The Linux strace
command is a powerful tool that is used to trace the system calls and signals of a program. It can be used to troubleshoot problems with a program, or to monitor the behavior of a program as it runs.
To use the strace
command, simply type strace
followed by the name of the program that you want to trace. For example, to trace the ls
command, you would use the following command:
$ strace ls
execve("/bin/ls", ["ls"], 0x7ffe9cb2e3f8 /* 44 vars */) = 0
brk(NULL) = 0x55f5bf42f000
...
This will execute the ls
command and display a detailed trace of the system calls and signals that are made by the ls
command as it runs. The output of the strace
command can be quite verbose, and it may include a large number of lines, depending on the complexity of the program being traced.
The strace
command has a number of options that can be used to control its behavior and the information that is displayed. For example, the -c
option can be used to summarize the output, displaying a summary of the system calls that were made by the program and the time that was spent in each system call.
For example, to summarize the output of the strace
command for the ls
command, you could use the following command:
$ strace -c ls
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
0.00 0.000000 0 1 read
0.00 0.000000 0 1 write
0.00 0.000000 0 2
The strace
command also has options that allow you to filter the output to display only specific types of system calls. For example, the -e
option can be used to specify a comma-separated list of system call names or patterns to trace.
For example, to trace only the open
and close
system calls made by the ls
command, you could use the following command:
$ strace -e open,close ls
...
openat(AT_FDCWD, ".", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
getdents(3, /* 8 entries */, 32768) = 200
getdents(3, /* 0 entries */, 32768) = 0
close(3) = 0
...
This will display only the open
and close
system calls made by the ls
command, which can be useful for understanding the specific operations that the command is performing on files and directories.
In addition to tracing system calls, the strace
command can also be used to trace signals that are sent to a program. To trace signals, you use the -f
option to trace child processes as they are created, and the -s
option to specify the maximum size of the strings that are displayed in the output.
For example, to trace signals for the ls
command, you could use the following command:
$ strace -f -s 128 ls
...
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, {sa_handler