0

Some process sends output of my console over stdin to remote print server. If there is cups printer configured, it prints it. So I need to keep cups disabled. I suspect something is running lp or lpr. It usually starts some time after I compile big project.

Is there a way howto find after what process run it?

The only thing I know is to see the job in the cups web history http://remote-print-server.example.com:631/:

ID        Name       User Size  Pages   State
foo-11612 (stdin)    user 1634k Unknown completed at Tue 06 Feb 2018 12:49:30 UTC

UPDATE: It's about printing through stdin. I don't have any local logs except journalctl, as the printer is not connected locally :-(. The text above is copied from cups web log.

  • It is normally messages from the kernel ring that appear on the console. This can be stopped by running "dmesg -D" – Raman Sailopal Feb 6 '18 at 15:21
  • is this in the console for the system, or any random terminal you've opened? – thrig Feb 6 '18 at 15:21
  • Sorry, I wasn't clear, but as you can see from tags, it's really about printing on printer, not echo (bash) or printf (C). It's about cups, lp and lpr). – pevik Feb 7 '18 at 7:36
0

Assuming that your console is /dev/ttyS0, you could search /proc/<pid>/fd for file descriptors with that device:

$ sudo ls -l /proc/[0-9]*/fd

Then search that output for either 1 -> /dev/ttyS0 (standard output) or 2 -> /dev/ttyS0 (standard error), and you'll be able to find the IDs of any processes that are using the console for stdout or stderr.

Alternatively, if you have lsof, you can use that:

$ sudo lsof /dev/ttyS0
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
agetty  3955 root    0u   CHR   4,64      0t0 4046 /dev/ttyS0
agetty  3955 root    1u   CHR   4,64      0t0 4046 /dev/ttyS0
agetty  3955 root    2u   CHR   4,64      0t0 4046 /dev/ttyS0
  • Please, see update, the question is about real printing, cups, lp and lpr. – pevik Feb 7 '18 at 7:39
0

On Linux, assuming that this is writing to your shell's stdout, you should be able to find potential processes using lsof to check who's connected:

% lsof -t "/proc/$$/fd/1"
23717
26269

You can then find out who's is doing writes using a tracing program like strace, perf trace, or by using eBPF:

% strace -s 1000 -ewrite -p "$(lsof -t "/proc/$$/fd/1" | paste -sd,)"
[pid 26680] write(1, "foo\n", 4)        = 4
[pid 26680] write(1, "bar\n", 4)        = 4
[pid 26680] write(1, "baz\n", 4)        = 4
  • Please, see update, the question is about real printing, cups, lp and lpr. – pevik Feb 7 '18 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.