Python 子进程：stderr 只保存第一行。为什么？

Question

我在 Python 中运行 tcpdump，我想知道有多少 数据包 被内核丢弃。。 p>

在命令行上运行时，tcpdump 如下所示：

me@mypc:$ sudo tcpdump -w myPackets.cap -i eth0 ip
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
^C28 packets captured
28 packets received by filter
0 packets dropped by kernel

这就是我在 Python 脚本中调用 tcpdump 的方式：

f_out = open("tcpdumpSTDOUT", "w")
f_err = open("tcpdumpSTDERR", "w")
tcpdumpProcess = subprocess.Popen(['tcpdump',
                        '-w', 'myPackets.cap', '-i', 'eth0', '-n','ip'],
                        stdout=f_out,
                        stderr=f_err)
# a few seconds later:
tcpdumpProcess.kill()
f_in.close()
f_out.close()

现在，如果我查看tcpdumpSTDERR，我只看到通常输出的第一行：

tcpdump：监听 eth0，链接类型 EN10MB（以太网），捕获大小 65535字节

剩下的都在哪里？

编辑 我尝试了另一种方法：

>>> myProcess = subprocess.Popen("tcpdump -w myPackets.cap -i eth2 ip",  shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
>>> myProcess.communicate()

然后我从另一个 shell 中杀死了 tcpdump，并显示了 commnunicate() 的输出：

('', 'tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes\n')

...仍然只是第一行！

编辑 2 有趣的是：

>>> import shlex
>>> a = subprocess.Popen(shlex.split("tcpdump -w myPackets.cap -i eth2 ip"),  stdout=subprocess.PIPE, stderr=subprocess.PIPE)
>>> a.terminate()
>>> a.communicate()
('', 'tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes\n221 packets captured\n221 packets received by filter\n0 packets dropped by kernel\n')

Answer 1

问题是我在进程上调用了kill() 而不是terminate()。对于后者，所有消息都存储在我指定为stderr 的任何内容中（tcpdump，出于某种原因，写入标准错误而不是标准输出）。

因此，如果它可能对其他人有所帮助，我决定将 stderr 重定向到 subprocess.PIPE 并直接在 Python 中解析字符串：

>>> tcpdumpProcess = subprocess.Popen(['tcpdump',
                        '-w', 'myPackets.cap', '-i', 'eth0', '-n','ip'],
                        stdout=subprocess.PIPE,
                        stderr=subprocess.PIPE)
>>> tcpdumpProcess.terminate()
# stdout in [0], stderr in [1]
>>> tcpdump_stderr = tcpdumpProcess.communicate()[1]
>>> print tcpdump_stderr
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
40 packets captured
40 packets received by filter
0 packets dropped by kernel

Answer 2

使用proc.terminate() 代替proc.kill()：

import shlex
import subprocess
import time

with open("tcpdumpSTDERR", "wb") as f_err: # close the file automatically
    proc = subprocess.Popen(shlex.split("tcpdump -w myPackets.cap -i eth2 ip"),
                            stderr=f_err)
time.sleep(2)    # wait a few seconds
proc.terminate() # send SIGTERM instead of SIGKILL
proc.wait()      # avoid zombies