shellsnoop captures the text input and output from shells running on the 
system. In the following example shellsnoop was run in one window, while
in another several commands were run: date, cal, uname -a, uptime and find.
shellsnoop has successfully captured the text that was displayed on the
other window.


# shellsnoop
  PID  PPID      CMD DIR  TEXT
 4724  3762      ksh   R
 4724  3762      ksh   W  date

 4741  4724     date   W  Sun Mar 28 23:10:06 EST 2004
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  cal

 4742  4724      cal   W     March 2004
 4742  4724      cal   W   S  M Tu  W Th  F  S
 4742  4724      cal   W      1  2  3  4  5  6
 4742  4724      cal   W   7  8  9 10 11 12 13
 4742  4724      cal   W  14 15 16 17 18 19 20
 4742  4724      cal   W  21 22 23 24 25 26 27
 4742  4724      cal   W  28 29 30 31
 4742  4724      cal   W
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  uname -a

 4743  4724    uname   W  SunOS jupiter 5.10 s10_51 i86pc i386 i86pc
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  uptime

 4744  4724   uptime   W   11:10pm  up 4 day(s), 11:15,  4 users,  load average: 0.05, 0.02, 0.02
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  ls -l d*

 4745  4724       ls   W  -rwxr--r--   3 root     sys         1292 Jan 14 16:24 devfsadm
 4745  4724       ls   W  -rwxr--r--   1 root     sys          904 Jan 14 16:24 devlinks
 4745  4724       ls   W  -rwxr--r--   6 root     sys          621 Jan 14 16:17 dhcp
 4745  4724       ls   W  -rwxr--r--   2 root     sys          494 Jan 14 16:17 dhcpagent
 4745  4724       ls   W  -rwxr--r--   5 root     sys         1050 Jan 16  2002 directory
 4745  4724       ls   W  -rwxr--r--   2 root     sys          779 Jan 14 16:17 domainname
 4745  4724       ls   W  -rwxr--r--   1 root     sys          469 Jan 14 16:24 drvconfig
 4745  4724       ls   W  -r-xr-xr-x   4 root     other       2804 Mar 27 13:37 dtlogin
 4724  3762      ksh   R
 4724  3762      ksh   W  jupiter:/etc/init.d>
 4724  3762      ksh   R
 4724  3762      ksh   R
 4724  3762      ksh   W  find /etc/default

 4746  4724     find   W  /etc/default
 4746  4724     find   W  /etc/default/cron
 4746  4724     find   W  /etc/default/devfsadm
 4746  4724     find   W  /etc/default/dhcpagent
 4746  4724     find   W  /etc/default/fs
 4746  4724     find   W  /etc/default/inetd
 4746  4724     find   W  /etc/default/inetinit
 4746  4724     find   W  /etc/default/kbd
 4746  4724     find   W  /etc/default/keyserv
 4746  4724     find   W  /etc/default/ipsec
 4746  4724     find   W  /etc/default/nss
 4746  4724     find   W  /etc/default/passwd
 4746  4724     find   W  /etc/default/syslogd
 4746  4724     find   W  /etc/default/tar
 4746  4724     find   W  /etc/default/utmpd
 4746  4724     find   W  /etc/default/init
 4746  4724     find   W  /etc/default/login
 4746  4724     find   W  /etc/default/su
 4746  4724     find   W  /etc/default/power
 4746  4724     find   W  /etc/default/sys-suspend
 4746  4724     find   W  /etc/default/rpc.nisd
 4746  4724     find   W  /etc/default/nfs
[...]



shellsnoop has a "-q" option for running in "quiet" mode - the previous 
columns are not printed, so only shell output is seen,

   # shellsnoop -q
   # date
   Wed Nov 30 16:19:48 EST 2005
   #
   # cal
      November 2005
    S  M Tu  W Th  F  S
          1  2  3  4  5
    6  7  8  9 10 11 12
   13 14 15 16 17 18 19
   20 21 22 23 24 25 26
   27 28 29 30
   
   #

The output appears somewhat boring, this is something you need to see
in realtime.

