Strace - Revision history

Christoph: /* Example usage */

2016-02-18T21:12:17Z

‎Example usage

Christoph: /* Example usage */

2016-02-18T21:07:40Z

‎Example usage

Christoph: /* See also */

2015-08-28T22:48:28Z

‎See also

Christoph: /* See also */

2015-08-28T22:41:16Z

‎See also

Christoph: /* Example usage */

2015-08-28T22:25:34Z

‎Example usage

Christoph: New page: '''`strace`''' is a diagnostic, debugging, and instructional userspace utility for Linux. It is used to monitor interactions between processes and the Linux kernel, which includ...

2015-08-28T21:49:36Z

New page: '''<tt>strace</tt>''' is a diagnostic, debugging, and instructional userspace utility for Linux. It is used to monitor interactions between processes and the Linux kernel, which includ...

New page

'''<tt>strace</tt>''' is a diagnostic, debugging, and instructional userspace utility for [[Linux]]. It is used to monitor interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state. The operation of <code>strace(1)</code> is made possible by the kernel feature known as <code>ptrace</code>.

<code>strace(1)</code> is an indispensable tool for any Linux Systems Administrator. [[Christoph Champ|I]] use it on a daily basis at work.

The most common usage is to start a program using <code>strace(1)</code>, which prints a list of system calls made by the program. This is useful if the program continually crashes, or does not behave as expected; for example using <code>strace(1)</code> may reveal that the program is attempting to access a file which does not exist or cannot be read.

An alternative application is to use the "<code>-p</code>" flag to attach to a running process. This is useful if a process has stopped responding, and might reveal, for example, that the process is blocking whilst attempting to make a network connection.

As <code>strace(1)</code> only details system calls, it cannot be used to detect as many problems as a code debugger such as [[GNU Debugger]] (gdb). It is, however, easier to use than a code debugger, and is an extremely useful tool for system administrators.

==Example usage==

* Simple call:
$ strace ls

* View the 'open' systems calls made by <code>`ls`</code>:
$ strace -e open ls
<pre>
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libacl.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libattr.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/proc/filesystems", O_RDONLY) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
foo bar baz
+++ exited with 0 +++
</pre>

* Save the 'open' and 'read' system calls made by a process (with PID=14889) to a file:
$ strace -e trace=open,read -p 14889 -o /tmp/strace.14889

* View the 'open' system calls made by a program called "<code>vpnc</code>" (<code>strace(1)</code> = window into program functionality):
$ strace -e open vpnc
#~OR~
$ strace -e open -p `pidof vpnc`

* Hook into STDOUT and STDERR of a running process:
$ strace -p <PID> -e trace=write -e write=1,2

* [[Redirection (Linux)#Swapping STDOUT and STDERR using file descriptors|Swapping STDOUT and STDERR using file descriptors]]

==See also==
* [[Lsof]]
* <code>ltrace(1), time(1), ptrace(2), proc(5)</code>

==External links==
* [http://sourceforge.net/projects/strace/ Project homepage]

[[Category:Linux Command Line Tools]]

@@ Line 14: / Line 14: @@
   $ strace ls
-Most <code>strace(1)</code> outputs will produce a lot of system function call (e.g., <code>open(), read(), write(), close(), etc.). One can specify which of (or filter by) these system calls, as shown below.
+Most <code>strace(1)</code> outputs will produce a lot of system function call (e.g., <code>open()</code>, <code>read()</code>, <code>write()</code>, <code>close()</code>, etc.). One can specify which of (or filter by) these system calls, as shown below.
 * View the 'open' systems calls made by <code>`ls`</code>:

@@ Line 49: / Line 49: @@
   $ strace -e trace=open,read -p 14889 -o /tmp/strace.14889
-* View the 'open' system calls made by a program called "<code>vpnc</code>" (<code>strace(1)</code> = window into program functionality):
+* View the 'open' system calls made by a program called "<code>firefox</code>" (<code>strace(1)</code> = window into program functionality):
-  $ strace -e open vpnc
+  $ strace -e open firefox
   #~OR~
-  $ strace -e open -p `pidof vpnc`
+  $ strace -e open -p $(pidof firefox)
 * Hook into STDOUT and STDERR of a running process:

@@ Line 91: / Line 91: @@
 * <code>ltrace(1), time(1), ptrace(2), proc(5)</code>
 * [http://www.sysdig.org/ Sysdig]
 ==External links==

@@ Line 13: / Line 13: @@
 * Simple call:
   $ strace ls
 * View the 'open' systems calls made by <code>`ls`</code>:
@@ Line 29: / Line 31: @@
 +++ exited with 0 +++
 </pre>
 * Save the 'open' and 'read' system calls made by a process (with PID=14889) to a file:
@@ Line 40: / Line 56: @@
 * Hook into STDOUT and STDERR of a running process:
   $ strace -p <PID> -e trace=write -e write=1,2
 * [[Redirection (Linux)#Swapping STDOUT and STDERR using file descriptors|Swapping STDOUT and STDERR using file descriptors]]

Strace - Revision history

Christoph: /* Example usage */

Christoph: /* Example usage */

Christoph: /* See also */

Christoph: /* See also */

Christoph: /* Example usage */

Christoph: New page: '''strace''' is a diagnostic, debugging, and instructional userspace utility for Linux. It is used to monitor interactions between processes and the Linux kernel, which includ...

Christoph: New page: '''`strace`''' is a diagnostic, debugging, and instructional userspace utility for Linux. It is used to monitor interactions between processes and the Linux kernel, which includ...