Questions tagged [strace]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
12 votes
1 answer
7k views

Will strace watch system calls recursively on child processes of the main process being observed?

If I run strace on a program and that program spawns a subprocess (e.g. perl's system() call), will strace report the system calls for the child process as well?
Ross Rogers's user avatar
  • 4,517
8 votes
6 answers
5k views

Linux equivalent to Mac OS X's fs_usage

Is there a Linux equivalent to the Mac OS X command fs_usage? According to the man page it does the following: "report system calls and page faults related to filesystem activity in real-time". I ...
Khai's user avatar
  • 156
7 votes
2 answers
21k views

Debugging connection timeouts using strace?

I'm trying to figure out why is Eclipse spinning, so I decided to fire up strace. I found the eclipse process using: $ ps ax | grep java 5546 ? Sl 19:04 /usr/bin/java ... [arguments ...
jabalsad's user avatar
  • 1,477
6 votes
1 answer
4k views

Why strace sudo command bombs when sudo command works?

my username is allowed to execute sudo command then why does this bomb strace sudo command with the error: sudo: must be setuid root
user322908's user avatar
6 votes
0 answers
9k views

What’s the command line equivalent of strace on Windows?

I need to | findstr SomePATH in order to search if a program access and close immediately a specific path. On Linux, I would use myprogram | strace 2>&1 | grep SomPATH. But what’s the ...
user2284570's user avatar
  • 1,823
4 votes
1 answer
2k views

What is a SIG_0 when looking at an strace

Attaching strace to a process that is using a lot of cpu, shows that the pid is 'killed' over and over. The process is using 130% cpu. What is a tgkill( SIG_0) ? strace -p 3876 nanosleep({0, ...
spuder's user avatar
  • 9,945
4 votes
3 answers
6k views

Interfacing strace with Process Name instead of PID

How do I implement a wrapper script pstrace in bash that changes the interface of [sudo] strace -c -p [PID] to [sudo] pstrace -c -p [PROCESS-NAME] similar to how killall [PROCESS-NAME] is used. ...
Nordlöw's user avatar
  • 197
4 votes
1 answer
3k views

What can trigger a SIGPWR signal that interrupts a 'sendmsg' system call?

On a RHEL 6 host, I have a Cassandra server listening for TCP connections on localhost. In parallel, I have a client application that sends it requests. The client (C# Mono) uses sendmsg to send the ...
Sotirios Delimanolis's user avatar
4 votes
2 answers
3k views

How do I strace the whole system?

strace allows you to monitor the activity of a particular program. How can I monitor the activity of all programs (expect for sshd/bash/strace_itself)? Currently I'm using a hack like this: function ...
Vi.'s user avatar
  • 17.2k
4 votes
0 answers
902 views

Understanding the strace output on a mac [closed]

I am seeing syscalls that I do not understand. Multiple calls ending with _nocancel. E.g. open_nocancel, close_nocancel. What are these calls and where do I find information about these? Google does ...
user220201's user avatar
4 votes
1 answer
1k views

Why do strace/truss sometimes 'fix' stuck processes?

Sometimes you have a stuck process that's been stuck for a while, and as soon as you go to poke at it with strace/truss just to see what's going on, it gets magically unstuck and continues to run! So ...
Emmel's user avatar
  • 351
3 votes
1 answer
2k views

Is it possible to strace pinging a host?

I am doing this $ strace -f ping -s 1 www.google.com execve("/bin/ping", ["ping", "-s", "1", "www.google.com"], [/* 80 vars */]) = 0 getuid() = 1001 setuid(1001) ...
socgen hacker's user avatar
3 votes
1 answer
1k views

docker version hangs before server info

Introduction I'm attempting to use the following version of docker on a Linux VM (uname -a returns Linux xen 4.1.17-yocto-standard #1 SMP PREEMPT Thu Jun 2 13:29:47 PDT 2016 x86_64 GNU/Linux), built ...
karobar's user avatar
  • 247
2 votes
2 answers
3k views

How does 'strace' work?

Recently, I was using mv to move a large amount of files from my hard drive to a flash drive. I forgot to add a verbose flag so I had no idea "where" the move was at and how many transfers remained. ...
nopcorn's user avatar
  • 16.7k
2 votes
1 answer
1k views

ntfs disk dying or..? rsync and mkdir failing, strange behavior

System root@host:~# uname -a Linux host 3.2.0-4-686-pae #1 SMP Debian 3.2.57-3+deb7u1 i686 GNU/Linux Mounts root@host:~# mount | tail -2 /dev/sda1 on /mnt/sda1 type ntfs (rw,relatime,uid=1000,gid=...
174140's user avatar
  • 94
2 votes
1 answer
4k views

How to properly unescape strace output

How do I unescape strings outputted by strace? I see some advices to use printf '%b' for that, but that doesn't work correctly for me in some cases. Consider echo -ne '\037\061': $ strace -e write ...
torvin's user avatar
  • 135
2 votes
1 answer
1k views

How to calculate and group the time differences of specified syscalls when running strace

I'm planing to do some web performance testing (to see how much time it's spent for each file), but it could be useful for any application. I exactly know existence and how to use different ...
kenorb's user avatar
  • 25.4k
2 votes
1 answer
191 views

why doesn't strace use test syscalls to find out their indices in the system call table?

I understand that strace command uses ptrace(PTRACE_PEEKUSER, child, __builtin_offsetof(struct user, regs.orig_eax)) to find the index of a system call the tracee child is trapped at. Then to ...
user322908's user avatar
2 votes
1 answer
588 views

why doesn't strace work on gcc -c

>echo > foobar.c >strace gcc -c foobar.c 2>&1 | grep foobar.o > (nothing) - foobar.o is being written obviously, but I don't see it on strace. Why?
user461984's user avatar
2 votes
1 answer
2k views

how to collect all files, that are opened by linux application

I want to collect a list of all files, that are opened by an application (in my case, it's a s/w bulder). 'strace -f' fails, because it mixes continuos opening from different forks, for example: ...
Sergey's user avatar
  • 21
2 votes
0 answers
1k views

How to find out the reason why ssh processes are hanging?

When i run command like iostat -dkx 2 2 via ssh, I get the expected result, but the processes on the local computer are saying alive in status "interruptible sleep". Why is this happening? Is there a ...
Ivan Denisovich's user avatar
1 vote
1 answer
7k views

Strange strace and setuid behaviour: permission denied under strace, but not running normally

This is related to this question. I have a script (fix-permissions.sh) that fixes some file permissions: #! /bin/bash sudo chown -R person:group /path/ sudo chmod -R g+rw /path/ And a small c ...
James's user avatar
  • 290
1 vote
1 answer
529 views

strace to discover sudo password persistence location

strace/dtrace/ltrace ... useful for lots of things, from finding hidden access violations to network socket tracing, but maybe it can't see all. I haven't been able to figure out using strace (it ...
ǝɲǝɲbρɯͽ's user avatar
1 vote
1 answer
2k views

Correlating strace output to source code function calls

I'm trying to fix a keyboard problem in a Linux application which I have the source code for. The application starts a TCP server and sends local keyboard and mouse events to connected clients. What's ...
joe's user avatar
  • 33
1 vote
1 answer
733 views

Tracing syscalls

I am trying to learn some tricks using "trace" (or dtrace or strace or truss), so I using the command: trace -d [random PID] I am getting the following error messages: trace error: trace facility ...
ddmichael's user avatar
  • 357
1 vote
1 answer
830 views

ping: Name or service not known

Problem ping: service.sys-dev.company.com: Name or service not known host, nslookup and dig works # host service.sys-dev.company.com traefik-proxy.ingresscontrollers.svc.cluster.local has address 10....
Neurobion's user avatar
1 vote
0 answers
24 views

trace all file opens of executable with command line on macos

(related to How to find all the files that a program opens/read/write? , but unfortunately the answers are obsolete. it seems that security and multicore concerns have been mucking around with the ...
ivo Welch's user avatar
  • 170
1 vote
1 answer
3k views

Why does sudo fail with strace?

I can run this command without issue. /tmp $ sudo echo "hello world" hello world However, this command fails: /tmp $ strace -o /tmp/out.log sudo echo "hello world" sudo: effective ...
ddoxey's user avatar
  • 111
1 vote
0 answers
121 views

Why accept4() is slow with Apache?

I am running a website on Apache2 and I noticed that the first bit is always slow to come. I tried to diagnose the problem with strace and found that accept4() is slow on each request. Below the ...
devPsycho's user avatar
1 vote
1 answer
284 views

Intercept environment variables read by a process

I have a process that’s reading some environment variables to set itself up, but I’m not sure which one. The programming language is foreign to me, so let’s supposed I don’t have the source. Is there ...
gurghet's user avatar
  • 117
1 vote
0 answers
121 views

Tool similar to `strace` but for CPU instructions

I am hoping to find something similar to strace which will yield the instructions used by the CPU. For example, I have a simple loop which calculates a sum and prints out every tenth iteration float ...
drjrm3's user avatar
  • 1,496
0 votes
0 answers
141 views

Why does strace change command behavior?

I'm trying to use PICpgm to program a Microchip connected via GPIO. I'm running Raspbian Buster on a Pi 4B. Running as root, this command returns with no error but it doesn't print anything useful. ...
Elliott B's user avatar
  • 1,195
0 votes
0 answers
289 views

Debugging slow cygwin bash startup

Running: strace bash -li and grepping for CreateProcessW: 182 590565 [main] bash 512 frok::parent: CreateProcessW (C:\cygwin64\bin\bash.exe, C:\cygwin64\bin\bash.exe, 0, 0, 1, 0x420, 0, 0, ...
levant pied's user avatar
0 votes
0 answers
796 views

2 java processing hanging for about 2.8s

I have 2 processes running on a VMWare server on the same vm. Centos 6.x I ran strace on both processes and saved the output 6970 14:04:09.643295 futex(0x7f47d8027754, FUTEX_WAKE_OP_PRIVATE, 1, 1, ...
Keyzer Suze's user avatar
0 votes
1 answer
212 views

Libreoffice is eating all cpu

On my debian box, LibreOffice (even while idle) is eating 100% of the CPU is runs on. I used strace and those 4 lines are constantly displayed as in a loop (as such I can tell which one comes first): ...
phep's user avatar
  • 101
0 votes
0 answers
762 views

dnsmasq; log querying process

I'm running dnsmasq in development and found that something on my laptop is putting forward queries for randomly generated domain names. Hence I'd like to display the PID/lsof -p output of the process ...
Henrik's user avatar
  • 181
0 votes
1 answer
339 views

make strace print EUID

I'm trying to debug a permission problem, but I'm having trouble finding out with which EUID the application is being executed at the moment of the error. Is there a way to make strace print the ...
Martin Kunev's user avatar
0 votes
1 answer
122 views

Is it secure to send strace log to third-party person?

I have some specific software - a console to access remote equipment. At some time it's UI starts to slow down too much (not because lack of resources but because some bug in that program). Developer ...
user334's user avatar
0 votes
1 answer
210 views

strace reports incorrect relative path?

I am using strace to report open and chdir system calls, and a fragment of its output is: 6791 chdir("//etc") = 0 6791 open("etc/fstab", O_RDONLY) = 3 This doesn't make ...
user461984's user avatar
0 votes
1 answer
83 views

dtruss SQL-Queries on Mac OSX

In our shop we have an inhomogenous environment and doing Java on different boxes - mostly Mac OSX, me on Linux and one Windows box. When it comes to debugging JPQL-Queries and its SQL-outcome, there ...
Thomas Junk's user avatar
0 votes
0 answers
36 views

Assistance remembering the name of a Linux “strace”-based tool for file paths mocking

Once surfing the Internet I’ve seen a home page for a Linux tool which claims it can employ Linux systrace interface to execute other programs with manipulated paths. Something like that: $ this-...
firegurafiku's user avatar