2

Here is my general question: How do you log into a remote server, kick off a continuously running process, redirect the standard output of that process to a file on the local machine, and have all of this run in the background (on the local machine)?

More specifically, I'm trying to pipe tshark output from a remote Raspberry Pi to my local machine (actually another remote machine with Windows running Cygwin - long story) and write it to a log file. I started out by running the command without output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch"

This seems to working as I would expect it to; I get a stream of data in the terminal. Next I tried to add output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out

This also seems to work as expected; I see standard error written to the terminal and after I terminate the process and check the output file (/var/tshark.out) I see the standard output from tshark. Next I try to run this in the background on my machine:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out &

Unfortunately this doesn't have the desired effect. When I check the output file it's empty, and when I check the job status (by running the "jobs" command) I see that it's stopped. Here is the output from jobs (I've reformatted it slightly for readability):

[1]+  Stopped   ssh pi@remotehost
                "sudo tshark
                -i wlan1mon
                -I -l -f broadcast
                -Y wlan.fc.subtype==4
                -T fields
                -e wlan.sa
                -e frame.time_epoch"
                > /var/tshark.out &

This led me down the path of trying various permutations of background-ing and nohup-ing both the remote and local process, but to no avail.

2
  • To simplify things, I would make a script on the remote host machine with tshark and all the options so it is easier to call. I would also ssh root@remotemachine and skip the sudo.
    – MERM
    Commented Jun 4, 2017 at 17:42
  • Have you tried $(ssh root@remotemachine tshark_script.sh) > /var/tshark.out &
    – MERM
    Commented Jun 4, 2017 at 17:43

1 Answer 1

4

Use the -f switch to the ssh, which will send the command to the background after the authentication and other potentially interactive steps.

2
  • 1
    Thanks; I'll try that. Could you explain why what I was doing didn't work?
    – igal
    Commented Jun 4, 2017 at 18:40
  • I experienced that some time ago too, but I am not sure about the cause from back of my head. Running it with strace can give you the idea.
    – Jakuje
    Commented Jun 4, 2017 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .