EMZETT.
Login

Emzett Wiki

strace: Watching a program's system calls

Properties1
tagsglossar, linux, debugging

2 min read

strace: Watching a program’s system calls

In short: A tool that shows which requests a program makes to the operating system kernel, such as opening files, establishing network connections or requesting memory.

In more detail: Programs can use files, network and processes only through system calls (syscalls). strace attaches to a program and lists each of these calls with parameters and result. So you see what a program really does, even without source code, and why, for example, it aborts with “file not found”.

In Depth

Usage

strace ls /nothing                 # start a program under observation
strace -p 1234                     # attach to a running process
strace -f -o trace.txt ./program   # also child processes, output to file
strace -e trace=openat,read ls     # only certain calls
strace -c ./program                # summary: frequency and time
strace -tt -T ...                  # with timestamp and duration

Output example: openat(AT_FDCWD, "/etc/app.conf", O_RDONLY) = -1 ENOENT (No such file or directory). The program looks for a configuration file that is missing.

Typical cases

  • “Why does the program not find its configuration?” Look at paths in openat/stat.
  • Program hangs: the last line shows what it is waiting for (read on a socket, futex, poll).
  • Slow: -c and -T show calls that take long.
  • Permission errors: EACCES with the path concerned.
  • Network: connect calls with destination address and port.

ltrace shows calls into libraries, lsof the open files, perf and eBPF tools (bpftrace, perf trace) observe system calls with far less overhead. On macOS dtruss corresponds, on Windows Sysinternals’ Process Monitor.

Limits

strace slows the program noticeably because every system call is stopped, and is unsuitable for continuous production use. To attach to other people’s processes you need rights (root or the same user and ptrace permission). The output often contains passwords and data arising from call parameters, so do not pass it on carelessly.

See also: Debuggers and core dumps, Profiling and flame graphs, eBPF in the Linux kernel, Processes and signals