ttysnoop(8) System Manager's Manual ttysnoop(8)

# [NAME](#NAME)

ttysnoop - Watch output from a tty or pts device. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**ttysnoop \[-h] \[-C] device**

# [DESCRIPTION](#DESCRIPTION)

ttysnoop watches a tty or pts device, and prints the same output that is appearing on that device. It can be used to mirror the output from a shell session, or the system console.

This works by use of kernel dynamic tracing of the tty\_write() function. This tool will need updating in case that kernel function changes in a future kernel version.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-C](#C)

Don't clear the screen.

[-s SIZE , --datasize SIZE](#s)

Size of the transmitting buffer (default 256).

[-c COUNT, --datacount COUNT](#c)

Number of times ttysnop checks for SIZE bytes of data (default 16).

[device](#device)

Either a path to a tty device (eg, /dev/tty0) or a pts number (eg, the "3" from /dev/pts/3).

# [EXAMPLES](#EXAMPLES)

[Snoop output from /dev/pts/2](#Snoop)

\# **ttysnoop /dev/pts/2**

[Snoop output from /dev/pts/2 (shortcut)](#Snoop~2)

\# **ttysnoop 2**

[Snoop output from the system console](#Snoop~3)

\# **ttysnoop /dev/console**

[Snoop output from /dev/tty0](#Snoop~4)

\# **ttysnoop /dev/tty0**

# [OVERHEAD](#OVERHEAD)

As the rate of tty\_write() is expected to be very low (<100/s), the overhead of this tool is expected to be negligible.

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[opensnoop(1)](/man/enterprise-packages/bcc/opensnoop.1)

2016-02-08 USER COMMANDS

---

Document: ttysnoop(8) from bcc 0.37.0-r3 (Chainguard OS)
Source: https://github.com/iovisor/bcc