How to find out what process is printing pages on remote printer through STDIN?

Question

Some process sends output of my console over stdin to remote print server. If there is cups printer configured, it prints it. So I need to keep cups disabled. I suspect something is running lp or lpr. It usually starts some time after I compile big project.

Is there a way howto find after what process run it?

The only thing I know is to see the job in the cups web history http://remote-print-server.example.com:631/:

ID        Name       User Size  Pages   State
foo-11612 (stdin)    user 1634k Unknown completed at Tue 06 Feb 2018 12:49:30 UTC

UPDATE: It's about printing through stdin. I don't have any local logs except journalctl, as the printer is not connected locally :-(. The text above is copied from cups web log.

Answer 1

Assuming that your console is /dev/ttyS0, you could search /proc/<pid>/fd for file descriptors with that device:

$ sudo ls -l /proc/[0-9]*/fd

Then search that output for either 1 -> /dev/ttyS0 (standard output) or 2 -> /dev/ttyS0 (standard error), and you'll be able to find the IDs of any processes that are using the console for stdout or stderr.

Alternatively, if you have lsof, you can use that:

$ sudo lsof /dev/ttyS0
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
agetty  3955 root    0u   CHR   4,64      0t0 4046 /dev/ttyS0
agetty  3955 root    1u   CHR   4,64      0t0 4046 /dev/ttyS0
agetty  3955 root    2u   CHR   4,64      0t0 4046 /dev/ttyS0

Answer 2

On Linux, assuming that this is writing to your shell's stdout, you should be able to find potential processes using lsof to check who's connected:

% lsof -t "/proc/$$/fd/1"
23717
26269

You can then find out who's is doing writes using a tracing program like strace, perf trace, or by using eBPF:

% strace -s 1000 -ewrite -p "$(lsof -t "/proc/$$/fd/1" | paste -sd,)"
[pid 26680] write(1, "foo\n", 4)        = 4
[pid 26680] write(1, "bar\n", 4)        = 4
[pid 26680] write(1, "baz\n", 4)        = 4