head, tail, and watch in Linux: Watch Output Live

head and tail take the ends of a file; watch repeats any command on a clock. Together they cover most "just show me the relevant part" moments — the newest log lines, the first rows of an export, a live refresh of either.

The ends of files #

First and last lines

$ head -20 export.csv
$ tail -5 deploy.log

Both default to ten lines, take -n for a count, and accept -c for bytes. A range in the middle combines them:

Lines 41-60: skip 40, take 20

$ tail -n +41 file.log | head -20

Following live output #

tail's superpower is -f: keep the file open and print new lines as they arrive. Watching a deploy or a service start is this command and nothing else:

Follow a log as it grows

$ tail -f /var/log/nginx/error.log

-F goes further and re-opens the file if it is rotated — the right choice under logrotate-managed paths where -f silently dies mid-shift. Feeding that stream onward is where grep earns a seat:

Follow only the errors

$ tail -F app.log | grep --line-buffered error

watch: any command, repeated #

watch re-runs a command on an interval and repaints the screen — a dashboard out of anything:

Refresh disk usage every 5 seconds

$ watch -n 5 'df -h /'
$ watch -d 'ss -s'

-d highlights what changed between runs, which turns even a slow query into a legible trend.

Tool	Job
`head -n N`	First N lines
`tail -n N`	Last N lines
`tail -f` / `-F`	Follow as the file grows
`watch -n S cmd`	Re-run cmd every S seconds
`multitail`	Follow several logs at once (honourable mention)

The systemd and process notes pair well with these habits; the whole terminal notes series is on the journal.