Just for fun:
Is there a way to monitor/capture/dump whatever is being written to
On Debian, or FreeBSD, if it matters, any other OS specific solutions are also welcome.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
/dev/null a named pipe is probably the easiest way. Be warned that some programs (
sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from
/dev/null, expecting it to return
# Remove special file, create FIFO and read from it rm /dev/null && mkfifo -m622 /dev/null && tail -f /dev/null # Remove FIFO, recreate special file rm /dev/null && mknod -m666 /dev/null c 1 3
This should work under all Linux distributions, and all major BSDs.
I once found out the hard way that /dev/null doesn't have to be a special dev file. A long time ago the /dev/null on an Ultrix system at work got deleted, so the next time a program redirected to /dev/null, it ended up being a normal file full of the output from that program. (I think it was 'no such file or directory', which meant when we were trying to figure out what was going on, we'd do
cat /dev/null and be told
no such file or directory which confused the hell out of us.)
So my suggestion would to be replace it with a named pipe, and then attach a program to the pipe that would read it and monitor it.
I think of an idea where /dev/null can be a symlink to a file descriptor but with add code mechanism to determine the operation is read or write and then if it is read, it should actually read from /dev/actualnull created seperately with mknod and if it is write then make a note of the invoking program and attempt to log/count for analyzing the programs that use /dev/null for writing. This is going to cost a lot in terms of performance, I suppose though. I guess it is not practical since most shell programs or code use redirection anyway. May be inotify could be used to monitor the usage of /dev/null ? or rewrite the kernel code that handles 1:3 devices, again compile and reinstall, experimentable.