strace

strace is a powerful diagnostic tool used to trace system calls and signals made by a process. It allows users to monitor the behavior of an application and diagnose issues related to system calls, file I/O, network communication, and other low-level operations. The strace command can be used to analyze and optimize the performance of applications, debug errors, and troubleshoot system-level issues.

Basic Syntax

strace [options] process [arguments]

Here, process specifies the name of the command or process to be traced, and arguments specify the arguments passed to the command. If no options are specified, strace prints a summary of system calls made by the command and its child processes.

Commonly Used Options

• -p pid: This attaches strace to an already running process specified by pid.
• -e trace=set: This specifies the system calls to trace. For example, -e trace=file traces only file-related system calls.
• -f: This follows child processes and traces their system calls as well.
• -o file: This directs the output of strace to the specified file instead of standard error.
• -s size: This sets the maximum string size that strace prints. The default value is 32 bytes.
• -t: This prefixes each line of the output with the time elapsed since the start of the trace.

Useful Examples

• strace ls: This traces the system calls made by the ls command.
• strace -p 1234: This attaches strace to the process with PID 1234 and traces its system calls.
• strace -e trace=file ls: This traces only file-related system calls made by the ls command.
• strace -f command: This follows child processes and traces their system calls as well.
• strace -o output.txt command: This directs the output of strace to the file output.txt.
• strace -s 64 command: This sets the maximum string size that strace prints to 64 bytes.
• strace -t command: This prefixes each line of the output with the time elapsed since the start of the trace.