I'll simply ask gdb to dump its memory, then I extract my command from its coredump. For example, $ bash $ echo $$ 477609 $ while true ; do ech

I'll simply ask gdb to dump its memory, then I extract my command from its coredump. For example, $ bash $ echo $$ 477609 $ while true ; do echo 1 ; echo 2>/dev/null ; sleep 30 ; done # From now on, this command cannot be stopped, and by now # the text has been overwritten by new output... Open a root shell, install gdb. # gcore 4077609 0x00007ae1b321ceca in wait4 () from /lib64/libc.so.6 Saved corefile core.4077609 [Inferior 1 (process 4077609) detached] # strings core.4077609 | grep while ......(omit huge amount of text)...... while true ; do echo 1 ; echo 2>/dev/null ; sleep 30 ; done Studying the source code and calling C functions in a debugger, like the author did here, is a clever and accurate way to solve this problem and deserves its pages in sysadmin folklore, but I think my brute-force approach, although boring, is equally acceptable. It's also safer, a wrong function call won't crash the program. If I can not find what I need immediately, analyzing the coredump safely in a debugger (perhaps on my own machine with more devtools installed, with a cup of tea) is also an option for me.