Introduction to strace

There will come a time when you will find yourself asking “What the heck is that process doing?”. To uncover the mysteries behind the behaviour of a process, we have a tool called strace.

The program strace is very handy when you want to debug the execution of a program. It catches and states all the system calls performed called by a process. It will also catch and state any inter-process signals received by this process.

Let’s dive into some examples.

Trace the execution the simple straight-forward way to use it. The output might look something like:

The output looks a bit messy, but it can provide very useful information like which files does this program use, what is this program doing right now or why does this program not read the config file – does it even look for it?

Attach to an existing process

You can run strace on a process that’s already running. Use -p, and provide the Process ID (PID):

The output presented to you is similar to the example above. Notice that you can only trace a process you have access rights to. Multiple -p options will also trace these processes with a limit of 32 processes that strace can attach to.

Trace child processes

Use -f to trace child processes as they are created by currently traced processes. This is useful for debugging a program that spawns children. strace will prepend the pid of the traced process output:

Trace specific system calls

The e-flag, along with the call open, displays only open system calls of the ls command, which outputs something along these lines:

With the above example, close to the end, you can see two things – ghost and, a folder and file, which is the actual output of the command ls.

A few of the options available after -e trace= are:

  • open
  • close
  • read
  • write

Trace multiple system calls

What if you want to trace multiple system calls in one command though? The option -e trace= can take a comma separated set of systemcalls as argument:

Which outputs:

Write output to file

If you’d like to write the output of strace to a file, add a -o:

When you print the contents of ls.txt, you’ll see that it contains only the output from strace, and not from the command ls:

Add a timestamp

If you add a -t to the command, you’ll be able to add a timestamp to each printed line. You can add up to 3 -t‘s. The more you add, the more verbose and detailed the timestamp will be.

One -t shows you seconds:

Adding a second -t will display microseconds:

A third -t will include the microseconds and the leading portion will be printed as the number of seconds since the epoch.

Print relative timestamp

If you’d like to find out the execution time of each call, -r will certainly do the trick:

A summary of system calls

Would you like to have a summary of calls, time, and errors for each system call? -c does this:

This option is very useful when trying to find out why a program is running slow.

6 thoughts on “Introduction to strace

  1. Pingback: From my reading list. November 2016 | Блоги экспертов

  2. Pingback: cron.weekly issue #57: PHP 7.1, Crypto, NTP, runv, Multibinder, Grafana, FPM & more!

  3. Pingback: DevOpsLinks #36 Free cryptography Courses, Learning Iptables By Examples & Serverless Computing – DevOpsLinks

  4. Pingback: Introduction to strace | The Road to Elysium | Ausfestivus's Blog

Leave a Reply

Your email address will not be published. Required fields are marked *