How can I read the standard output of an already-running process?

(devblogs.microsoft.com)

59 points by ibobev7 days ago

6 comments

theamk1 day ago
Raymond's posts are always fun to read, but it sometimes he focuses more on the "proper" methods, and does not even acknowledge that there are hacky workarounds.Like for this case - sure, you cannot redefine the standard output handle, but that's not what the customer asked for, is it? They said "read" and I can see a whole bunch of ways to do so - ReadConsoleOutput + heuristic for scrolling, code inject into console host, attach debugger, set up detour on logging function, custom kernel module...To be fair, as a MS support person, it's the exactly right thing to do. You don't want the person to start writing custom kernel module when they should redirect stdout on process start instead. But as a random internet reader, I'd love to read all about hacky ways to achieve the same!
- bigstrat20031 day ago
 > Raymond's posts are always fun to read, but it sometimes he focuses more on the "proper" methods, and does not even acknowledge that there are hacky workarounds.Nor should he, IMO. Hacky workarounds are almost always a terrible idea that will bite you in the ass someday.
 - integralid1 day ago
 As a hacker, I'm sorry, reverse engineer hacky workarounds is what I do. When I want to read stdout of a malware process I'm not going to ask a developer nicely, in going to grab my trusty debugger or API monitor.But yeah, for production quality software hacks are the very last resort. It's still fun and enlightening to know them, though.
 - yndoendo1 day ago
 Had a WPF touch interface application that would latch on when a person; presses, holds, and slides their finger off the screen. Highly unacceptable when it controls a machine that could remove a limb.Only fix was to write a custom touch screen event handler that overrides the built in one by Microsoft.I would love to have a _proper method_ and pull out my _hacky_ method that prevents the removal of a person's limb.
 - AmazingTurtle1 day ago
 Hacky workarounds aren't rare exceptions; they're the plumbing of modern software. Anti-cheat and antivirus tools only work because they lean on strange kernel behaviors. Cloud platforms ship fixes that rely on undefined-but-stable quirks. Hardware drivers poke at the system in ways no official API ever planned for.Yeah, they're ugly, but in practice the choice isn't between clean and hacky; it's between shipping and not shipping. Real-world software runs on constraints, not ideals.
 - tetha1 day ago
 On the other hand, everything you ship outside of a clearly established golden path is a maintenance burden that piles and piles and piles. And these maintenance burdens tend to gradually slow the org down until they cause rather catastrophic failures, usually out of security or hardware (read: fire) incidents. Or HR reasons because people figure there are better places to fight fires.
ranger_danger1 day ago
I know this article is for Windows, but if you're wondering if there's a way to do this on Linux, there is:<a href="https://strace.io/" rel="nofollow">https://strace.io/</a><a href="https://github.com/nelhage/reptyr" rel="nofollow">https://github.com/nelhage/reptyr</a><a href="https://github.com/crigler/dtach" rel="nofollow">https://github.com/crigler/dtach</a><a href="https://github.com/jerome-pouiller/reredirect" rel="nofollow">https://github.com/jerome-pouiller/reredirect</a><a href="https://github.com/pasky/retty" rel="nofollow">https://github.com/pasky/retty</a>
- zaius1 day ago
 Here's my method using GDB from many years ago: <a href="https://gist.github.com/zaius/782263" rel="nofollow">https://gist.github.com/zaius/782263</a>
- maxjohan1 day ago
 Is there a way to read from present tty?In practice: I boot into tty and manually start the graphical session (Wayland/Sway). I occasionally get (non-Sway) warnings when I return to tty (eg close the window manager). But the output is always scuffed, so I can't read the whole log. The lines get printed on top of each other or something.Is there a way to read everything from tty, from within the tty?Neither of the methods below work, because the warnings/errors aren't produced by Sway itself, but some other OS module/component.$ sway |& tee /tmp/sway.log$ tail -f /tmp/sway.log
 - toast01 day ago
 If things are printed on top of each other, try script?<a href="https://man.freebsd.org/cgi/man.cgi?query=script&apropos=0&sektion=1&manpath=FreeBSD+15.0-RELEASE+and+Ports&arch=default&format=html" rel="nofollow">https://man.freebsd.org/cgi/man.cgi?query=script&apropos=0&s...</a>But, if you're getting console debugs from the kernel, that wouldn't be captured either... Otoh, debug output from the kernel should also go into logs or dmesg or something?You'll capture everything and maybe be able to figure it out from there?
 - maxjohan1 day ago
 Thanks for the input! Sounds promising. I've to admit, 'script' doesn't say anything to me yet. I've to look into it.About the logs, yes, I have yet to dive into that. The _everything_ part makes it very tedious, so I had hoped for another solution :)
 - ranger_danger1 day ago
 If script doesn't work, you could maybe try starting everything from within GNU screen or tmux with logging turned on?
 maxjohan19 hours ago
 These methods would fetch Sway error messages, but nothing else, no? This is not about Sway messages.
 - toast01 day ago
 oh, one more thing... your pipeline is only capturing stdout; errors often get logged to stderr ... script (or screen/tmux logging) will capture both though.
 maxjohan19 hours ago
 Thanks for the notice! Embarrassing rookie mistake ;)
 - yjftsjthsd-h1 day ago
 It might be useful to try and figure out what's logging the messages.However, if it was me, I'd strongly consider just starting from your shell in the tty, then running tmux, then starting sway, then attaching to tmux from a terminal emulator.
 - maxjohan1 day ago
 Thanks for your reply! I've thought about that as well. Haven't tried it though. Two thoughts about it:1. Running graphical from within tmux feels unsafe (?). Introducing another layer can't be the way to go. BUT this comes from a position of limited knowledge, so I might stand corrected on this one. Also, doing it once for debugging won't do any harm.2. I'm pretty sure the errors are not printed by Sway itself, but some other OS module. Errors that Sway cause for other modules won't be included in the Sway log. So the problem remains, no?
- baobun1 day ago
 This prompted me to ask the crowd about a similar use-case of editing your command line as it's already running your command<a href="https://news.ycombinator.com/item?id=46234678">https://news.ycombinator.com/item?id=46234678</a>
- mzs1 day ago
 vxworks 6.x:(one login session, say over serial)<pre><code> -> ioTaskStdGet 0, 1 value = 3 = 0x3 -> taskIdSelf value = 13600784 = 0xcf8810 </code></pre> (another session, say over telnet)<pre><code> -> ioTaskStdSet 0xcf8810, 1, 0x9 value = 0 = 0x0 </code></pre> (first session ie SERIAL)<pre><code> -> printf "foo\n" -> taskIdSelf -> i </code></pre> (otherone eg TELNET)<pre><code> -> foo value = 4 = 0x4 value = 13600784 = 0xcf8810 NAME ENTRY TID PRI STATUS PC SP ERRNO DELAY ---------- ------------ -------- --- ---------- -------- -------- ------- ----- ... </code></pre> teeheeheehaw!
- glhaynes1 day ago
 I assume roughly the same caveats would apply, though? Buffering might be set wrong (and have no mechanism to be updated because the program never checks again), etc.
- jmclnx1 day ago
 Thanks, links saved.Then there is this method, but I guess that article refers to no redirection output.If in background or via cron, I always redirect. But this is for UN*X type systems with a tail that supports '-f'$ prog > /tmp/log.txt 2>&1 &Then$ tail -f /tmp/log.txtJust so happens, I actually used this the other day for a long running process on OpenBSD :)
 - smcameron1 day ago
 Can't you just read from /proc/pid/fd/0 ?
 - irishcoffee1 day ago
 This was my first thought as well. I assume somehow I'm the dummy that doesn't understand the question.
 - jmclnx11 hours ago
 OpenBSD does not have a /proc file system.
 - hmng1 day ago
 Isn't that what tee is for? Like$ prog | tee /tmp/log.txt
 - jmclnx1 day ago
 When I submit a process to bg, I mostly use cron and I do not care about seeing output during runtime.So, tail suites my needs in the rare cases something unexpected seems to be happening.
 - gosub1001 day ago
 That's if you start the process with advance knowledge that you'll want to tail the output and log it. Not if you want to view the output of an existing process
 - hmng1 day ago
 Yes, but I was replying to the above, using redirection and tail -f.
amelius1 day ago
Can't you attach to it from GDB?
- gary_01 day ago
  Or you could patch the executable on disk or in memory, or probably some other hacks I'm not thinking of. I think he means that there's no Windows API or "proper" way to do it, not that it's literally impossible (it's running on a general-purpose computer, after all).
jeffrallen1 day ago
strace (8).
bh0k4l1 day ago
How I use the script command to read the output of the last command and ask an LLM for help:The following custom command is executed for starting the terminal<pre><code> /usr/bin/zsh -c 'export SCRIPT_LOG_FILE_NAME=$(date "+%m-%d-%y-%H-%M-%S-%N") && mkdir -p /tmp/script-log/ && script -f -q /tmp/script-log/$SCRIPT_LOG_FILE_NAME' export SCRIPT_LOG_FILE_NAME=$(date "+%m-%d-%y-%H-%M-%S-%N") mkdir -p /tmp/script-log/ script -f -q /tmp/script-log/$SCRIPT_LOG_FILE_NAME </code></pre> The date sub-command creates a unique filename for the current session and stores it in SCRIPT_LOG_FILE_NAME.<pre><code> export SCRIPT_LOG_FILE_NAME=$(date "+%m-%d-%y-%H-%M-%S-%N") </code></pre> Create a folder in /tmp/script-log/.<pre><code> mkdir -p /tmp/script-log/ </code></pre> Script then writes the current terminal session to that file.<pre><code> script -f -q /tmp/script-log/$SCRIPT_LOG_FILE_NAME </code></pre> Now any command run in this terminal knows where the last program wrote its output.We can split the log at the last $PS1 prompt and feed the most recent chunk to a utility such as Simon W.'s llm.Add the following to .zshrc (or …):<pre><code> alias z='tail -n 100 /tmp/script-log/$SCRIPT_LOG_FILE_NAME | llm -s "Fix it or similar" | pbcopy' </code></pre> Essentially, run a command; if it fails, run z.
- bmacho1 day ago
 On HN you can have a code block by adding 2 spaces before each line