watch(1) has been in util-linux since forever, and it does one thing: rerun a command every N seconds and paint the latest output. The moment something interesting flickers by, it's gone. If the number you wanted changed 30 seconds ago while you were reading your Slack, tough — go rerun the command and hope it repeats.

viddy (Sachaa-Thanasius' Rust rewrite of the original Go tool by sachaos) is the same program with a ring buffer nailed to the back. Every snapshot is kept. You can pause, scroll back through history, and diff any two moments against each other. It's watch(1) with rr-flavored time travel.

Install it: cargo install viddy, or grab a static binary from GitHub releases. Single file, no daemon.

The basics look identical to watch:

# refresh every second, show diff highlighting
viddy -n 1 -d df -h /var/lib/docker

# quote the whole pipeline like you would with watch
viddy -n 0.5 'ps -eo pid,rss,comm --sort=-rss | head -20'

The interesting part is the keys. Press Space to pause the timeline. Now Shift+J/K scrolls through every captured snapshot with timestamps. d toggles diff mode — additions and removals get highlighted against the previous snapshot. s pops up a searchable snapshot picker so you can jump directly to "the frame from 4 minutes ago." t hides the header if you want a clean screen for a demo.

Where it earns its keep is watching flaky or bursty things:

# catch the exact second a connection appears
viddy -n 0.5 'ss -tnp state established | grep :5432'

# find WHEN the leak started, not just that it's leaking
viddy -n 2 -d 'cat /proc/$(pidof myapp)/status | grep -E "^(Vm|Rss)"'

# watch a k8s rollout and rewind to see which pod flapped
viddy -n 1 'kubectl get pods -o wide'

Two flags worth knowing. --differences=cumulative (or press Shift+D) highlights every byte that has ever changed since you started watching — perfect for finding the one counter in a giant status dump that actually moves. And --pty runs your command in a pty so ANSI-colored tools (like btop-style output or kubectl get with colors) render correctly instead of showing raw escape sequences.

There's also a subtler feature: viddy records the wall-clock duration each command took to execute. If your monitoring one-liner starts taking 3 seconds instead of 50ms, you can see that regression in the timeline header without instrumenting anything. I've caught misbehaving kubectl API servers and slow docker ps daemons this way.

What it isn't: a metrics system. Snapshots live in RAM only, and by default it keeps the last 10,000 (tunable via --tail). Once you close viddy, the timeline is gone. It's a debugging tool for the "I need to catch this in the act" moment, not a Prometheus replacement.

The one gotcha: on some terminals the default keybindings for scrolling back conflict with tmux copy mode. Check viddy --help and remap in ~/.config/viddy.toml if needed — the config is TOML and takes about 30 seconds to skim.