158

How would I 'attach' a console/terminal-view to an applications output so I can see what it may be saying?

How would I detach from an applications output without killing the application?

Normally if you fire up a talkative application using the command line you get to see all kinds of wonderful output. However, let’s say I have a particularly chatty programming running, like KINO, and I want to view its output at any given moment without restarting it through the command line. I cannot; at least I don't know how.

2
  • 1
    Do you have debug symbol in your process? Does it run in production environnement? And if so do you need it to NEVER been paused ? Apr 3, 2009 at 22:39
  • When I have bouts of stability issues with end user programs like kino (crashes and kills my sound) I want to be able to know how/why it crashed so I can work on fixing it. This isn't a program I'm developing but a technique I'd like to know for trouble shooting. I'll try your suggestion below.
    – aggitan
    Apr 4, 2009 at 0:26

8 Answers 8

387

I think I have a simpler solution here. Just look for a directory whose name corresponds to the PID you are looking for, under the pseudo-filesystem accessible under the /proc path. So if you have a program running, whose ID is 1199, cd into it:

$ cd /proc/1199

Then look for the fd directory underneath

$ cd fd

This fd directory hold the file-descriptors objects that your program is using (0: stdin, 1: stdout, 2: stderr) and just tail -f the one you need - in this case, stdout):

$ tail -f 1
15
  • 17
    I was unable to use tail as in my case the output was redirected to another process for input, but more showed me the current data.
    – Ωmega
    Sep 13, 2013 at 14:38
  • 15
    One of the most riveting posts on this site!
    – robert
    Jan 23, 2016 at 9:09
  • 3
    more is working for me. ubuntu 14.04 on a node process May 4, 2016 at 7:01
  • 5
    This is not working for me with a java process which calls System.out.println. There is no output at all to /proc/[pid]/fd/1
    – Nick
    May 13, 2016 at 14:34
  • 1
    Tried to create a reproduction using the below, but to no avail: ``` docker run -it --name container1 ubuntu bash -c -i "COUNT=0; while true; do echo Keep the dance floor beat going; ((COUNT++)); sleep 1; echo \"Count is: \${COUNT}\"; done;" ``` In another terminal: ``` docker exec -it container1 tail -f /proc/1/fd/1 ``` Dec 27, 2016 at 18:28
69

I was looking for this exact same thing and found that you can do:

strace -ewrite -p $PID

It's not exactly what you needed, but it's quite close.

I tried the redirecting output, but that didn't work for me. Maybe because the process was writing to a socket, I don't know.

2
  • 1
    thanks it works, but output is truncated, e.g. for ping: write(1, "64 bytes from 1.0.0.1: icmp_seq="..., 56) = 56
    – izy
    Jul 24, 2020 at 0:48
  • 4
    @izy you can specify a -sLENGTH flag to set a new buffersize (default 32). for more details, check unix.stackexchange.com/a/58601 Sep 7, 2021 at 7:50
24

There are a few options here. One is to redirect the output of the command to a file, and then use 'tail' to view new lines that are added to that file in real time.

Another option is to launch your program inside of 'screen', which is a sort-of text-based Terminal application. Screen sessions can be attached and detached, but are nominally meant only to be used by the same user, so if you want to share them between users, it's a big pain in the ass.

4
  • 1
    "There are a few options here. One is to redirect the output of the command to a file, and then use 'tail' to view new lines that are added to that file in real time." Can this be done with already running applications?
    – aggitan
    Apr 3, 2009 at 21:23
  • 2
    You probably need tail -f $log_file to get the output as it is written in the file. Also, no, there is no way I know of to do that with an already running app.
    – Varkhan
    Apr 3, 2009 at 21:29
  • @aggitan: No. For existing applications, you'll have to restart them, because they've already bound their I/O to the controlling terminal.
    – Don Werve
    Apr 3, 2009 at 22:08
  • 1
15

For me, this worked:

  1. Login as the owner of the process (even root is denied permission)

    ~$ su - process_owner
    
  2. Tail the file descriptor as mentioned in many other answers.

    ~$ tail -f /proc/<process-id>/fd/1 # (0: stdin, 1: stdout, 2: stderr)
    
1
  • 3
    What if file descriptors point to a socket? # ls -la /proc/24510/fd/1 lrwx------ 1 root root 64 Oct 31 08:34 /proc/24510/fd/1 -> socket:[444026]
    – Fusion
    Sep 15, 2021 at 13:55
15

You can use reptyr:

sudo apt install reptyr
reptyr pid
1
  • 3
    if reptyr $PID did not work try sudo reptyr -T $PID based on this issue
    – weshouman
    Oct 25, 2020 at 5:43
8

How would I 'attach' a console/terminal-view to an applications output so I can see what it may be saying?

About this question, I know it is possible to catch the output, even when you didn't launch sceen command before launching the processus.

While I never tried it, I've found an interesting article which explains how to do using GDB (and without restarting your process).

redirecting-output-from-a-running-process

Basically:

  1. Check the open files list for your process, thanks to /proc/xxx/fd
  2. Attach your process with GDB
  3. While it is paused, close the file you are interested in, calling close() function (you can any function of your process in GDB. I suspect you need debug symbols in your process..)
  4. Open the a new file calling the create() or open() function. (Have a look in comments at the end, you'll see people suggest to use dup2() to ensure the same handle will be in use)
  5. Detach the process and let in run.

By the way, if you are running a linux OS on i386 box, comments are talking about a better tool to redirect output to a new console : 'retty' . If so, consider its use.

3

I wanted to remotely watch a yum upgrade process that had been run locally, so while there were probably more efficient ways to do this, here's what I did:

watch cat /dev/vcsa1

Obviously you'd want to use vcsa2, vcsa3, etc., depending on which terminal was being used.

So long as my terminal window was of the same width as the terminal that the command was being run on, I could see a snapshot of their current output every two seconds. The other commands recommended elsewhere did not work particularly well for my situation, but that one did the trick.

2

An even simpler option is cat:

cat /proc/<pid>/fd/1

Especially if tail does not work for you due to permission errors (even using sudo), or if the process to monitor display a progress bar using curses or an equivalent library.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.