Skip to content

Instantly share code, notes, and snippets.

@zipizap
Last active December 25, 2015 06:59
Show Gist options
  • Save zipizap/6935880 to your computer and use it in GitHub Desktop.
Save zipizap/6935880 to your computer and use it in GitHub Desktop.
# I want to *snoop* the stdout(1) and stderr(2) of the process named 'ntfsresize'
# (run as root)
strace -p $(pidof "ntfsresize") -e trace=write 2>&1 | grep 'write(1'
# Explanation:
#
# -p $(pidof "ntfsresize")
# Apply strace to the process named "ntfsresize"
# If you want to trace a bash script, use instead $(pidof -x "script-name.sh")
#
# -e trace=write
# Trace only the WRITE system calls
# Keep in mind that
# write(1,... will write to STDOUT
# write(2,... will write to STDERR
# write(3-and-up,... will write to other filedescriptors (files, sockets, or whatever the program opens)
# Doing "-e trace=write" is the same as "-e write"
#
# 2>&1 | grep 'write(1'
# The strace program shows sends its output to stderr, we then join its stderr into stdout and finally pipe it
# to the grep. We need to join stderr to stdout because pipes normally only pass stdout, not stderr.
# The grep grabs the straced write calls directed to stdout "write(1,..."
#
@zipizap
Copy link
Author

zipizap commented Dec 13, 2013

C Evans comment gave it a big improvement :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment