Watch file transfers live in the terminal

Use filetrace watch to see file transfers, processes and connections as they happen, filter the view, and record snapshots to a log file.

filetrace watch is a live dashboard of what the machine is sending: the file transfers in progress with their process, destination, method, rate and confidence, the processes ranked by the rate they send at, and the open connections. It refreshes every second and works with or without a running agent.

​

Start the live view

sudo filetrace watch

FILETRACE  web-01 · Linux 6.8  LIVE

4             13            6.67 MB/s
Transfers     Processes     Outbound

ACTIVE FILE TRANSFERS
PROCESS      FILE                         DESTINATION    METHOD           RATE  CONFIDENCE
nginx 1245   /var/www/stream.bin          203.0.113.25   sendfile    6.67 MB/s  EXACT
nginx 1245   /var/www/video.mp4           198.51.100.10  sendfile        0 B/s  EXACT
python 892   /data/export/customers.csv   203.0.113.50   read-write      0 B/s  INFERRED

● EXACT: 2   ● INFERRED: 1   LOST: 0
[F] Files  [P] Processes  [N] Network  [Space] Pause  [?] Help  [Q] Quit

The header shows the host, the kernel and whether the view is live or paused, then the number of transfers in progress, the processes with network activity and the outbound rate. The line under the table counts the transfers in progress by confidence, and LOST counts the events the collector could not record since it started.

When no agent is running, watch loads the probes itself and collects in the foreground for as long as it runs. It then needs the same privileges as the agent, and it starts with no history.

​

Switch views

Key	View
f	File transfers in progress
p	Processes, by the rate they send at
n	Network: open connections
space	Pause or resume refreshing
?	Show or hide the help, which also explains the columns
q	Quit

RATE, OUTBOUND and INBOUND are bytes per second over the last one to two seconds, counted where the local socket accepts or delivers them.

​

Narrow the view

The filters apply to every view, except --file and --remote, which select transfers:

sudo filetrace watch --remote 203.0.113.0/24 --confidence exact
sudo filetrace watch --process nginx
sudo filetrace watch --sort bytes --min-bytes 1MB --interval 2s

--sort orders the transfers by rate (default), bytes, process or file. --direction ranks processes and connections by outbound (default), inbound or both traffic. --limit sets the rows per table; by default the view shows as many as fit.

The full list of options is on the watch reference page.

​

Record snapshots

With --no-ui, watch prints a plain snapshot per interval instead of redrawing the screen. This is also what happens when the output is not a terminal, so redirecting to a file works without the option:

sudo filetrace watch --no-ui > activity.log

--- 2026-11-11 20:07:58 ---
FILETRACE  web-01 · Linux 7.0  LIVE

4             13            4.18 MB/s
Transfers     Processes     Outbound

ACTIVE FILE TRANSFERS
...

PROCESSES
PID   PROCESS   OUTBOUND  FILES  CONNECTIONS     SENT
...

● EXACT: 3   ● INFERRED: 1   LOST: 0

Each snapshot holds the transfers and processes tables, 10 rows each unless --limit says otherwise. For machine-readable records, follow the event stream instead: filetrace events --follow --jsonl. See Use Filetrace output in scripts.

​

Other live sources

To	Use
Print each event as it happens	sudo filetrace events --follow
Repeat the agent’s own statistics	sudo filetrace stats --watch
Graph rates over time	The Prometheus metrics
Stream transfers to a program	WatchTransfers in the gRPC API