official source states it, fetched and read during this build: the procps-ng watch(1) manual and the GNU coreutils tee(1) manual at man7.org/linux/man-pages, the tee invocation node of the GNU Coreutils Manual and the Redirections, Process Substitution and Pipelines nodes of the Bash Reference Manual at gnu.org, plus the FreeBSD watch(8) manual for the version-gated page; behaviour noted as differing across implementations or versions is flagged on its page. Demand evidence from live command-line threads, reconfirmed at dispatch; no facts are sourced from tutorials, howtogeek, linuxize, Reddit or StackExchange. An independent guide, not affiliated with or endorsed by the Free Software Foundation, the GNU project or procps-ng.
Your purchase is for personal use only. You do not have redistribution rights: please do not share, resell, or republish this book or its pages.
© 2026 Steve Hodgkiss. All rights reserved. Personal use only; no redistribution rights.
Edition 1.0 · stevehodgkiss.net
Contents
The loop
watch runs a command repeatedly until interrupted, on a two-second default with a header that reports timing and exit code, -n to set the interval, and -d to highlight what changed.
- 01Repeat, don't rerun
- 02Set the interval
Per the procps-ng watch(1) manual: 'watch runs command repeatedly, displaying its output and errors (the first screenful). This allows you to watch the program output change over time. By default, command is run every 2 seconds and watch will run until interrupted.'
Repeat, don't rerun
watch wraps one command in a loop you never write. Per the manual, it runs command repeatedly, showing output and errors, the first screenful, and it keeps going until interrupted.
Every rerun-by-hand habit, the up-arrow hammer on df, ping, ls, is this loop done manually. watch takes the rhythm and the clearing of the screen off your hands.
The tool runs the loop; you watch the change. That division of labour is the whole first idea.
Replace one up-arrow habit this week: run watch df -h instead of retyping df -h, and quit with q when you have seen enough.
Per the procps-ng watch(1) manual: '-n, --interval seconds: Specify update interval. Values smaller than 0.1 and larger than 2678400 (31 days) are converted into these respective bounds. Both "." and "," work for any locale. The WATCH_INTERVAL environment variable can be used to persistently set a non-default interval (following the same rules and formatting).'
Set the interval
The interval is a flag, not a rebuild. Per the manual, -n, --interval seconds sets the update interval, with values clamped to their bounds: nothing faster than 0.1 seconds, nothing slower than 2678400, thirty-one days.
Both '.' and ',' work for any locale, and the WATCH_INTERVAL environment variable sets a persistent non-default interval with the same rules.
Pick the rhythm to match the change you are waiting for: seconds for a ping, minutes for a log, hours for a backup.
Time one chore this week with -n: watch -n30 systemctl status one service, and pick the interval by how fast it actually changes.
Per the procps-ng watch(1) manual EXAMPLES: 'The command is passed to the shell, which allows you to make the pipeline. The quotes are a feature of the shell too.' with the example watch -n1 'grep "^cpu MHz" /proc/cpuinfo | sort -nrk4'.
Quote the pipeline
Everything after the options is one command, and watch hands it to a shell. The manual's example is watch -n1 'grep "^cpu MHz" /proc/cpuinfo | sort -nrk4', and it says plainly: the command is passed to the shell, which allows you to make the pipeline.
The quotes are a feature of the shell too: without them, your own shell would split the pipeline and hand watch only the first piece.
Pipes, redirection, variables inside a watched command only work because the whole thing stays quoted and reaches that inner shell intact.
Quote one pipeline this week: wrap a grep and sort pair in single quotes inside watch -n5 and watch the sorted screen refresh.
The fitting
tee copies standard input to each file and still passes it on, -a appends instead of overwriting, sudo tee writes root-owned paths because the shell does the redirect, and one input can feed many files.
- 01Copy, then pass on
- 02Write as root
Per the GNU coreutils tee(1) manual: 'tee - read from standard input and write to standard output and files'; 'Copy standard input to each FILE, and also to standard output'; and the GNU Coreutils Manual: 'This is useful when you want not only to send some data down a pipe, but also to save a copy.'
Copy, then pass on
tee is named for the plumber's fitting: one pipe in, branches out. Per the manual, tee copies standard input to each FILE, and also to standard output.
The Coreutils Manual states the use exactly: when you want not only to send some data down a pipe, but also to save a copy. The stream keeps flowing; a copy lands in the file.
Nothing about your pipeline changes shape. tee is a splice you can insert anywhere a stream already flows.
Splice one command this week: df -h | tee disk.txt, and confirm you saw the output on screen and the copy in the file.
Per the Bash Reference Manual, Redirections: 'redirections modify file handles in the current shell execution environment', so the shell performs the redirection as the invoking user before the command runs; per tee(1), tee 'copies standard input to each FILE'.
Write as root
The classic puzzle: sudo cmd > /etc/app.conf fails on permission. The Bash Reference Manual explains why: redirections modify file handles in the current shell execution environment. Your shell, running as you, opens the file before the command ever starts; sudo never touches the redirect.
The fix moves the write into the privileged process: echo 'value' | sudo tee /etc/app.conf. tee runs as root and copies standard input to each FILE; the producing command stays unprivileged.
The pipe character is doing the diplomacy: your data crosses the privilege boundary, not your whole command.
Use the pattern once this week: write one root-owned config line with a producing command piped into sudo tee, not a sudo'd redirect.
This book's plan: one observation habit, kept. When you run a command twice to see a change, wrap it in watch -d instead; when a stream is worth keeping, branch it through tee -a; save the pairs that earn their place in a snippets file.
One habit to keep
The two tools share one habit: stop consuming output by accident. When you catch yourself running a command twice to compare, wrap it in watch -d; when a stream matters, branch it through tee -a and keep the copy.
Keep the survivors in a snippets file: the diffing watch, the appending tee, the root-write pattern, the -p fan-out. Four lines already cover most daily observation work.
You now read observation as a decision, not a reflex. One habit a week and it stays.
Start the snippets file this week: save the first watch and tee pair you actually used, with the command and the date.