Redirecting output of running process via SSH in background

Here is my general question: How do you log into a remote server, kick off a continuously running process, redirect the standard output of that process to a file on the local machine, and have all of this run in the background (on the local machine)?

More specifically, I'm trying to pipe tshark output from a remote Raspberry Pi to my local machine (actually another remote machine with Windows running Cygwin - long story) and write it to a log file. I started out by running the command without output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch"

This seems to working as I would expect it to; I get a stream of data in the terminal. Next I tried to add output redirection:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out

This also seems to work as expected; I see standard error written to the terminal and after I terminate the process and check the output file (/var/tshark.out) I see the standard output from tshark. Next I try to run this in the background on my machine:

ssh pi@remotehost "\
sudo tshark \
-i wlan1mon \
-I -l -f broadcast \
-Y wlan.fc.subtype==4 \
-T fields \
-e wlan.sa \
-e frame.time_epoch" \
> /var/tshark.out &

Unfortunately this doesn't have the desired effect. When I check the output file it's empty, and when I check the job status (by running the "jobs" command) I see that it's stopped. Here is the output from jobs (I've reformatted it slightly for readability):

[1]+  Stopped   ssh pi@remotehost
                "sudo tshark
                -i wlan1mon
                -I -l -f broadcast
                -Y wlan.fc.subtype==4
                -T fields
                -e wlan.sa
                -e frame.time_epoch"
                > /var/tshark.out &

This led me down the path of trying various permutations of background-ing and nohup-ing both the remote and local process, but to no avail.

Asked by user99163 (9,119 )
Jun 04, 2017 at 17:31