Say there's a running process that produces output, but you don't know where that output is redirected (it might go to a file, an open terminal, or /dev/null for all I know). Is it possible to snoop on existing process's output stream possessing only the PID of that process? Perhaps some way through /proc?
Add a comment
|
2 Answers
You can use this command to see output of a running process:
tail -f /proc/$PID/fd/1
-
Does that aggregate all output? What if the process is outputting to multiple files? (interesting, +1)SAFX– SAFX2013-10-09 19:32:16 +00:00Commented Oct 9, 2013 at 19:32
-
This is for grabbing stdout/stderr only.anubhava– anubhava2013-10-09 19:33:33 +00:00Commented Oct 9, 2013 at 19:33
-
To redirect an already running process's stdout/stderr see: serverfault.com/questions/213119/…anubhava– anubhava2013-10-09 19:34:54 +00:00Commented Oct 9, 2013 at 19:34
-
1This works only if the output is redirected to a file. It does not work if the descriptor points to a terminal
/dev/pts/4, and I did not bother callingtail -fon descriptor that points to/dev/nullS.T.A.L.K.E.R.– S.T.A.L.K.E.R.2013-10-09 19:37:05 +00:00Commented Oct 9, 2013 at 19:37 -
Check the link I provided. Using gdb you can redirect a running process's stdout/stderr to any other place you want.anubhava– anubhava2013-10-09 19:42:46 +00:00Commented Oct 9, 2013 at 19:42
Maybe you can try
lsof | grep $PID
Or
ps aux | grep $PID
