> ## Documentation Index
> Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Watch file transfers live in the terminal

> Use filetrace watch to see file transfers, processes and connections as they happen, filter the view, and record snapshots to a log file.

`filetrace watch` is a live dashboard of what the machine is sending: the file transfers in progress with their process, destination, method, rate and confidence, the processes ranked by the rate they send at, and the open connections. It refreshes every second and works with or without a running agent.

## Start the live view

```bash theme={null}
sudo filetrace watch
```

```text theme={null}
FILETRACE  web-01 · Linux 6.8  LIVE

4             13            6.67 MB/s
Transfers     Processes     Outbound

ACTIVE FILE TRANSFERS
PROCESS      FILE                         DESTINATION    METHOD           RATE  CONFIDENCE
nginx 1245   /var/www/stream.bin          203.0.113.25   sendfile    6.67 MB/s  EXACT
nginx 1245   /var/www/video.mp4           198.51.100.10  sendfile        0 B/s  EXACT
python 892   /data/export/customers.csv   203.0.113.50   read-write      0 B/s  INFERRED

● EXACT: 2   ● INFERRED: 1   LOST: 0
[F] Files  [P] Processes  [N] Network  [Space] Pause  [?] Help  [Q] Quit
```

The header shows the host, the kernel and whether the view is live or paused, then the number of transfers in progress, the processes with network activity and the outbound rate. The line under the table counts the transfers in progress by confidence, and `LOST` counts the events the collector could not record since it started.

When no agent is running, `watch` loads the probes itself and collects in the foreground for as long as it runs. It then needs the same privileges as the agent, and it starts with no history.

## Switch views

| Key | View |
| - | - |
| `f` | File transfers in progress |
| `p` | Processes, by the rate they send at |
| `n` | Network: open connections |
| `space` | Pause or resume refreshing |
| `?` | Show or hide the help, which also explains the columns |
| `q` | Quit |

`RATE`, `OUTBOUND` and `INBOUND` are bytes per second over the last one to two seconds, counted where the local socket accepts or delivers them.

## Narrow the view

The filters apply to every view, except `--file` and `--remote`, which select transfers:

```bash theme={null}
sudo filetrace watch --remote 203.0.113.0/24 --confidence exact
sudo filetrace watch --process nginx
sudo filetrace watch --sort bytes --min-bytes 1MB --interval 2s
```

`--sort` orders the transfers by `rate` (default), `bytes`, `process` or `file`. `--direction` ranks processes and connections by `outbound` (default), `inbound` or `both` traffic. `--limit` sets the rows per table; by default the view shows as many as fit.

The full list of options is on the [`watch` reference page](https://filetrace.mintlify.site/cli/watch).

## Record snapshots

With `--no-ui`, `watch` prints a plain snapshot per interval instead of redrawing the screen. This is also what happens when the output is not a terminal, so redirecting to a file works without the option:

```bash theme={null}
sudo filetrace watch --no-ui > activity.log
```

```text theme={null}
--- 2026-11-11 20:07:58 ---
FILETRACE  web-01 · Linux 7.0  LIVE

4             13            4.18 MB/s
Transfers     Processes     Outbound

ACTIVE FILE TRANSFERS
...

PROCESSES
PID   PROCESS   OUTBOUND  FILES  CONNECTIONS     SENT
...

● EXACT: 3   ● INFERRED: 1   LOST: 0
```

Each snapshot holds the transfers and processes tables, 10 rows each unless `--limit` says otherwise. For machine-readable records, follow the event stream instead: `filetrace events --follow --jsonl`. See [Use Filetrace output in scripts](https://filetrace.mintlify.site/guides/automation.md).

## Other live sources

| To | Use |
| - | - |
| Print each event as it happens | `sudo filetrace events --follow` |
| Repeat the agent's own statistics | `sudo filetrace stats --watch` |
| Graph rates over time | The [Prometheus metrics](https://filetrace.mintlify.site/integrations/prometheus.md) |
| Stream transfers to a program | `WatchTransfers` in the [gRPC API](https://filetrace.mintlify.site/integrations/grpc-api.md) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.