Linux · text processing

tee

save and show at once

tee sits in a pipe and sends what passes through to two places: a file, and onward. Named after a T-shaped pipe joint, it is also the standard way to write to a root-owned file from a pipe.

A redirect sends output to a file instead of the screen; tee sends it to both.

Writes to

A file and the screen

both at once

Append

-a

otherwise the file is replaced

With sudo

| sudo tee file

for files you cannot write

Several files

tee a b c

each gets a copy

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ ping -c 2 192.0.2.1 | tee ping.log

1PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.

64 bytes from 192.0.2.1: icmp_seq=1 ttl=64 time=0.412 ms

64 bytes from 192.0.2.1: icmp_seq=2 ttl=64 time=0.398 ms

2$ wc -l ping.log

3 ping.log

3$ echo "192.168.1.20 fileserver" | sudo tee -a /etc/hosts

192.168.1.20 fileserver

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The output appears as usual

tee passes everything through to the screen, so the command can be watched while it runs.

And it was saved

The same three lines are in ping.log.

Appending to a root-owned file

tee runs under sudo, so it may open /etc/hosts. -a appends instead of replacing. The line is echoed back because tee also prints.

Switches

A switch changes how the command behaves. These are the ones used day to day; man tee lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-a: Append to the file instead of overwriting it.
-i: Ignore interrupt signals, so Ctrl+C does not stop tee before the command.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

make 2>&1 | tee build.log

Saves both normal output and errors while showing them.

command | tee -a history.log

Appends to a log instead of overwriting it.

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Writes a kernel setting that needs root.

command | sudo tee file > /dev/null

Writes the file without echoing the content to the screen.

In cybersecurity

tee is how a record is kept of what a command actually printed.

Keeping evidence

During an investigation or an authorised test, piping commands through tee keeps a dated record of exactly what was seen.

Forgetting -a overwrites

sudo tee /etc/hosts without -a replaces the whole file with one line. Check for the -a every time.

Saved output may contain secrets

A log made with tee holds whatever the command printed, tokens and passwords included. Give it tight permissions.

Filed under

Text processing

Read alongside

echoPrints its arguments — text, or the value of a variable — followed by a new line.catPrints the contents of a file to the terminal, or joins several files into one stream.