CODEWITHSUNDEEP
linuxlinux-kernel
Rouki
Rouki

Reputation: 2345

See stdin/stdout/stderr of a running process - Linux kernel

Is there a way to redirect/see the stdin/stdout/stderr of a given running process(By PID) in a simple way ?

I tried the following (Assume that 'pid' contains a running user process):

int foo(const void* data, struct file* file, unsigned fd)
{
    printf("Fd = %x\n", fd);
    return 0;
}
struct task_struct* task = pid_task(find_vpid(pid), PIDTYPE_PID);
struct files_struct* fs = task->files;
iterate_fd(fs, 0, foo, NULL);

I get 3 calls to foo (This process probably has 3 opened files, makes sense) but I can't really read from them (from the file pointers).

It prints:

0
1
2

Is it possible to achieve what I asked for in a fairly simple way ?

thanks

Upvotes: 4

Views: 6356

Answers (2)

a.m.
a.m.

Reputation: 2161

You can achieve it via gdb

Check the file handles process() has open : 

$ ls -l /proc/6760/fd
total 3
lrwx—— 1 rjc rjc 64 Feb 27 15:32 0 -> /dev/pts/5
l-wx—— 1 rjc rjc 64 Feb 27 15:32 1 -> /tmp/foo1
lrwx—— 1 rjc rjc 64 Feb 27 15:32 2 -> /dev/pts/5

Now run GDB:

$ gdb -p 6760 /bin/cat
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
[lots more license stuff snipped]
Attaching to program: /bin/cat, process 6760
[snip other stuff that’s not interesting now]

(gdb) p close(1)
$1 = 0

Provide a new file name to get output - process_log

(gdb) p creat(“/tmp/process_log″, 0600)
$2 = 1
(gdb) q
The program is running. Quit anyway (and detach it)? (y or n) y
Detaching from program: /bin/cat, process 6760

After that verify the result as:

ls -l /proc/6760/fd/
total 3
lrwx—— 1 rjc rjc 64 2008-02-27 15:32 0 -> /dev/pts/5
l-wx—— 1 rjc rjc 64 2008-02-27 15:32 1 -> /tmp/process_log <====
lrwx—— 1 rjc rjc 64 2008-02-27 15:32 2 -> /dev/pts/5

In the similar way, you can redirect stdin, stderr too.

Upvotes: 2

BraveNewCurrency
BraveNewCurrency

Reputation: 13065

First, if you can change your architecure, you run it under something like screen, tmux, nohup, or dtach which will make your life easier.

But if you have a running program, you can use strace to monitor it's kernel calls, including all reads/writes. You will need to limit what it sees (try -e), and maybe filter the output for just the first 3 FDs. Also add -s because the default is to limit the size of data recorded. Something like: strace -p <PID> -e read,write -s 1000000

Upvotes: 3

Related Questions