Back to index
Last updated 2017/07/01

Using `script' and `tail' to follow a shell session in real-time

This is an old trick that my longest standing friend Mark and I used years ago on one of his UltraSPARC stations while having fun doing any number of things. It can be used for all sorts of needs (e.g. showing someone how to do something, allowing someone to help debug your problem to name two of many others) but the main idea is that person is running tasks (for the purpose of this article I will pretend this person is the victim) and more generally using the shell, while the other person (and pretending that this person is the snoop) is watching everything, even if they're across the world. It works as long as both are on the same system and that the victim writes output (directs to) a file that the snoop can read (as in open for reading).

So the question is, is there a way that I can control the starting of the file, and even more than that, could the snoop check on the file later (doesn't watch in the beginning) or stop in the middle and then start watching again? Absolutely. Here's how:

As for the caveat I referred to, it is simply this: control characters are also sent to the file and so it isn't ASCII only. Furthermore, because of the same reason, using text editors (e.g. vi) will not show correctly to the snoop.

In the end, this is probably not often used but it is very useful when it is indeed needed. Lastly, if you were cat the output file, you'd see it as if you were watching the file in real-time. Most importantly: do not ever do anything that would reveal confidential information and if you do have anything you don't want shown to the world, do not use /tmp or any public-readable file (and rm it when done too!). Yes, you can have someone read a file in your directory as long as they know the full path and have proper permissions to the directory and file.