1ttysnoop(8) System Manager's Manual ttysnoop(8)
2
3
4
6 ttysnoop - Watch output from a tty or pts device. Uses Linux eBPF/bcc.
7
9 ttysnoop [-h] [-C] device
10
12 ttysnoop watches a tty or pts device, and prints the same output that
13 is appearing on that device. It can be used to mirror the output from a
14 shell session, or the system console.
15
16 This works by use of kernel dynamic tracing of the tty_write() func‐
17 tion. This tool will need updating in case that kernel function
18 changes in a future kernel version.
19
20 Since this uses BPF, only the root user can use this tool.
21
23 CONFIG_BPF and bcc.
24
26 -C Don't clear the screen.
27
28 -s SIZE , --datasize SIZE
29 Size of the transmitting buffer (default 256).
30
31 -c COUNT, --datacount COUNT
32 Number of times ttysnop checks for SIZE bytes of data (default
33 16).
34
35 device Either a path to a tty device (eg, /dev/tty0) or a pts number
36 (eg, the "3" from /dev/pts/3).
37
39 Snoop output from /dev/pts/2
40 # ttysnoop /dev/pts/2
41
42 Snoop output from /dev/pts/2 (shortcut)
43 # ttysnoop 2
44
45 Snoop output from the system console
46 # ttysnoop /dev/console
47
48 Snoop output from /dev/tty0
49 # ttysnoop /dev/tty0
50
52 As the rate of tty_write() is expected to be very low (<100/s), the
53 overhead of this tool is expected to be negligible.
54
56 This is from bcc.
57
58 https://github.com/iovisor/bcc
59
60 Also look in the bcc distribution for a companion _examples.txt file
61 containing example usage, output, and commentary for this tool.
62
64 Linux
65
67 Unstable - in development.
68
70 Brendan Gregg
71
73 opensnoop(1)
74
75
76
77USER COMMANDS 2016-02-08 ttysnoop(8)