Redirect input and output in the shell

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Send output to files and to other commands

Know the three data channels

Every program has three channels, each with a number (a file descriptor).

Number	Name	Default
0	stdin (standard input)	The keyboard
1	stdout (standard output)	The screen
2	stderr (standard error)	The screen

Normal results go to channel 1, error messages to channel 2. Both appear on the screen, so they look the same — but you can send them to different places.

$ls /etc/hosts /nothing
ls: cannot access '/nothing': No such file or directory
/etc/hosts
$ls /etc/hosts /nothing 2> /dev/null
/etc/hosts
$ls /etc/hosts /nothing > /dev/null
ls: cannot access '/nothing': No such file or directory

9.2

Send output to a file

> writes the output to a file (the file is emptied first). >> adds it to the end.

$date > /tmp/report.txt
$uptime >> /tmp/report.txt
$df -h >> /tmp/report.txt
$cat /tmp/report.txt
$> /tmp/empty.txt

> FILE alone, without a command, makes an empty file or empties an existing one.

Watch out

> on the wrong file destroys it at once — even /etc/passwd. Turn on protection with set -o noclobber: then > refuses to overwrite, and >| forces it.

9.3

Handle error messages

2> sends only the errors somewhere else. /dev/null is a black hole: data sent there is gone.

$find / -name "*.repo" 2> /dev/null
$find / -name "*.repo" 2> /tmp/errors.txt
$find / -name "*.repo" > /tmp/found.txt 2> /tmp/errors.txt
$find / -name "*.repo" > /tmp/all.txt 2>&1
$find / -name "*.repo" &> /tmp/all.txt
$backup.sh >> /var/log/backup.log 2>&1

Sign	What it does
`2> FILE`	Errors to a file
`2>> FILE`	Errors added to a file
`2> /dev/null`	Throw the errors away
`> FILE 2>&1`	Output and errors to the same file (the order matters!)
`&> FILE`	Output and errors to the same file (short form)
`&>> FILE`	Output and errors added to the same file

Remember

2>&1 means "send channel 2 to where channel 1 goes now". Write it after > FILE. cmd 2>&1 > file puts the errors on the screen, not in the file.

9.4

Read input from a file

< gives a file to a command as its input, as if you typed it.

$wc -l < /etc/passwd
38
$sort < names.txt
$mail -s "Disk report" admin@example.com < /tmp/report.txt
$while read host; do ping -c1 -W1 "$host" > /dev/null && echo "$host up"; done < hostlist.txt

9.5

Connect commands with pipes

The pipe | sends the output of the left command into the input of the right command. Many small tools build one big answer.

$ps aux | grep httpd
$ls -l /etc | less
$cat /etc/passwd | cut -d: -f1 | sort
$dnf list --installed | wc -l
$journalctl -p err -b | tail -n 20
$ss -tln | grep ':22 '

Typical "filter" commands in a pipe:

Command	Job in the pipe
`grep WORD`	Keep only lines with WORD
`sort` / `sort -n` / `sort -h`	Sort as text / as numbers / as sizes like 4K, 2G
`uniq -c`	Count lines that repeat (sort first!)
`wc -l`	Count lines
`head` / `tail`	Keep the first / last lines
`cut -d: -f1`	Keep one column
`awk '{print $1}'`	Keep one field (split by spaces)
`tr a-z A-Z`	Change characters
`less`	Read the result page by page

Example: the 5 IP addresses with the most failed SSH logins.

#grep "Failed password" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -n 5
     41 203.0.113.50
     12 198.51.100.7
      3 192.168.122.20

At work

Build a pipe step by step. Run the first part, look at the output, add the next |, look again.

Note

A pipe only passes channel 1. To pipe errors too, use 2>&1 | or |&.

9.6

Save and show at the same time with tee

tee FILE writes its input to a file and passes it on — a "T" in the pipe.

$dnf check-update | tee /tmp/updates.txt
$ls -l /etc | tee /tmp/etc.txt | wc -l
$make 2>&1 | tee build.log
$echo "10.0.0.5  db1" | sudo tee -a /etc/hosts

tee -a adds to the file instead of overwriting it.
sudo tee is the right way to write a root-only file from a normal user's pipe.

9.7

Join output with command substitution

$(command) puts the output of a command into another command line.

$echo "This host: $(hostname), kernel $(uname -r)"
$cp /etc/fstab /root/fstab.$(date +%F)
$kill $(pgrep -u anna sleep)
$rpm -qf $(which ss)
iproute-6.11.0-1.el10.x86_64