Novell LINUX ENTERPRISE SERVER 10 SP2 - INSTALLATION AND ADMINISTRATION Installation Manual page 347

17.1.3 System Calls of a Program Run: strace
The utility strace enables you to trace all the system calls of a process currently
running. Enter the command in the normal way, adding strace at the beginning of
the line:
tux@mercury:~> strace ls
execve("/bin/ls", ["ls"], [/* 61 vars */]) = 0
uname({sys="Linux", node="mercury", ...}) = 0
brk(0)
access("/etc/ld.so.preload", R_OK)
directory)
open("/etc/ld.so.cache", O_RDONLY)
fstat64(3, {st_mode=S_IFREG|0644, st_size=89696, ...}) = 0
mmap2(NULL, 89696, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7ef2000
close(3)
open("/lib/librt.so.1", O_RDONLY)
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\36\0"..., 512) \
= 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=36659, ...}) = 0
[...]
stat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) \
= 0xb7ca7000
write(1, "bin Desktop
\ music Music
) = 55
close(1)
munmap(0xb7ca7000, 4096)
exit_group(0)
For example, to trace all attempts to open a particular file, use the following:
tux@mercury:~> strace -e open ls .bashrc
open("/etc/ld.so.cache", O_RDONLY)
open("/lib/librt.so.1", O_RDONLY)
open("/lib/libacl.so.1", O_RDONLY)
open("/lib/libc.so.6", O_RDONLY)
open("/lib/libpthread.so.0", O_RDONLY)
open("/lib/libattr.so.1", O_RDONLY)
[...]
To trace all the child processes, use the parameter -f. The behavior and output format
of strace can be largely controlled. For information, see man strace.
= 0x805c000
= -1 ENOENT (No such file or \
= 3
= 0
= 3
Documents music\tM"..., 55bin
public_html tmp
= 0
= 0
= ?
= 3
= 3
= 3
= 3
= 3
= 3
Desktop Documents \
System Monitoring Utilities 329