We have a requirement to troubleshoot an existing system running Busybox, we have Telnet access. It would be helpful to log the system's console output (ideally the last n lines of it) to a file for debugging.

There's plenty of examples on redirecting the stdout/stderr of a command to a file at the point of invocation, but I can't find anything conclusive on capturing output from a running process or processes.

It seems like we should perhaps be able to capture/redirect from /proc/<PID>/fd/1 but searching suggests this is not possible, and I haven't managed to find an incantation to make it work.

Being a small embedded system we can't install more packages, so if it can't be done with basic command-line kung-fu we'll have to go back to the drawing board.

Any suggestions?

  • 1
    From busybox.net/downloads/BusyBox.html it appears that syslogd writes to /var/log/messages (default). Would that be helpful? Of course that would assume syslogd is installed. – KM. Feb 10 '15 at 19:15
  • Use script on the machine you telnet from. – roaima Feb 10 '15 at 19:52
  • One way or another you need to call ptrace. You will need nonstandard tools, but it can be a tiny C program, or GDB. – Gilles 'SO- stop being evil' Feb 10 '15 at 22:55
  • I realise this is a possible duplicate question, but the accepted answer to the duplicate is pretty much a dead "no", with very little else by way of exploration of options or other approaches. Seems a bit defeatist to me. – John U Feb 11 '15 at 13:05

You can. First SIGSTOP the process you are interested in, then change /proc/[pid]/fd/x to whatever you need (you can symbolic link it to a tty or a file), and then SIGCONT the process. now it will write its stdout and stderr to whatever tty or file you specified.

| improve this answer | |
  • You can't modify /proc/<pid>/fd/1, at least not directly. – Gilles 'SO- stop being evil' Feb 10 '15 at 22:52
  • @Giles. yes you can, you can use the "p dup2" command in gdb to manipulate file descriptors on a running process. See stackoverflow.com/questions/593724/… – Michael Martinez Feb 11 '15 at 1:06
  • That's completely different. You aren't modifying the file under /proc, you're causing the process to open a different file, which is of course reflected in the /proc interface. – Gilles 'SO- stop being evil' Feb 11 '15 at 7:13
  • @Gilles: "completely different?" Really? Not. you're splitting hairs at this point. – Michael Martinez Feb 11 '15 at 19:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.