I'm trying to capture write to stdout (or stderr), but apparently the actual data is related to the exit event. I wrote a simple C program that writes to stdout and stderr.

#include <stdio.h>
    printf("Standard output\n");
    fprintf(stderr, "Standard error\n");
    return 0;

I compile it with 'gcc example.c -o example'. If I now start sysdig with

sudo sysdig --unbuffered -X syscall.type=write and proc.name=example

and run ./example, I get to following output

91612 20:12:09.273696708 2 example (12909) > write fd=1(<f>/dev/pts/1) size=16 
91613 20:12:09.273726879 2 example (12909) > write fd=2(<f>/dev/pts/1) size=15 

No data is shown, and only the enter event (>) is shown. Also the stdout chisel doesn't produce any output

sudo sysdig --unbuffered -X -c stdout syscall.type=write and proc.name=example

Is the problem in my example program or where? If I run sysdig without any parameters, it sometimes shows also the exit event for some processes.

I'm running Ubuntu 20.04 distribution, and the version of sysdig is 0.26.4. For more information on sysdig, see GitHub repository of sysdig .

  • I think you need to provide some information on sysdig, i.e., what Linux distro are you using? On Debian 10, if I type "man -k sysdig" it returns "sysdig: nothing appropriate." May 10, 2021 at 20:40
  • @CinaedSimson I added information about my distribution and sysdig. The man command does not give any results for programs that are not installed. At least on Ubuntu I can get information about the package with 'apt show sysdig', even if it is not installed. Try the Debian equivalent of it. May 11, 2021 at 5:54
  • Thanks - I'm aware of the command. I'm running Debian 10. Sorry, I don't know anything about it. May 11, 2021 at 7:19

1 Answer 1


Apparently there was some problem with the version that came with Ubuntu. I downloaded the latest version (0.27.1) from sysdig website, and now the result is correct:

65099 19:55:54.695520567 7 example (10805) > write fd=1(<f>/dev/pts/0) size=16 
65102 19:55:54.695526434 7 example (10805) < write res=16 data=
    0x0000: 5374 616e 6461 7264 206f 7574 7075 740a  Standard output.
65103 19:55:54.695528110 7 example (10805) > write fd=2(<f>/dev/pts/0) size=15 
65104 19:55:54.695529507 7 example (10805) < write res=15 data=
    0x0000: 5374 616e 6461 7264 2065 7272 6f72 0a  Standard error.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .