πŸ— Wiki

strace

strace

strace traces system calls. It is very useful to see how the software work or which point it crash, and even to track why the software is so slow.

1. Useful Options

  • -p <PID> option to attach

  • -t option to print timestamp.

  • -o <path/filename> option to write a report.

  • -k option to obtain stack trace between each syscall.

    This option was introduced in the release of strace v4.10. And it has to be built with libunwind library.

2. Example

Very simple usage:

$ strace /bin/cat /etc/os-release

Attaching running process with -p option:

$ strace -p 12345

You can see strings of the output are truncated. That’s why -s is needed. Default value of it is 32, only 32 chracters will be shown without -s option.

$ strace -s 128 /bin/cat /etc/os-release

If you want to see some syscalls, you can use -e option.

$ strace -e trace=open,read,write,close /bin/cat /etc/os-release

If you just want to filter out some system calls, I’d rather use grep. But the outputs are written in stderr, not stdout. You should redirect stderr to stdout so that can use grep command.

$ strace /bin/cat /etc/os-release 2>&1 | grep -v futex  # '-v' option to filter out.
$ strace /bin/cat /etc/os-release 2>&1 | grep -v futex | grep -v poll

3. See Also