Error Messages: stderr, 2> and /dev/null

Two kinds of output

Commands have two output channels. Normal results go to standard output (stdout), and error messages go to standard error (stderr). Both show up on your screen, so you usually can't tell them apart. Here ls lists a file that exists and one that doesn't:

ls /etc/hostname /etc/nothing-here

In the terminal

student@vulntech:~$ ls /etc/hostname /etc/nothing-here
ls: cannot access '/etc/nothing-here': No such file or directory
/etc/hostname

Now redirect with >. The error still shows on the screen, because > only catches standard output:

ls /etc/hostname /etc/nothing-here > out.txt
cat out.txt

In the terminal

student@vulntech:~$ ls /etc/hostname /etc/nothing-here > out.txt
ls: cannot access '/etc/nothing-here': No such file or directory
student@vulntech:~$ cat out.txt
/etc/hostname

Each channel has a number

> is short for 1>. To redirect the errors, put a 2 in front:

ls /etc/hostname /etc/nothing-here 2> errors.txt
cat errors.txt

In the terminal

student@vulntech:~$ ls /etc/hostname /etc/nothing-here 2> errors.txt
/etc/hostname
student@vulntech:~$ cat errors.txt
ls: cannot access '/etc/nothing-here': No such file or directory

Or split them into two files in one go:

ls /etc/hostname /etc/nothing-here > out.txt 2> errors.txt
cat out.txt
cat errors.txt

In the terminal

student@vulntech:~$ ls /etc/hostname /etc/nothing-here > out.txt 2> errors.txt
student@vulntech:~$ cat out.txt
/etc/hostname
student@vulntech:~$ cat errors.txt
ls: cannot access '/etc/nothing-here': No such file or directory

Both in one file: 2>&1

2>&1 means send the errors (2) wherever the output (1) is going:

ls /etc/hostname /etc/nothing-here > all.txt 2>&1
cat all.txt

In the terminal

student@vulntech:~$ ls /etc/hostname /etc/nothing-here > all.txt 2>&1
student@vulntech:~$ cat all.txt
ls: cannot access '/etc/nothing-here': No such file or directory
/etc/hostname

Bash also has a shortcut for this: command &> all.txt.

Common mistake: Order matters. Write > file 2>&1, not 2>&1 > file. The second version points the errors at the screen before the output moves to the file, so the errors still end up on the screen.

/dev/null: the black hole

/dev/null is a special file that throws away everything written to it. It's perfect for hiding error messages you don't care about. Searching folders you aren't allowed to read gives Permission denied errors, for example the administrator's home /root:

find /etc /root -name 'host*'
find /etc /root -name 'host*' 2>/dev/null

In the terminal

student@vulntech:~$ find /etc /root -name 'host*'
/etc/hostname
/etc/hosts
/etc/init.d/hostname
/etc/runlevels/boot/hostname
find: ‘/etc/sudoers.d’: Permission denied
find: ‘/root’: Permission denied
student@vulntech:~$ find /etc /root -name 'host*' 2>/dev/null
/etc/hostname
/etc/hosts
/etc/init.d/hostname
/etc/runlevels/boot/hostname

Tip: command > /dev/null 2>&1 silences a command completely. Scripts do this when they only care whether the command worked.

Remember: 2> redirects errors. 2>&1 sends errors where the output goes. 2>/dev/null hides them.