GNU Screen logging

• Introduction
• Log on command, shortcut Ctrl+a,H and option -L are equivalent
• Logfile statement
• Logtstamp string

Introduction

When you install complex software you need log of your activities for subsequent analyses and as a record. If you work with screen then one way to get the log is to enable screen logging.

Gnu screen logging is pretty tricky. There are several command with subtle interactions between them. Interactions which are not clear after reading screen manual or manpage. 

1. To enable logging you can can put the command log on  for each window or invoke screen with the option -L (you can do it from .screenrc too). Shortcut for the  log on command is Ctrl+a,shift H. If repeated it toggle logging on/off. Message screenlog.1 created appear  when log is activated.  If file existed message Appennding to file  screenlog.1  is displayed for a shot time.

2. You can use command deflog on to enable logging for all screens.

3. Where to write the file is determined by command logfile. If no command is given the default is used (screelog.%n in the current directory, where %n is screen window number)
4. How quickly to flash log to the file is determined by command logfile flush secs Default is 10 sec.

5. Command logtstamp string string  allow putting timestamps into the log.  If time-stamps are turned ‘on’, screen adds a string containing the current time to the logfile after two minutes of inactivity. When output continues and more than another two minutes have passed, a second time-stamp is added to document the restart of the output. You can change this timeout with the second form of the command. The third form is used for customizing the time-stamp string. Default is:

   ‘-- %n:%t -- time-stamp -- %M/%d/%y %c:%s --\n’ 

Log on command, shortcut  Ctrl+a,H and option -L  are by-and-large equivalent

To start logging to default location (or any predefined location if command logfile is present in .screenrc use Ctrl+a,H.  or command log on in your .sceenrc script. Just option -L does not start logging.

By default it will create a file with name “screenlog.0” in your home directory, to which log will be written. If you want to stop logging, use the same Ctrl+a,H

Option -L  enable logging, but does not start it.

Logfile statement

logfile statement in your .sceenrc file defines location of log file for all screen windows. The syntax is:

logfile  filename

Defines the name the log files will get. The default is screenlog.%n”.

For example

deflog on
logfile /tmp/screen-%S-%n.log

logfile /tmp/screenlog-%Y%m%d-%c:%s

logfile flush 1

With logfile flush 1 we request that every 1 second the output be flushed to the log, making it easier to follow with tail -f.

Logtstamp string

Command logtstamp string string  allow putting timestamps into the log.  If time-stamps are turned ‘on’, screen adds a string containing the current time to the logfile after two minutes of inactivity. When output continues and more than another two minutes have passed, a second time-stamp is added to document the restart of the output. You can change this timeout with the second form of the command. The third form is used for customizing the time-stamp string. Default is:

‘-- %n:%t -- time-stamp -- %M/%d/%y %c:%s --\n’ 

A short note on GNU Screen configuration:

You can add configuration to ~/.screenrc or another configuration file named by -c filename upon invocation, and among the many options are some to enable logging what happens in the screen windows. This is useful when using screen as a reattachable daemonizer.

Consider this configuration:

logfile path/to/screen-output.%Y%m%d.log
logfile flush 1
logtstamp on
logtstamp after 5
log on 

That works nicely. With logfile we specify the name of the logfile, using some % escapes as per "STRING ESCAPES" in the manpage to put the date in the logfile name.

With logfile flush 1 we request that every 1 second the output be flushed to the log, making it easier to follow with tail -f.

logtstamp on turns on timestamping which writes a timestamp to the log after a default 2 minutes of inactivity. We shorten that to 5 seconds with logtstamp after 5.

Finally, log on turns on the logging.

Now, what if we want to customize the timestamp? The default looks like this:

-- 0:process-name -- time-stamp -- Jul/24/13  9:09:56 --

Which the manpage says can be customized with logtstampt string ..., where the default is

‘-- %n:%t -- time-stamp -- %M/%d/%y %c:%s --\n’.

The manpage earlier says that arguments may be separated by single or double quotes. Doing so with the default shown doesn't work, because a literal \n shows up in the logfile.

The solution I worked out by trial and error is that you must double-quote the string and use an octal escape value \012. Single-quoting that will output a literal backslash 0 1 2, and \n simply is not a recognized escape. Thus our final configuration directive is:

logtstamp string "-- time-stamp -- %Y-%m-%d %0c:%s --\012"

which results in output like:

-- time-stamp -- 2013-07-24 09:59:35 --

If you use more than one screen window with this configuration, all windows' output will go into the same logfile. Use the %n escape string to include a window number in the logfile name if you'd like them kept separate.

NEWS CONTENTS

• 20140923 : Automatic session logging and monitoring with GNU screen for the paranoid. – cmdln.org (a sysadmin blog) ( Automatic session logging and monitoring with GNU screen for the paranoid. – cmdln.org (a sysadmin blog), Sep 23, 2014 )
• 20140923 : logging - Differences between Screenlog and Hardcopy on GNU Screen ( Stack Overflow )
• 20140923 : logging - How to increase the screen log size in GNU Screen ( Stack Overflow )
• 20140922 : custom gnu-screen session log filename ( Stack Overflow )
• 20140922 : How do i log GNU screen output to a file ( How do i log GNU screen output to a file , )
• 20140922 : Screen - Logging ( Screen - Logging, )
• 20140922 : log ( log, )
• 210210 : Remove ( color - special - escape - ANSI ) codes, from text, with sed ( commandlinefu.com )
• 210210 : Using screen for remote interaction Linux.com ( Using screen for remote interaction Linux.com, )

Old News ;-)

[Sep 23, 2014] Automatic session logging and monitoring with GNU screen for the paranoid. – cmdln.org (a sysadmin blog)

Yes its been a while since I have checked in. Sorry I've just been too busy. But I have a great tip this time. Recently I had the need to do auto­matic ses­sion log­ging. A 3rd party was going to be log­ging into one of my servers to check out some soft­ware glitches that were hap­pen­ing. I love using GNU Screen for many shell tasks so using it for mon­i­tor­ing was log­i­cal. Screen is great for sev­eral rea­sons. First you can detach from it so you can leave the office, go home and re-attach and not have lost your place. Sec­ond, you can share another screen. It can be shared input or you can just watch what some­one else is doing. Finally screen can do native log­ging. I wanted to automat­ti­cally launch a screen ses­sion when somone logged in so if I hap­pened to be on the server I could mon­i­tor them in real time. I also wanted a log of the ses­sion in case I wanted to look over it later or if I was not able to mon­i­tor the ses­sion live.

I ended up adding the fol­low­ing to my .bashrc

# -- if $STARTED_SCREEN is set, don't try it again, to avoid looping
# if screen fails for some reason.
if [[ "$PS1" &&; "${STARTED_SCREEN:-No}" = No && "${SSH_TTY:-No}" != No ]]; then
STARTED_SCREEN=1 ; export STARTED_SCREEN
if [ -d $HOME/log/screen-logs ]; then
sleep 1
screen -RR && exit 0
echo "Screen failed! continuing with normal bash startup"
else
mkdir -p $HOME/log/screen-logs
fi
# [end of auto-screen snippet]

Lets go through that .….

if [[ "$PS1" && "${STARTED_SCREEN:-No}" = No && "${SSH_TTY:-No}" != No ]]

If I have some title at my ter­mi­nal and if STARTED_SCREEN is set and non-null, (expands to $STARTED_SCREEN. Oth­er­wise, expands to No.) and if SSH_TTY is set and not null, then we can attempt to cre­ate the screen.
$SSH_TTY is set when you ssh in, it should not be tripped by scp or sftp logins either.

then
STARTED_SCREEN=1 ; export STARTED_SCREEN

Here STARTED_SCREEN is set so that we dont loop on login cre­at­ing a ton of screens.

if [ -d $HOME/log/screen-logs ]; then

if the direc­tory is present

#sleep 1
screen -RR && exit 0
# normally, execution of this rc script ends here...
echo "Screen failed! continuing with normal bash startup"

Attempt to reat­tach any unat­tached screens. If there are no screens to be attached then make one and attach to it.

And I added the fol­low­ing to my .screenrc

# support color X terminals
termcap xterm 'XT:AF=\E[3%dm:AB=\E[4%dm:AX'
terminfo xterm 'XT:AF=\E[3%p1%dm:AB=\E[4%p1%dm:AX'
termcapinfo xterm 'XT:AF=\E[3%p1%dm:AB=\E[4%p1%dm:AX:hs:ts=\E]2;:fs=\007:ds=\E]2;screen\007'
termcap xtermc 'XT:AF=\E[3%dm:AB=\E[4%dm:AX'
terminfo xtermc 'XT:AF=\E[3%p1%dm:AB=\E[4%p1%dm:AX'
termcapinfo xtermc 'XT:AF=\E[3%p1%dm:AB=\E[4%p1%dm:AX:hs:ts=\E]2;:fs=\007:ds=\E]2;screen\007'

# detach on hangup
autodetach on
# no startup msg
startup_message off
# always use a login shell
shell -$SHELL

# auto-log
logfile $HOME/log/screen-logs/%Y%m%d-%n.log
deflog on

Most of this is self explana­tory the log file for auto log­ging and deflog on are what give you your fun logs to look over later.

You might also want to do some logrotate on the logs or some script to expire logs that are x days old. If you for­get about them over time they may try to eat your file system.

Note: I picked this up some­where else a while back i just don't remem­ber exactly where. I mod­i­fied it slightly to make it more read­able but the credit goes to the orig­i­nal author. I think it was http://taint.org/wk/RemoteLoginAutoScreen.

logging - Differences between Screenlog and Hardcopy on GNU Screen

Stack Overflow

Introduction

I'm new using GNU screen, and I'm using it mostly because I don't want to lose my work if unexpectedly my SSH connection closes, and also because I want to keep a logfile of every output printed on my terminal (at least some recent tracks)

For SSH stuff, I guess Ctrl+a d to detach and screen -r or screen -r session_name to re-attach to some session solve all my problems, now I'm trying to understand logging.

I found screenlog and hardcopy on this link, which basically says

hardcopy Ctrl+a h Writes out the current display contents to the file hardcopy.n in the window's default directory, where n is the number of the current window. This either appends or overwrites the file if it exists, as determined by the hardcopy_append command.

log Ctrl+a H Begins/ends logging of the current window to the file screenlog.n in the window's default directory, where n is the number of the current window. If no parameter is given, the logging state is toggled. The session log is appended to the previous contents of the file if it already exists. The current contents and the contents of the scrollback history are not included in the session log. Default is off.

Observed Behavior

So, as far as I understood by this and trying to use them, after enabling screenlog, it keeps logging everything I write and all the outputs of terminal in that file (which happens to go $HOME for me) including those characters to change color like \033[1;31mm. If I do cat screenlog.0, it crashes sometimes printing the file indefinitely, but ok, I can open it with an editor or in another session...

As for hardcopy, apparently it doesn't keep tracking commands, nor colors of outputs, and I don't know if it takes only those few lines that are visible in terminal or everything that happened on that session, could someone clarify this to me?

Finally, I'm opening screen on Terminator instead of the classical terminal, and even if I open different screen sessions on different windows of Terminator, all logs go to screenlog.0 or hardcopy.0. In the case of screenlog, will it conflict with another process that's being output on other sessions or overwrite it? How can I create different screenlog.n files and put them in a directory other than $HOME?

Further Considerations

Just to conclude, which one is recommended? Sorry for this huge question, but I'm trying to write it in a way that it can be useful to clarify details of these logs that I'm having a hard time to find in other places. Feel free to correct me if I said something wrong :)

@WilliamPursell Sometimes I need to use it on a remote server that does not have tmux and I don't have root permissions, so I'm stuck with screen. By the way, `tmux is simpler/better/safer or something like that? – rafa Aug 8 '13 at 13:53

Personally, I like the way tmux handles the copy buffer. You can change panes/windows/sessions while keeping different views in different states in the scroll back, which is not possible with screen (or wasn't the last time I looked). – William Pursell Aug 9 '13 at 0:52

logging - How to increase the screen log size in GNU Screen

Stack Overflow

Q: Is there a way to increase the screen log size? I cannot save all my history.
$ screen -S creed1
$ command1
output command 1... (50 lines)
$ command2
output command 2... (200 lines)
$ command3
output command 3... (60 lines)
$ command4
output command 4... (75 lines)

Ctrl+A+H (saving to hardcopy.0)

vim hardcopy.0 shows only the last 100 lines approx.

I wanna know this for compliance purposes with a customer.

A: You want to do Ctrl+A + H at the beginning to start logging, not when you are done.

I found that out and other screen commands here: http://www.computerhope.com/unix/screen.htm

[Sep 22, 2014] custom gnu-screen session log filename

Stack Overflow

Q: I'd like to know if someone has tried logging their gnu-screen session to a logfile (other than the default screenlog.N where N is the session number).

I tried doing the following
~$ screen -L custom_screenlog -S test_session

but screen would terminate. It's not also in the screen manual. Tried searching Google and I can't seem to see an answer.

A: My 4.0.2 version of GNU screen has no argument to -L switch.

The log file is systematically named screenlog.0 and created in the current directory. Then you may simply try:

screen -L -S test_session

Edit: you can customize your .screenrc file, adding for instance
logfile /tmp/screenlog-%Y%m%d-%c:%s

This way log files may be stored in a predefined directory (/tmp in this example) and may be named after logfile opening date

How do i log GNU screen output to a file

Old 06-12-2009, 02:35 PM #4

jamescondron

It is logged whenever there is output. The location is ~/screenlog.*; you could use any number of options to copy it/rotate the logs.

Screen - Logging Command: hardcopy

(C-a h, C-a C-h)
Writes out the current display contents to the file `hardcopy.n' in the window's default directory, where n is the number of the current window. This either appends or overwrites the file if it exists, as determined by the hardcopy_append command.

Command: hardcopy_append state

(none)
If set to `on', screen will append to the `hardcopy.n' files created by the command hardcopy; otherwise, these files are overwritten each time.

Command: hardcopydir directory

(none)
Defines a directory where hardcopy files will be placed. If unset hardcopys are dumped in screen's current working directory.

log

Command: log [state]

(C-a H)
Begins/ends logging of the current window to the file `screenlog.n' in the window's default directory, where n is the number of the current window. If no parameter is given, the logging state is toggled.

The session log is appended to the previous contents of the file if it already exists. The current contents and the contents of the scrollback history are not included in the session log. Default is `off'.

Command: logdir directory

(none)
Defines a directory where logfiles will be placed. If unset logfiles are written in screens current working directory.

Remove ( color - special - escape - ANSI ) codes, from text, with sed

commandlinefu.com

Remove ( color / special / escape / ANSI ) codes, from text, with sed

sed "s,\x1B\[[0-9;]*[a-zA-Z],,g"

Credit to the original folks who I've copied this command from.

The diff here is:

Theirs: [m|K]

Theirs is supposed to remove \E[NUMBERS;NUMBERS[m OR K]

This statement is incorrect in 2 ways.

1. The letters m and K are two of more than 20+ possible letters that can end these sequences.

2. Inside []'s , OR is already assumed, so they are also looking for sequences ending with | which is not correct.

This : [a-zA-Z]

This resolves the "OR" issue noted above, and takes care of all sequences, as they all end with a lower or upper cased letter.

This ensures 100% of any escape code 'mess' is removed.

Alternatives

There are 2 alternatives - vote for the best!

sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"

sed -r "s:\x1B\[[0-9;]*[mK]::g"'

sed -r "s/\x1B\[([0-9]{1,3}((;[0-9]{1,3})*)?)?[m|K]//g

sed -r 's/'$(echo -e "\033")'\[[0-9]{1,2}(;([0-9]{1,2})?)?[mK]//g'

Remove color codes (special characters) with sed

sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"

Handles the color codes intended for 256-color terminals (such as xterm-(256)color and urxvt-unicode-256color), in addition to the standard 16-color ANSI forms. Overkill for strict ANSI output, see other options for something simpler.

Using screen for remote interaction Linux.com

The logfile will contain the output of your session with corrections and cursor movements already evaluated and applied. One caveat is that programs that send control sequences to the screen will still confuse the output. One example of this is GNU ls, which by default colorizes output. You should turn this off in your session

Fortunately screen comes with a comprehensive logging facility that is much more sophisticated than what script can do. Screen's logging can be turned on or off at any time with Ctrl-a H, or you can use the -L switch when starting screen to enable it by default. The log file is written to the current directory under the name screenlog.n, where n is incremented by one for each new log.

The logfile will contain the output of your session with corrections and cursor movements already evaluated and applied. One caveat is that programs that send control sequences to the screen will still confuse the output. One example of this is GNU ls, which by default colorizes output. You should turn this off in your session by using something like the following bash alias:

 alias ls='ls --color=none'  

With that, all the pieces are in place: multiple users can share a screen session for any sort of command-line-based instruction. The teacher can at any time take control of the session by switching all other users to read-only access. Finally, you can turn on the logging facilities in screen to get an accurate and usable log of the entire session (or just portions of the session if you desire).

Recommended Links

Softpanorama Recommended

Top articles

Sites

Top articles

Sites

• GNU screen [commandslogfile]
• GNU screen [commandslog]
• Automatic session logging and monitoring with GNU screen for the paranoid. – cmdln.org (a sysadmin blog)
• GNU Screen logtstamp string End Point Blog

Reference

Screen User's Manual

18.2 log

- Command: deflog state

(none)
Same as the log command except that the default setting for new windows is changed. Initial setting is `off'.

- Command: log [state]

(C-a H)
Begins/ends logging of the current window to the file screenlog.n in the window's default directory, where n is the number of the current window. This filename can be changed with the 'logfile' command. If no parameter is given, the logging state is toggled. The session log is appended to the previous contents of the file if it already exists. The current contents and the contents of the scrollback history are not included in the session log. Default is 'off'.

- Command: logfile filename
- Command: logfile flush secs

(none)
Defines the name the log files will get. The default is 'screenlog.%n'. The second form changes the number of seconds screen will wait before flushing the logfile buffer to the file-system. The default value is 10 seconds.

- Command: logtstamp [state]
- Command: logtstamp after secs
- Command: logtstamp string string

(none)
This command controls logfile time-stamp mechanism of screen. If time-stamps are turned 'on', screen adds a string containing the current time to the logfile after two minutes of inactivity. When output continues and more than another two minutes have passed, a second time-stamp is added to document the restart of the output. You can change this timeout with the second form of the command. The third form is used for customizing the time-stamp string ('-- %n:%t -- time-stamp -- %M/%d/%y %c:%s --\n' by default).

18.1 hardcopy

- Command: hardcopy [-h] [file]

(C-a h, C-a C-h)
Writes out the currently displayed image to the file file, or, if no filename is specified, to hardcopy.n in the default directory, where n is the number of the current window. This either appends or overwrites the file if it exists, as determined by the hardcopy_append command. If the option -h is specified, dump also the contents of the scrollback buffer.

- Command: hardcopy_append state

(none)
If set to 'on', screen will append to the hardcopy.n files created by the command hardcopy; otherwise, these files are overwritten each time.

- Command: hardcopydir directory

(none)
Defines a directory where hardcopy files will be placed. If unset, hardcopys are dumped in screen's current working directory.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: July, 28, 2019