I have a command running for a long time, which I don't want to disturb. However, I would like to keep check on the process (most of the time remotely). I am constantly monitoring the process via commands like top, iotop, stat etc. The process is a terminal based process which wasn't started via screen or tmux or similar. So the only way to check the output is using physical access.

I know that /proc contains lot of info about the process. So I was wondering if it also can display the output (or even just the last batch of output -- char/word/line). I searched in /proc/<pid>/fd, but couldn't find anything useful.

Below is the output of ls -l /proc/26745/fd/*

lrwx------ 1 user user 64 Oct 28 13:19 /proc/26745/fd/0 -> /dev/pts/17
lrwx------ 1 user user 64 Oct 28 13:19 /proc/26745/fd/1 -> /dev/pts/17
lrwx------ 1 user user 64 Sep 27 22:27 /proc/26745/fd/2 -> /dev/pts/17

Any pointers?


I would use strace for that:

strace -qfp PID -e trace=write -e write=1,2

That will trace all write(2) system calls of PID and its child processes, and hexdump the data written to file descriptors 1 and 2.

Of course, that won't let you see what the process has already written to the tty, but will start monitoring all writes from a point on.

Also, strace is not amenable to change its output format -- you should explore using gdb(1) or write a small program using ptrace(2) if you need more flexibility.

| improve this answer | |
  • As you have rightly pointed out, this command gives all the output (only) from now on. To some extent, this serves my partial need. Thanks for introducing me to strace! – Mike V.D.C. Oct 28 '18 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.