ttysnoop(8)

📦 version 0.36.1, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

🎀 ttysnoop(8) 🎀

✨ NAME ✨

okay so ttysnoop is the tool that lets you watch whatever output is showing up on a tty or pts device 👀 It's built on Linux eBPF/bcc, so it's giving kernel-level main character energy 💅

🌸 SYNOPSIS 🌸

ttysnoop [-h] [-C] device

💖 DESCRIPTION 💖

okay so bestie, ttysnoop watches a tty or pts device and prints the exact same output that's appearing on that device ✨ It's perfect for mirroring a shell session or the system console 🦋

Lowkey the way it works is through kernel dynamic tracing of the tty_write() function 🧚 Heads up though: if that kernel function ever changes in a future kernel version, this tool will need updating 😭

⚠️ Since this uses BPF, only the root user can run this tool. No cap, nobody else gets in 🔥

🍓 REQUIREMENTS 🍓

You'll need CONFIG_BPF and bcc 🫶

👑 OPTIONS 👑

  • -C — don't clear the screen 🧹 (the screen stays as-is, slay)
  • -s SIZE, --datasize SIZE — the size of the transmitting buffer. It defaults to 256 💜
  • -c COUNT, --datacount COUNT — how many times ttysnop checks for SIZE bytes of data. It defaults to 16 ⭐
  • device — either a path to a tty device (like /dev/tty0) or a pts number (like the 3 from /dev/pts/3) 🌈

🦋 EXAMPLES 🦋

Snoop output from /dev/pts/2 🌸

# ttysnoop /dev/pts/2

Snoop output from /dev/pts/2, but the shortcut version 💅

# ttysnoop 2

Snoop output from the system console 🖥️

# ttysnoop /dev/console

Snoop output from /dev/tty0 🎀

# ttysnoop /dev/tty0

🧚 OVERHEAD 🧚

The rate of tty_write() is expected to be very low (<100/s), so the overhead of this tool is expected to be negligible 🥹 literally barely there.

🫶 SOURCE 🫶

This is from bcc 💖

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, so it's a must-read 📚✨

🌈 OS 🌈

Linux 🐧

🙈 STABILITY 🙈

Unstable, still in development 🚧 it's giving work-in-progress.

💜 AUTHOR 💜

Brendan Gregg 👑

🔥 SEE ALSO 🔥

opensnoop(1) ✨

Bye bestie, go be iconic with your snooping 🦋💖 (Source: USER COMMANDS, dated 2016-02-08, ttysnoop(8) 🎀)

📦 where this page comes from