2

Here is my general question: How do you log into a remote server, kick off a continuously running process, redirect the standard output of that process to a file on the local machine, and have all of this run in the background (on the local machine)?

More specifically, I'm trying to pipe tshark output from a remote Raspberry Pi to my local machine (actually another remote machine with Windows running Cygwin - long story) and write it to a log file. I started out by running the command without output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch"

This seems to working as I would expect it to; I get a stream of data in the terminal. Next I tried to add output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out

This also seems to work as expected; I see standard error written to the terminal and after I terminate the process and check the output file (/var/tshark.out) I see the standard output from tshark. Next I try to run this in the background on my machine:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out &

Unfortunately this doesn't have the desired effect. When I check the output file it's empty, and when I check the job status (by running the "jobs" command) I see that it's stopped. Here is the output from jobs (I've reformatted it slightly for readability):

[1]+  Stopped   ssh pi@remotehost
                "sudo tshark
                -i wlan1mon
                -I -l -f broadcast
                -Y wlan.fc.subtype==4
                -T fields
                -e wlan.sa
                -e frame.time_epoch"
                > /var/tshark.out &

This led me down the path of trying various permutations of background-ing and nohup-ing both the remote and local process, but to no avail.

  • To simplify things, I would make a script on the remote host machine with tshark and all the options so it is easier to call. I would also ssh root@remotemachine and skip the sudo. – MERM Jun 4 '17 at 17:42
  • Have you tried $(ssh root@remotemachine tshark_script.sh) > /var/tshark.out & – MERM Jun 4 '17 at 17:43
4

Use the -f switch to the ssh, which will send the command to the background after the authentication and other potentially interactive steps.

  • 1
    Thanks; I'll try that. Could you explain why what I was doing didn't work? – igal Jun 4 '17 at 18:40
  • I experienced that some time ago too, but I am not sure about the cause from back of my head. Running it with strace can give you the idea. – Jakuje Jun 4 '17 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.