4

When I look at ls -la /proc/<pid>/fd, I see that stdout is a link to a pipe:

lr-x------    1 admin    root            64 Jul  9 21:22 1 -> pipe:[1155]

What does it mean? Who is listening to this pipe? How can I watch this process's stdout?

1
  • "How can I watch this process stdout?" Is it your aim to "eavesdrop" on it? Or just to find out where the stream is going?
    – fra-san
    Jul 9, 2020 at 20:07

2 Answers 2

3

Borrowing from this answer, that means that the standard output of the process whose PID is <pid> has been redirected to a pipe (a kind of FIFO with no representation in the filesystem hierarchy). 1155 is the pipe's inode number (on Linux you can look for /proc/[pid]/fd/ in the proc(5) man page for more on this).

An example:

$ cat - | less
$ pgrep cat
187873
$ ls -l /proc/187873/fd/1
l-wx------ 1 user user 64 Jul  9 22:23 /proc/187873/fd/1 -> 'pipe:[1624839]'

The standard output of cat is being redirected to the writing end of the pipe whose inode is 1624839, while the standard input of less is being redirected from its reading end.

If we knew nothing about the process connected to the reading end of the pipe, we could search for all the processes that have it open (but note that we might not have the needed privileges to see them):

$ fuser -v /proc/187873/fd/1
                     USER   PID ACCESS COMMAND
/proc/187873/fd/1:   user  187873 F.... cat
                     user  187874 f.... less

And then confirm that less has it open (for reading):

$ ls -l /proc/187874/fd/0
lr-x------ 1 user user 64 Jul  9 22:28 /proc/187874/fd/0 -> 'pipe:[1624839]'
0

You find the other end of the pipeline (if the process is still alive) with

ls -l /proc/[1-9]*/fd 2>/dev/null | grep -B 3 -F 'pipe:[1155]'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .