RSS Amplifier

My Sysadmin Cheatsheet · Aug 16, 2016

Capture Output of Running Processes on OS X

Read inOriginalenesdefrptjaittr
0
Sign in to vote or save

docs.j7k6.org

17 Aug 2016

Note: The dtrace security restrcition needs to be disabled on El Capitan. Boot into recovery mode → csrutil enable --without dtrace.

Capture stdout

sudo dtrace -p <$PID> -qn 'syscall::write*:entry /pid == $target && arg0 == 1/ { printf("%s", copyinstr(arg1, arg2)); }'

Capture stderr

sudo dtrace -p <$PID> -qn 'syscall::write*:entry /pid == $target && arg0 == 2/ { printf("%s", copyinstr(arg1, arg2)); }'

Capture both

sudo dtrace -p <$PID> -qn 'syscall::write*:entry /pid == $target && (arg0 == 1 || arg0 == 2)/ { printf("%s", copyinstr(arg1, arg2)); }'
  1. https://github.com/mivok/squirrelpouch/wiki/dtrace

Read the original on docs.j7k6.org ↗

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.