8 ms·

Why pipes sometimes get "stuck": buffering

• deleted 2y ago
  [deleted]
• Twirrim 2y ago
  This is one of those things where, despite some 20+ years of dealing with NIX systems, I know* it happens, but always forget about it until I've sat puzzled why I've got no output for several moments.
• ctoth 2y ago
  Feels like a missed opportunity for a frozen pipes joke. Then again... Frozen pipes are no joke.
• hiatus 2y ago
  > Some things I didn’t talk about in this post since these posts have been getting pretty long recently and seriously does anyone REALLY want to read 3000 words about buffering? I personally would.
  • CoastalCoder 2y ago
    It depends on the writing. I've read that sometimes wordy articles are mostly fluff for SEO.
    • TeMPOraL 2y ago
      In case of this particular author, those 3000 words would be dense, unbuffered wisdom.
    • penguin_booze 2y ago
      Summarizing is one area where I'd consider using AI. I haven't explored what solutions exist yet.
  • deleted 2y ago
    [deleted]
  • EasyMark 2y ago
    I think this is one of those things where AI helps a lot. Have it summarize the article, then proof read it. Have a TLDR and a NTLDR (never too long, did read) section
• Veserv 2y ago
  The solution is that buffered accesses should almost always flush after a threshold number of bytes or after a period of time if there is at least one byte, “threshold or timeout”. This is pretty common in hardware interfaces to solve similar problems. In this case, the library that buffers in userspace should set appropriate timers when it first buffers the data. Good choices of timeout parameter are: passed in as argument, slightly below human-scale (e.g. 1-100 ms), proportional to {bandwidth / threshold} (i.e. some multiple of the time it would take to reach the threshold at a certain access rate), proportional to target flushing overhead (e.g. spend no more than 0.1% time in syscalls). Also note this applies for both writes and reads. If you do batched/coalesced reads then you likely want to do something similar. Though this is usually more dependent on your data channel as you need some way to query or be notified of “pending data” efficiently which your channel may not have if it was not designed for this use case. Again, pretty common in hardware to do interrupt coalescing and the like.
  • asveikau 2y ago
    I think doing those timeouts transparently would be tricky under the constraints of POSIX and ISO C. It would need to have some cooperation from the application layer
    • jart 2y ago
      The only way you'd be able to do it is by having functions like fputc() call clock_gettime(CLOCK_MONOTONIC_COARSE) which will impose ~3ns overhead on platforms like x86-64 Linux which have a vDSO implementation. So it can be practical sort of although it'd probably be smarter to just use line buffered or unbuffered stdio. In practice even unbuffered i/o isn't that bad. It's the default for stderr. It actually is buffered in practice, since even in unbuffered mode, functions like printf() still buffer internally. You just get assurances whatever it prints will be flushed by the end of the call.
      • asveikau 2y ago
        That's just for checking the clock. You'd also need to have a way of getting called back when the timeout expires, after fputc et al are long gone from the stack and your program is busy somewhere else, or maybe blocked. Timeouts are usually done with signals (a safety nightmare, so no thanks) or an event loop. Hence my thought that you can't do it really transparently while keeping current interfaces.
• BoingBoomTschak 2y ago
  Also made a post some time ago about the issue: https://world-playground-deceit.net/blog/2024/09/bourne_shell_stdio_trivia.html#h2-1 https://world-playground-deceit.net/blog/2024/09/bourne_shel... About the commands that don't buffer, this is either implementation dependent or even wrong in the case of cat (cf https://pubs.opengroup.org/onlinepubs/9799919799/utilities/cat.html https://pubs.opengroup.org/onlinepubs/9799919799/utilities/c... and `-u`). Massive pain that POSIX never included an official way to manage this. Not mentioned is input buffering, that would gives you this strange result: $ seq 5 | { v1=$(head -1); v2=$(head -1); printf '%s=%s\n' v1 "$v1" v2 "$v2"; } v1=1 v2= The fix is to use `stdbuf -i0 head -1`, in this case.
  • jagrsw 2y ago
    I don't believe a process reading from a pipe/socketpair/whatever can enforce such constraints on a writing process (except using heavy hackery like ptrace()). While it might be possible to adjust the pipe buffer size, I'm not aware of any convention requiring standard C I/O to respect this. In any case, stdbuf doesn't seem to help with this: $ ./a | stdbuf -i0 -- cat #include <stdio.h> #include <unistd.h> int main(void) { for (;;) { printf("n"); usleep(100000); } }
    • BoingBoomTschak 2y ago
      I'm sorry, but I don't understand what you're meaning. The issue in your example is the output buffering of a, not the input buffering of cat. You'd need `stdbuf -o0 ./a | cat` there.
• Rygian 2y ago
  Learned two things: `unbuffer` exists, and “unnecessary” cats are just fine :-)
  • wrsh07 2y ago
    I like unnecessary cat because it makes the rest of the pipe reusable across other commands Eg if I want to test out my greps on a static file and then switch to grepping based on a tail -f command
    • chatmasta 2y ago
      Yep. I use unnecessary cats when I’m using the shell interactively, and especially when I’m building up some complex pipeline of commands by figuring out how to do each step before moving onto the next. Once I have the final command, if I’m moving it into a shell script, then _maybe_ I’ll switch to file redirection.
  • samatman 2y ago
    I prefer the trivial cat, because the < redirect puts the source in the middle of the pipe. cat foo.txt | bar | blah > out.log vs. bar < foo.txt | blah > out.log It looks more like what it is. Also, with cat you can add another file or use a glob, that's come in handy more than once. Furthermore, it means the first command isn't special, if I decide I want something else as the first command I just add it. Pure... concatenation. heh. It's useful to know both ways, I suppose. But "don't use trivial cat" is just one of those self-perpetuating doctrines, there's no actual reason not to do things that way if you want.
    • delamon 2y ago
      You can do it like this: < foo.txt bar | blah > out.log
      • samatman 2y ago
        Hey, TIL. I like that more, in a way, and less, in a way. The angle bracket is pointing off into nothing but throws `foo.txt` into `bar` anyway, so the control flow seems more messed up than in `bar < foo.txt`. On the other hand it's structurally a bit more useful, because I can insert a different first stage very easily. But I still can't add a filename or change it to a glob, so cat is still more flexible. So I'm going to stick to my trivial-catting ways, but thanks for the head's up.
• Joker_vD 2y ago
  > I think this problem is probably unavoidable – I spent a little time with strace to see how this works and grep receives the SIGINT before tcpdump anyway so even if tcpdump tried to flush its buffer grep would already be dead. I believe quite a few utilities actually do try to flush their stdout on receiving SIGINT... but as you've said, the other side of the pipe may also very well have received a SIGINT, and nobody does a short-timed wait on stdin on SIGINT: after all, the whole reason you've been sent SIGINT is because the user wants your program to stop working now.
• mpbart 2y ago
  Wow I had no idea this behavior existed. Now I’m wondering how much time I’ve wasted trying to figure out why my pipelined greps don’t show correct output
• why-el 2y ago
  Love it. > this post is only about buffering that happens inside the program, your operating system’s TTY driver also does a little bit of buffering sometimes and if the TTY is remote, so do the network switches! it's buffering all the way down.
• BeefWellington 2y ago
  AFAIK, signal order generally propagates backwards, so the last command run will always receive the signal first, provided it is a foreground command. But also, the example is not a great one; grepping tcpdump output doesn't make sense given its extensive and well-documented expression syntax. It's obviously just used as an example here to demonstrate buffering.
  • toast0 2y ago
    > grepping tcpdump output doesn't make sense given its extensive and well-documented expression syntax. I dunno. If doesn't make sense in the world where everyone makes the most efficient pipelines for what they want; but in that world, they also always remember to use --line-buffered on grep when needed, and the line buffered output option for tcpdump. In reality, for a short term thing, grepping on the grepable parts of the output can be easier than reviewing the docs to get the right filter to do what you really want. Ex, if you're dumping http requests and you want to see only lines that match some url, you can use grep. Might not catch everything, but usually I don't need to see everything.
  • Joker_vD 2y ago
    > grepping tcpdump output doesn't make sense given its extensive and well-documented expression syntax Well. Personally, every time I've tried to learn its expression syntax from its extensive documentation my eyes would start to glaze over after about 60 seconds; so I just stick with grep — at worst, I have to put the forgotten "-E" in front of the pattern and re-run the command. By the way, and slightly off-tangent: if anyone ever wanted grep to output only some part of the captured pattern, like -o but only for the part inside the parentheses, then one way to do it is to use a wrapper like this: #!/bin/sh -e GREP_PATTERN="$1" SED_PATTERN="$(printf '%s\n' "$GREP_PATTERN" | sed 's;/;\\/;g')" shift grep -E "$GREP_PATTERN" --line-buffered "$@" | sed -r 's/^.*'"$SED_PATTERN"'.*$/\1/g' Not the most efficient way, I imagine, but it works fine for my use cases (in which I never need more than one capturing group anyway). Example invocation: $ xgrep '(^[^:]+):.*:/nonexistent:' /etc/passwd nobody messagebus _apt tcpdump whoopsie
    • 2y ago
• Thaxll 2y ago
  TTY, console, shell, stdin/out, buffer, pipe, I wish there was a clear explanation somewhere of how all of those are glue/work together.
  • MathMonkeyMan 2y ago
    Here's a resource for at least the first one: https://www.linusakesson.net/programming/tty/ https://www.linusakesson.net/programming/tty/
• toast0 2y ago
  > when you press Ctrl-C on a pipe, the contents of the buffer are lost I think most programs will flush their buffers on SIGINT... But for that to work from a shell, you'd need to deliver SIGINT to only the first program in the pipeline, and I guess that's not how that works.
  • akdev1l 2y ago
    The last process gets sigint and everything else gets sigpipe iirc
    • toast0 2y ago
      That makes sense to me, but the article implied everything got a sigint, but the last program got it first. Eitherway, you'd need a different way to ask the shell to do it the otherway... Otoh, do programs routinely flush if they get SIGINFO? dd(1) on FreeBSD will output progress if you hit it with SIGINFO and continue it's work, which you can trigger with ctrl+T if you haven't set it differently. But that probably goes to the foreground process, so probably doesn't help. And, there's the whole thing where SIGINFO isn't POSIX and isn't really in Linux, so it's hard to use there... This article [1] says tcpdump will output the packet counts, so it might also flush buffers, I'll try to check and report a little later today. [1] https://freebsdfoundation.org/wp-content/uploads/2017/10/SIGINFO-Stay-in-the-Dark.pdf https://freebsdfoundation.org/wp-content/uploads/2017/10/SIG...
      • toast0 2y ago
        > This article [1] says tcpdump will output the packet counts, so it might also flush buffers, I'll try to check and report a little later today. I checked, tcpdump doesn't seem to flush stdout on siginfo, and hitting ctrl+T doesn't deliver it a siginfo in the tcpdump | grep case anyway. Killing tcpdump with sigint does work: tcpdump's output is flushed and it closes, and then the grep finishes too, but there's not a button to hit for that.
    • tolciho 2y ago
      No, INTR "generates a SIGINT signal which is sent to all processes in the foreground process group for which the terminal is the controlling terminal" (termios(4) on OpenBSD, other what passes for unix these days are similar), as complicated by what exactly is in the foreground process group (use tcgetpgrp(3) to determine that) and what signal masking or handlers those processes have (which can vary over the lifetime of a process, especially for a shell that does job control), or whether some process has disabled ISIG—the terminal being shared "global" state between one or more processes—in which case none of the prior may apply. $ make pa re ci cc -O2 -pipe -o pa pa.c cc -O2 -pipe -o re re.c cc -O2 -pipe -o ci ci.c $ ./pa | ./re | ./ci > /dev/null ^Cci (2) 66241 55611 55611 pa (2) 55611 55611 55611 re (2) 63366 55611 55611 So with "pa" program that prints "y" to stdout, and "re" and "ci" that are basically cat(1) except that these programs all print some diagnostic information and then exit when a SIGPIPE or SIGINT is received, here showing that (on OpenBSD, with ksh, at least) a SIGINT is sent to each process in the foreground process group (55611, also being logged is the getpgrp which is also 55611). $ kill -l | grep INT 2 INT Interrupt 18 TSTP Suspended
• two_handfuls 2y ago
  Maybe that's why my mbp sometimes appears not to see my keyboard input for a whole second even though nothing much is running.
  • YZF 2y ago
    Shouldn't be related ... but who knows. I've not noticed this myself (also MBP user).
• mg 2y ago
  Related: Why pipes can be indeterministic. https://www.gibney.org/the_output_of_linux_pipes_can_be_indeter https://www.gibney.org/the_output_of_linux_pipes_can_be_inde...
• calibas 2y ago
  Buffers are there for good reason, it's extremely slow (relatively speaking) to print output on a screen compared to just writing it to a buffer. Printing something character-by-character is incredibly inefficient. This is an old problem, I encounter it often when working with UART, and there's a variety of possible solutions: Use a special character, like a new line, to signal the end of output (line-based). Use a length-based approach, such as waiting for 8KB of data. Use a time-based approach, and print the output every X milliseconds. Each approach has its own strengths and weaknesses, depends upon the application which one works best. I believe the article is incorrect when mentioning certain programs that don't use buffering, they just don't use an obvious length-based approach.
  • PhilipRoman 2y ago
    Also, it's not just the work needed to actually handle the write on the backend - even just making that many syscalls to /dev/null can kill your performance.
  • qazxcvbnmlp 2y ago
    Having a layer or two above the interface aware of the constraint works the best (when possible). Line based approach does this but requires agreement on the character (new line).
    • akira2501 2y ago
      Which is exactly why setbuf(3) and setvbuf(3) exists.
• pixelbeat 2y ago
  Nice article. See also: https://www.pixelbeat.org/programming/stdio_buffering/ https://www.pixelbeat.org/programming/stdio_buffering/ It's also worth mentioning a recent improvement we made (in coreutils 8.28) to the operation of the `tail | grep` example in the article. tail now notices if the pipe goes away, so one could wait for something to appear in a log, like: tail -f /log/file | grep -q match then_do_something There are lots of gotchas to pipe handling really. See also: https://www.pixelbeat.org/programming/sigpipe_handling.html https://www.pixelbeat.org/programming/sigpipe_handling.html
• emcell 2y ago
  one of the reasons why i hate computers :D
• jakub_g 2y ago
  In our CI we used to have some ruby commands that were piped to prepend "HH:MM:SS" to each line to track progress (because GitLab still doesn't support this out of the box, though it's supposed to land in 17.0), but it would sometimes lead to some logs being flushed with a large delay. I knew it had something to do with buffers and it drove me nuts, but couldn't find a fix, all solutions tried didn't really work. (Problem got solved when we got rid of ruby in CI - it was legacy).
• josephcsible 2y ago
  I've ran into this before, and I've always wondered why programs don't just do this: when data gets added to a previously-empty output buffer, make the input non-blocking, and whenever a read comes back with EWOULDBLOCK, flush the output buffer and make the input blocking again. (Or in other words, always make sure the output buffer is flushed before waiting/going to sleep.) Wouldn't this fix the problem? Would it have any negative side effects?
  • 392 2y ago
    Setting nonblocking takes effect on the file description rather than just the file descriptor. Meaning if your program crashes the description remains in nonblocking mode for the next program, which is not prepared to handle it. Node.js sets stdin to nonblocking. This is great because it means copy and pasting a shell script containing an npm install into your shell will work, since the description is reset between each program by your terminal. But when those same lines are executed by the bash interpreter directly, processes after npm will randomly fail by failing to read from stdin with a return value they never expected to see. Ask me how I know
• kreetx 2y ago
  From experience, `unbuffer` is the tool to use to turn buffering off reliably.
• fatih-erikli-cg 2y ago
  [dead]
• radarsat1 2y ago
  Side note maybe, but is there an alternative to chaining two greps?
  • ykonstant 2y ago
    The most portable way to do it with minimal overhead is with sed: sed -e '/pattern1/!d' -e '/pattern2/!d' which generalizes to more terms. Easier to remember and just as portable is awk '/pattern1/ && /pattern2/' but now you need to launch a full awk. For more ways see https://unix.stackexchange.com/questions/55359/how-to-run-grep-with-multiple-and-patterns https://unix.stackexchange.com/questions/55359/how-to-run-gr...
    • jrpelkonen 2y ago
      These are good suggestions, but maybe it’s worth noting that one of the solutions offered in the article is not equivalent: tail -f /some/log/file | grep -E 'thing1.*thing2' This will only match if the subpatterns, i.e. thing1 & thing2, are in this order, and also require that the patterns do not overlap.
• SG- 2y ago
  how important is buffering in 2024 on modern ultra fast single user systems I wonder? I'd be interested in seeing it disabled for testing purposes.
  • chatmasta 2y ago
    It depends what the consumer is doing with the data as it exits the buffer. If it’s a terminal program printing every character, then it’s going to be slow. Or more generally if it’s any program that doesn’t have its own buffering, then it will become the bottleneck so the slowdown will depend on how it processes input. Ultimately even “no buffer” still has a buffer, which is the number of bits it reads at a time. Maybe that’s 1, or 64, but it still needs some boundary between iterations.
  • akira2501 2y ago
    > on modern ultra fast single user systems I wonder? The latency of a 'syscall' is on the order of a few hundred instructions. You're switching to a different privilege mode, with a different memory map, and where your data ultimately has to leave the chip to reach hardware. It's absurdly important and it will never not be.
  • YZF 2y ago
    Those ultra fast systems also have ultra fast I/O. Buffering is critical to get good performance e.g. on your NVMe. The difference between writing one character at a time and writing a few megabytes at a time would be many orders of magnitude (x1000? x10000?) enough to make pipe processing of large files be unacceptably slow. Even between processes you want to move large blocks of data otherwise you're just context switching all the time. You can try this by flushing after every character in a toy program and do some sort of chain `toy largefile | toy | toy > mycopy`
• londons_explore 2y ago
  I'd like all buffers to be flushed whenever the systemwide CPU becomes idle. Buffering generally is a CPU-saving technique. If we had infinite CPU, all buffers would be 1 byte. Buffers are a way of collecting together data to process in a batch for efficiency. However, when the CPU becomes idle, we shouldn't have any work "waiting to be done". As soon as the kernel scheduler becomes idle, all processes should be sent a "flush your buffers" signal.
  • webstrand 2y ago
    That's a neat idea, probably not all at once though. And it could reduce efficiency for low power systems to be speculatively waking sleeping processes?
  • corank 2y ago
    An interesting idea! Sending signals to all processes sounds expensive as hell though. All that work just to make a system call again to flush a buffer. Maybe a mechanism can be added to make the kernel aware of the user space buffer so it can directly fetch stuff from there when it's idle? Is it kind of like io_uring https://man7.org/linux/man-pages/man3/io_uring_register_buffers.3.html https://man7.org/linux/man-pages/man3/io_uring_register_buff...
    • londons_explore 2y ago
      > Sending signals to all processes sounds expensive as hell though. You'd only send signals to processes who had run any code since the CPU was last idle (if the process hasn't executed, it can't have buffered anything). There could also be some kind of "I have buffered something" flag a process could set on itself, for example at a well-known memory address.
• frogulis 2y ago
  Hopefully not a silly question: in the original example, even if we had enough log data coming from `tail` to fill up the first `grep` buffer, if the logfile ever stopped being updated, then there would likely be "stragglers" left in the `grep` buffer that were never outputted, right?
  • fwip 2y ago
    Yes, that's correct.
• o11c 2y ago
  This article is confusing two different things: "unbuffered" vs "line-buffered". Unbuffered will gratuitously give you worse performance, and can create incorrect output if multiple sources are writing to the same pipe. (sufficiently-long lines will intermingle anyway, but most real-world output lines are less than 4096 bytes, even including formatting/control characters and characters from supplementary planes) Line-buffering is the default for terminals, and usually what you want for pipes. Run each command under `stdbuf -oL -eL` to get this. The rare programs that want to do in-line updates already have to do manual flushing so will work correctly here too. You can see what `stdbuf` is actually doing by running: env -i `command -v stdbuf` -oL -eL `command -v env`
• chrsw 2y ago
  I've run into this buffering issue on Unix before and it had me scratching my head for a while. Caution: not all 'awk' implementations behave the same with respect to buffering.
• NelsonMinar 2y ago
  I've been doing Unix for 35+ years and have never fully understood how this works. I appreciate the holistic description here, talking about buffering behaviors across a bunch of different systems and components. I definitely learned something from it.
• m00x 2y ago
  Because it's not a truck that you can just dump things on, it's a series of tubes.
• wyuenho 2y ago
  An equally important but opposite problem with pipes getting stuck is pipes getting broken because some commands at the front of the pipe expects buffering down the pipe. Some years ago I was scratching my head trying to figure out why curl ... | grep -q was giving me a "Failed write body error". I knew "grep -q" would close stdin and exit as soon as a match is found, and therefore I needed a buffer in front of grep but I was on a Mac, which to this day still doesn't come with "sponge" (or stdbuf and unbuffer for that matter), so I had to find a cross-platform command that does a little buffering but not too much, and could handle stdout being closed. So I settled on: curl ... | uniq | grep -q To this day people are still confused why there's not a "sort" in front of uniq and the comment about this cross-platform buffer thing I put in the script.
• worksonmymach 2y ago
  Lol I just realized this problem hit me. I did a docker --follow | grep and got nothing. Then found the data in the docker logs later. Assumed it was a brainfart and as I was demoing something didn't investigate just brushed over it. Thanks jvns!
• deleted 2y ago
  [deleted]
• gigatexal 2y ago
  Julia’s blog is one of the hall of fame blogs. I aspire to share content so enriching one day on my own piece of the internet.
• xorcist 2y ago
  When you think about it, this behaviour makes sense. How else would you implement it? I/O is always block oriented. The reason you don't always notice is that UNIX is so dearly line-based that every layer of the software stack goes to enormous pain to buffer everything to make interactive use convenient. (The article then talks about different types of buffering, but that is not important to the point being made.) So we are on top of a large pile of optimizations the even make "grep | grep | grep" possible, but we are so spoiled we don't even notice until the pile of abstractions runs too deep and the optimizations doesn't work anymore! In this specific case, it is however a strange thing to do. Why would you want to start two processes in order to search for two words? Each with its own memory management, scheduling, buffering etc.? Even if the buffering can be turned off, the other overhead will be noticeable. If you wanted to search for ten words, would you start ten separate grep processes, each responsible for their own word? No, you would ask grep to search for lines containing these both these two words in any order, like so: grep 'thing1.*thing2\|thing2.*thing1' This is probably what the article alludes to in the "grep -E" example (the -E is there in order to not have to escape the pipe character), but the author forgot to write the whole argument so the example is wrong. It would be practical to have a special syntax for "these things, in any order" in grep, but sadly that's one of the things missing from original grep. This makes it unnecessarily difficult to construct the argument programmatically with a script. This was one of the things Perl solved with lookahead and lookbehind buffers, you can use these to look ahead from the start of the line to see if all words are present: grep -P '^(?=.*?thing1)(?=.*?thing2)' This syntax is hard to read and understand, but it's the least bad when needed. (Related: How to search for any one of several words? That's much easier because each match is independent of each other, just give grep several expressions: grep -e 'thing1' -e 'thing2' which has none of the above problems.)
• lincpa 2y ago
  [dead]
• deleted 2y ago
  [deleted]