I'm trying to fix a keyboard problem in a Linux application which I have the source code for. The application starts a TCP server and sends local keyboard and mouse events to connected clients. What's the best way to interrogate the running server process to find out which source-code functions it's using to trap the keystrokes? Will the strace utility work for this in some way? Using the -c flag with strace shows system calls the application is making, but not sure how to trace that back to the source file functions.

1 Answer 1


The strace utility shows you system calls. Most compiled programs in Linux eventually link with the standard C library, referred to as "glibc" though the actual library file name is libc.so.6. C language "system calls" such as "open", "read", "write" are in fact wrapper functions for the actual system calls that the glibc library executes. Sometimes the wrappers include a surprising amount of code that you usually don'y think about. Sometimes programmers use libraries with functions that make multiple glibc calls that do multiple system calls. Furthermore, if you see a specific "read" in the strace output, you don't have any way of connecting it with a specific "read" or other library function call in the source code. The result of this is that there is no general way to correlate strace output with specific lines of code in a source file.

I assume that when you state that you have the source code you mean that you can also compile it into a functioning executable program. If this is indeed the case, then your best bet is to instrument the code with printfs followed with fflush(stdout) and then run the program under strace. For the printfs you can try somethng like

printf(__FILE__ ", %s:%d Entered\n", __FUNCTION__, __LINE__), fflush(stdout);

at the start of every C function. You can define the above line as a preprocessor marcro that is conditionally defined as the above or as nothing, depending on another macro such as DEBUG, so that you can leave these macros in your code base and compile the code with or without DEBUG defined.

You will see the printf "write" system calls and their output interspersed among the system call that are reading the keystrokes. This should allow you to zero in on the source code functions that are reading the tty input. It might require some persistent effort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.