Linux "watch" command showing last 30 lines of nft list ruleset [duplicate]

I found solution while typing question

watch "bash -c 'sudo nft list ruleset | tail -n 30'" 

just:

watch -n 1 'nft list ruleset | tail -n 30' 

Most watch implementations these days invoke a shell to interpret the concatenation of their arguments as shell code as if using eval. Some have a -x options to cut the middle man and run the command directly so

So:

watch foo bar 

is actually the same as:

watch -x sh -c 'foo bar' 

And your:

watch "bash -c 'sudo nft list ruleset | tail -n 30'" 

Is like:

watch -x sh -c "bash -c 'sudo nft list ruleset | tail -n 30'" 

With that bash invocation totally unnecessary as sh can do piping just as well as bash and generally more efficiently.

You might want to make it:

sudo watch 'nft list ruleset | tail -n 30' 

Rather than:

watch 'sudo nft list ruleset | tail -n 30' 

even if watch or tail don't need superuser privileges to avoid the sudo overhead at each iteration (and filling up your audit logs).