Display monitor output while appending it to audit.log.
Keep the existing audit.log contents.
Which command is appropriate?
tee -a appends its input to the file while still copying the same input to standard output.
Detailed explanation
monitor | tee audit.logIncorrect. tee without -a overwrites audit.log.
Incorrect. tee without -a overwrites audit.log.
monitor > audit.logIncorrect. > saves output but does not display a copy on the terminal.
Incorrect. > saves output but does not display a copy on the terminal.
monitor | tee -a audit.logCorrect. tee -a preserves the existing file and displays the stream.
Correct. tee -a preserves the existing file and displays the stream.
monitor | tee -i audit.logIncorrect. -i concerns interrupts and does not select append mode.
Incorrect. -i concerns interrupts and does not select append mode.
Try it yourself
An example you can run in a temporary verification environment.
tmp=$(mktemp); printf 'old\n' >"$tmp"; printf 'new\n' | tee -a "$tmp" >/dev/null; cat "$tmp"; rm -f "$tmp"Expected result
old
newKey points
- -a means append
- tee without -a overwrites
- stdout remains visible
Notes
- Environment: GNU coreutils 9.x / 一時ファイル
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.