bcc-ttysnoop(8)

1ttysnoop(8)                 System Manager's Manual                ttysnoop(8)
2
3
4

NAME

6       ttysnoop - Watch output from a tty or pts device. Uses Linux eBPF/bcc.
7

SYNOPSIS

9       ttysnoop [-h] [-C] device
10

DESCRIPTION

12       ttysnoop  watches  a tty or pts device, and prints the same output that
13       is appearing on that device. It can be used to mirror the output from a
14       shell session, or the system console.
15
16       This  works  by  use of kernel dynamic tracing of the tty_write() func‐
17       tion.  This tool will  need  updating  in  case  that  kernel  function
18       changes in a future kernel version.
19
20       Since this uses BPF, only the root user can use this tool.
21

REQUIREMENTS

23       CONFIG_BPF and bcc.
24

OPTIONS

26       -C     Don't clear the screen.
27
28       device Either  a  path  to a tty device (eg, /dev/tty0) or a pts number
29              (eg, the "3" from /dev/pts/3).
30

EXAMPLES

32       Snoop output from /dev/pts/2
33              # ttysnoop /dev/pts/2
34
35       Snoop output from /dev/pts/2 (shortcut)
36              # ttysnoop 2
37
38       Snoop output from the system console
39              # ttysnoop /dev/console
40
41       Snoop output from /dev/tty0
42              # ttysnoop /dev/tty0
43

OVERHEAD

45       As the rate of tty_write() is expected to be  very  low  (<100/s),  the
46       overhead of this tool is expected to be negligible.
47

SOURCE

49       This is from bcc.
50
51              https://github.com/iovisor/bcc
52
53       Also  look  in  the bcc distribution for a companion _examples.txt file
54       containing example usage, output, and commentary for this tool.
55

OS

57       Linux
58

STABILITY

60       Unstable - in development.
61

AUTHOR

63       Brendan Gregg
64