Redirecting/grep’ing an existing shell’s STDOUT

If all you want to do is spy on the existing process, you can use strace -p1234 -s9999 -e write where 1234 is the process ID. (-s9999 avoids having strings truncated to 32 characters, and write the system call that produces output.) If you want to view only data written on a particular file descriptor, you can use something like strace -p1234 -e trace= -e write=3 to see only data written to file descriptor 3 (-e trace= prevents the system calls from being loged). That won't give you output that's already been produced.

If the output is scrolling by too fast, you can pipe it into a pager such as less, or send it to a file with strace -o trace.log ….

With many programs, you can divert subsequent output with a ptrace hack, either to your current terminal or to a new screen session. See How can I disown a running process and associate it to a new screen shell? and other linked threads.

Note that depending on how your system is set up, you may need to run all these strace commands as root even if the process is running under your user with no extra privileges. (If the process is running as a different user or is setuid or setgid, you will need to run strace as root.) Most distributions only allow a process to trace its children (this provides a moderate security benefit — it prevents some direct malware injection, but doesn't prevent indirect injection by modifying files). This is controlled by the kernel.yama.ptrace_scome sysctl.

Yes, exactly that can happen if lines to stdout are long enough.

#!/usr/bin/perl
use strict;
use warnings;

for (1..10) {
    print "START"; print "-" x 100000; print "END\n";
    warn "!\n";
}

Running:

./writer.pl > out 2>&1

Checking: Open file out in an editor and find stderr ! in between -, not always between END and START

This will vary between OS:s, languages and systems in various ways, but your basic assumption is correct. Experiment by varying length of stdout-lines: print "-" x 100, print "-" x 10000 etc.