LinuxQuestions.org - save error output of a running app

A known technique is by means of the GNU debugger, gdb. You can redirect file descriptors 1 (standard output) and 2 (standard error) from the terminal to a file and leave the process running to its completion.

Here is an example. First, check the PID of the running process, then use the command:

Code:

gdb -p PID

to attach a gdb session to the process. In the following I will put an example session, highlighting my entries in blue (note that the first part is made of the licensing stuff and of the output messages of gdb itself):

Code:

$ gdb -p 11220

GNU gdb (GDB; openSUSE 11.1) 6.8.50.20081120-cvs

Copyright (C) 2008 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "i586-suse-linux".

For bug reporting instructions, please see:

<http://bugs.opensuse.org/>.

Attaching to process 11220

Reading symbols from /bin/bash...(no debugging symbols found)...done.

(no debugging symbols found)

Loaded symbols for /bin/bash

Reading symbols from /lib/libreadline.so.5...(no debugging symbols found)...done.

Loaded symbols for /lib/libreadline.so.5

Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.

Loaded symbols for /lib/libdl.so.2

Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.

Loaded symbols for /lib/libc.so.6

Reading symbols from /lib/libncurses.so.5...(no debugging symbols found)...done.

Loaded symbols for /lib/libncurses.so.5

Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.

Loaded symbols for /lib/ld-linux.so.2

(no debugging symbols found)

0xffffe430 in __kernel_vsyscall ()

(gdb) p creat("/home/alex/foo.stdout",0600)

$1 = 3

(gdb) p dup2(3,1)

$2 = 1

(gdb) p close(3)

$3 = 0

(gdb) p creat("/home/alex/foo.stderr",0600)

$4 = 3

(gdb) p dup2(3,2)

$5 = 2

(gdb) p close(3)

$6 = 0

(gdb) q

The program is running.  Quit anyway (and detach it)? (y or n) y

Detaching from program: /bin/bash, process 11220

After that, stdout and stderr are redirected to /home/alex/foo.stdout and /home/alex/foo.stderr respectively, until completion of the process.

And here is a little explanation:

a) p creat("/home/alex/foo.stdout",0600)
$1 = 3
this creates a file with rw permissions and gdb assigns file descriptor 3 to it. This may differ for you, depending on the actual number of file descriptors kept open by the process. The important thing is that you must use this value in the subsequent commands.

b) p dup2(3,1)
this duplicates fd 3 to fd 1, actually redirecting the standard output to the newly created file.

c) p close(3)
this closes the file descriptor 3. Steps a), b), c) are repeated for standard error (you can see the difference in the filename and in the dup2 statement, which redirects fd3 to fd2).

d) q
quit the gnu debugger and detach the process (you have to answer y to the final question). At this point check the two files and see how they will be populated as soon as the process "spits" some more output/error.

Note that no lines of output are lost during the gdb session, since gdb attaches itself to the running process and pick up the standard output and the standard error. I hope this is what you're looking for.