Attach to a processes output for viewing

Question

How would I 'attach' a console/terminal-view to an applications output so I can see what it may be saying?

How would I detach from an applications output without killing the application?

Normally if you fire up a talkative application using the command line you get to see all kinds of wonderful output. However, let’s say I have a particularly chatty programming running, like KINO, and I want to view its output at any given moment without restarting it through the command line. I cannot; at least I don't know how.

Solution 1

There are a few options here. One is to redirect the output of the command to a file, and then use 'tail' to view new lines that are added to that file in real time.

Another option is to launch your program inside of 'screen', which is a sort-of text-based Terminal application. Screen sessions can be attached and detached, but are nominally meant only to be used by the same user, so if you want to share them between users, it's a big pain in the ass.

Solution 2

I think I have a simpler solution here. Just look for a directory whose name corresponds to the PID you are looking for, under the pseudo-filesystem accessible under the /proc path. So if you have a program running, whose ID is 1199, cd into it:

$ cd /proc/1199

Then look for the fd directory underneath

$ cd fd

This fd directory hold the file-descriptors objects that your program is using (0: stdin, 1: stdout, 2: stderr) and just tail -f the one you need - in this case, stdout):

$ tail -f 1

Solution 3

I was looking for this exact same thing and found that you can do:

strace -ewrite -p $PID

It's not exactly what you needed, but it's quite close.

I tried the redirecting output, but that didn't work for me. Maybe because the process was writing to a socket, I don't know.

Solution 4

For me, this worked:

1. Login as the owner of the process (even root is denied permission)

   ~$ su - process_owner
   

2. Tail the file descriptor as mentioned in many other answers.

   ~$ tail -f /proc/<process-id>/fd/1 # (0: stdin, 1: stdout, 2: stderr)
   

Solution 5

You can use reptyr:

sudo apt install reptyr
reptyr pid

View more solutions

Comments

[yves Baumes]

Do you have debug symbol in your process? Does it run in production environnement? And if so do you need it to NEVER been paused ?

[aggitan]

When I have bouts of stability issues with end user programs like kino (crashes and kills my sound) I want to be able to know how/why it crashed so I can work on fixing it. This isn't a program I'm developing but a technique I'd like to know for trouble shooting. I'll try your suggestion below.

[aggitan]

"There are a few options here. One is to redirect the output of the command to a file, and then use 'tail' to view new lines that are added to that file in real time." Can this be done with already running applications?

[Don Werve]

@aggitan: No. For existing applications, you'll have to restart them, because they've already bound their I/O to the controlling terminal.

[Ωmega]

I was unable to use tail as in my case the output was redirected to another process for input, but more showed me the current data.

[TJ Biddle]

@Ωmega - Wouldn't you be able to find the process that you're redirecting it into, and then tail it's stdin (/proc/#/0)?

[Ωmega]

In my environment actually tail didn't work at any scenario, only head and more...

[reinierpost]

See unix.stackexchange.com/questions/31824/…

[robert]

One of the most riveting posts on this site!

[Shih-Min Lee]

more is working for me. ubuntu 14.04 on a node process

[Nick]

This is not working for me with a java process which calls System.out.println. There is no output at all to /proc/[pid]/fd/1

[licorna]

@Nick I don't know about Java but you might need to check JRE pid (or something like that). I won't be impressed if Java is heavily buffering stdout either.

[JacobWuzHere]

Tried to create a reproduction using the below, but to no avail: ``` docker run -it --name container1 ubuntu bash -c -i "COUNT=0; while true; do echo Keep the dance floor beat going; ((COUNT++)); sleep 1; echo \"Count is: \${COUNT}\"; done;" ``` In another terminal: ``` docker exec -it container1 tail -f /proc/1/fd/1 ```

[licorna]

Sorry @JacobWuzHere. I don't have Docker experience, I'm not sure if Docker even uses the proc filesystem :(

[eddyP23]

Best discovery this year! This feature rocks!

[Peter Moore]

Wow this is so interesting. what happens for me is that doing a tail on a stdout of one process in python affects the input of another processes in python. for example keystrokes in a debug session of python are getting skipped. Very interesting.

[Tejas Sarade]

This will work if process has already allocated tty. You can check if tty is allocated or not using ps' command. If it shows ?` in TTY column then no tty allocated, then there is nothing to check in /proc/PID/fd.

[butla]

@TejasSarade hm... my processes (running from bare Konsole or Tmux on Kubuntu 18.04) report that they have a TTY, but I can't tail or less the file descriptors anyway. At least, there seems to be nothing in them.

[akki]

For me, tail worked after I changed my current user to the owner of the process with su proc_owner. Even as root I was denied access.

[izy]

thanks it works, but output is truncated, e.g. for ping: write(1, "64 bytes from 1.0.0.1: icmp_seq="..., 56) = 56

[weshouman]

if reptyr $PID did not work try sudo reptyr -T $PID based on this issue

[schetefan24]

@izy you can specify a -sLENGTH flag to set a new buffersize (default 32). for more details, check unix.stackexchange.com/a/58601

[Fusion]

What if file descriptors point to a socket? # ls -la /proc/24510/fd/1 lrwx------ 1 root root 64 Oct 31 08:34 /proc/24510/fd/1 -> socket:[444026]