redirection

Overview

Where does a command's output go, and where does its input come from? Redirection lets you control this — sending output to files, reading input from files, and separating normal output from errors. This lesson explains redirection and the standard streams.

Learning objectives

• Identify the three standard streams (stdin, stdout, stderr).
• Use redirection operators to control input and output.
• Separate and combine output and error streams.

Core concept

Every process has three standard streams:

• stdin (0) — standard input (default: keyboard).
• stdout (1) — standard output (default: terminal).
• stderr (2) — standard error, for error messages (default: terminal).

Redirection operators reroute these:

• > — send stdout to a file (overwrite).
• >> — send stdout to a file (append).
• < — take stdin from a file.
• 2> — redirect stderr; 2>&1 — merge stderr into stdout.

How it works

command > file writes the command's normal output to file, replacing its contents; >> adds to the end instead. command < file feeds file as the command's input. Errors travel on a separate stream (stderr), so command > out.txt still shows errors on screen; use 2> err.txt to capture them separately, or > all.txt 2>&1 to combine both into one file. Understanding that stdout and stderr are distinct is key to capturing exactly what you want.

Practical example

$ ls /etc /nonexistent > out.txt 2> err.txt
$ cat out.txt          # the successful listing of /etc
$ cat err.txt          # the error about /nonexistent

Normal output went to out.txt, the error message to err.txt. Alternatively, ls /etc /nonexistent > all.txt 2>&1 would put both into one file, and command > /dev/null 2>&1 would discard all output entirely.

Cybersecurity relevance

Redirection is everywhere in scripting and analysis: saving tool output to files for later review, logging a script's activity, and separating errors from results all rely on it. Capturing both streams (2>&1) ensures you do not miss error output when reviewing results (e.g. from a scan or a batch job in authorized testing). Redirecting to /dev/null is common to silence noise, but be careful not to discard output you actually need for evidence.

Common mistakes

• Using > when you meant >>, overwriting a file instead of appending.
• Forgetting errors go to stderr, so > alone does not capture them.
• Overwriting important files with > — the redirect truncates the target immediately.

Key takeaways

• Processes have three streams: stdin (0), stdout (1), stderr (2).
• Redirect with > (overwrite stdout), >> (append), < (input from file), 2> (stderr), and 2>&1 (merge stderr into stdout).
• Redirection underpins saving tool output, logging, and separating errors from results; capture both streams when you need complete records.

Check your understanding

• What is the difference between > and >>, and between stdout and stderr?
• How would you capture both a command's normal output and its error messages into the same file?