How do I get the PIDs of all the processes which are dumping output to stdout.

  • Your request is unclear. do you mean processes that are currently and actively sending data to some tty ? processes that are currently feeding some pipe / socket / file via their stdout ? Or any process that is just capable of doing so occasionally ?
    – MC68020
    Jun 24 at 10:47
  • I mean processes that are currently and actively sending data to stdout. Jun 24 at 10:50
  • So wherever the ouput goes (tty / input to some pipe / socket / file…) ?
    – MC68020
    Jun 24 at 10:52

2 Answers 2


All processes are given a standard output and are liable to write to it. If you want to find those processes whose standard output is the current terminal, on Linux you can use

find -L /proc/[0-9]*/fd/1 -prune -samefile /dev/stdout

The similar

find -L /proc/[0-9]*/fd/2 -prune -samefile /dev/stdout

will identify processes whose standard error is the current terminal. You can combine both with

find -L /proc/[0-9]*/fd/[12] -prune -samefile /dev/stdout

That doesn’t tell you whether they’re actually writing to the current terminal however.

To actually log all PIDs writing to their standard out, you can use bpftrace, if your kernel supports eBPF (which many distribution kernels do now; see the bpftrace kernel requirements for details):

sudo bpftrace -e 'kprobe:ksys_write /comm != "bpftrace" && arg0 == 1/ { printf("PID %d writing to stdout\n", pid); }'

This will log every write to standard out (file descriptor 1), except those coming from bpftrace itself (since this bpftrace program writes to standard out, it ends up just logging itself).

  • bpftrace ! +1 ! Splendid Stephen! I just want that ! Ha ! It seems I should first enable CONFIG_BPF , CONFIG_BPF_SYSCALL, CONFIG_BPFILTER and CONFIG_BPF_JIT in my kernel .config. Probably worth mentioning. Nevermind ! Many thanks !
    – MC68020
    Jun 24 at 16:49
  • Or find -L /proc/[1-9]*/fd/1 -prune -samefile /dev/stdout to catch other paths to the terminal. Or print -rC1 /proc/<->/fd/1(e['[[ $REPLY -ef $TTY ]]']:h:h:t) for the pids only in zsh (or ps -fp instead of print -rC1 to get some information about the processes) Jun 24 at 20:07
  • @MC68020 fair enough ;-). The same can be done with ftrace, I’ve been meaning to check out Steven Rostedt’s latest improvements to that. Jun 24 at 21:16
  • -prune so find doesn't descend into directories for those processes that have a directory opened on fd 1. Now -samefile would account for hardlinks of $(tty) but not for copies, we'd need a -samedevice. See also lsof -ad1 "$(tty)" (working like -samefile AFAICT). Jun 25 at 9:53
  • Would also not catch processes whose stdout is redirected to /dev/tty in the session where the controlling tty is $(tty)... Jun 25 at 10:31

Unlike others, I believe your question does not make that much sense, or rather I suspect you made a mistake?

Stdout, very specifically, is just a file descriptor FD1.

Each process that has FD1 open, ie /proc/self/fd/1 on linux, is potentially writing to stdout.

Is this really what you wanted to know?

If yes, then bftrace example of @Stephen Kitt is only way to get processes actually writing to FD1, but only those that write to it at the moment tracer filter runs.

If you are okay even with all the possible writers sudo lsof | egrep ' 1u| 1w' should do too (and returns much bigger set).

But if you are asking, what is writing into "current" tty (maybe the one you are seeing in terminal), that is completely different matter, because even if process closed FD1, it can have your tty open on any other FD, to be wild, even on FD777901700.

In that case you must identify tty in question and filter for that sudo lsof | grep 'CHR' | grep '/dev/yourtty'.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.