67 lines
1.6 KiB
Groff
67 lines
1.6 KiB
Groff
.TH ttysnoop 8 "2016-02-08" "USER COMMANDS"
|
|
.SH NAME
|
|
ttysnoop \- Watch output from a tty or pts device. Uses Linux eBPF/bcc.
|
|
.SH SYNOPSIS
|
|
.B ttysnoop [\-h] [\-C] device
|
|
.SH DESCRIPTION
|
|
ttysnoop watches a tty or pts device, and prints the same output that is
|
|
appearing on that device. It can be used to mirror the output from a shell
|
|
session, or the system console.
|
|
|
|
This works by use of kernel dynamic tracing of the tty_write() function.
|
|
This tool will need updating in case that kernel function changes in a future
|
|
kernel version.
|
|
|
|
Since this uses BPF, only the root user can use this tool.
|
|
.SH REQUIREMENTS
|
|
CONFIG_BPF and bcc.
|
|
.SH OPTIONS
|
|
.TP
|
|
\-C
|
|
Don't clear the screen.
|
|
.TP
|
|
\-s SIZE , \-\-datasize SIZE
|
|
Size of the transmitting buffer (default 256).
|
|
.TP
|
|
\-c COUNT, \-\-datacount COUNT
|
|
Number of times ttysnop checks for SIZE bytes of data (default 16).
|
|
.TP
|
|
device
|
|
Either a path to a tty device (eg, /dev/tty0) or a pts number (eg, the "3"
|
|
from /dev/pts/3).
|
|
.SH EXAMPLES
|
|
.TP
|
|
Snoop output from /dev/pts/2
|
|
#
|
|
.B ttysnoop /dev/pts/2
|
|
.TP
|
|
Snoop output from /dev/pts/2 (shortcut)
|
|
#
|
|
.B ttysnoop 2
|
|
.TP
|
|
Snoop output from the system console
|
|
#
|
|
.B ttysnoop /dev/console
|
|
.TP
|
|
Snoop output from /dev/tty0
|
|
#
|
|
.B ttysnoop /dev/tty0
|
|
.SH OVERHEAD
|
|
As the rate of tty_write() is expected to be very low (<100/s), the overhead
|
|
of this tool is expected to be negligible.
|
|
.SH SOURCE
|
|
This is from bcc.
|
|
.IP
|
|
https://github.com/iovisor/bcc
|
|
.PP
|
|
Also look in the bcc distribution for a companion _examples.txt file containing
|
|
example usage, output, and commentary for this tool.
|
|
.SH OS
|
|
Linux
|
|
.SH STABILITY
|
|
Unstable - in development.
|
|
.SH AUTHOR
|
|
Brendan Gregg
|
|
.SH SEE ALSO
|
|
opensnoop(1)
|