I have a deamon running (that I did not create) and I need to be able to read its logs. Unfortunately, it does not have a log file. Is there a way to pipe the daemon's output into a file, and have it continuously update so I can run tail -f on it?

  • Are you sure it's producing output? A daemon doesn't usually write to standard output, so there wouldn't be anything to pipe.
    – Barmar
    Mar 8 '16 at 20:53
  • If it does produce output, use daemon > filename.log
    – Barmar
    Mar 8 '16 at 20:53
  • Although - when I do daemon > filename, I immediately get output to my terminal, but when I open the file, nothing is there. Should this be happening, or...?
    – jackwise
    Mar 8 '16 at 21:09
  • It may be writing to stderr, so you should also redirect that daemon > filename 2>&1.
    – Barmar
    Mar 8 '16 at 21:10
  • That works, but will this cause output to be continuously written ie so I can run a tail -f on it?
    – jackwise
    Mar 8 '16 at 21:14

The files under /proc/<PID>/fd/<FD> are symlinks to the their corresponding file objects. So, if a program with PID 45920 is reading from a file at /home/hypnotoad/all_glory_to_the_hypnotoad, and that file is mapped to file descriptor 3, then running ls -l /proc/45920/fd/3 will yield:

lrwx------. 1 root root 64 Mar 15 18:33 /proc/45920/fd/3 -> /home/hypnotoad/all_glory_to_the_hypnotoad

So, if you have the PID of the daemon process, you can see what file descriptors it has open (and what files those descriptors map to) using ls -l /proc/<PID>/fd/ and you can find out a bit more about those descriptors using find /proc/<PID>/fdinfo/ | xargs -n 1 cat.

Of course, it'll have file descriptors 0 (stdin), 1 (stdout), and 2 (stderr) open, and it may have file descriptor 255 open (for a tty). If fdinfo indicates a pos value other than zero, that means the file descriptor is almost certainly in use (because it gives the position of the pointer into the file / stream / what-have-you).

If it really isn't logging to any files on-disk, then this answer on redirecting output from a running process may be of use to you. Worth noting that it's possible to have gdb execute commands from a file, rather than interactively, so that you can minimize daemon interruption time.

Also worth noting in passing that the process you use to run gdb will be subject to the usual restrictions surrounding the ptrace syscall, so you'll want to make sure your process is either running as root, or running in some other context such that it can attach to the daemon.

Alternatively, of course, if you don't mind having the daemon down for a little while, you could run it inside a docker container and capture the output that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.