TRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [ -dtTf ] [ -o filename ] [ -s strsize ] command

strace [ -dtTf ] [ -o filename ] [ -s strsize ] -p pid

DESCRIPTION

strace runs the specified command until it exits. It intercepts the system calls and signals of a process. The name of the system call, its arguments and result are listed on standard error or the file specified with the -o option.

Each line in the trace contains the system call name, followed by its arguments in parentheses and its result. Error returns (result = -1) have the error message appended. Signals are printed as a signal name. If possible, arguments are printed in symbolic form. Structure pointers are dereferenced and the fields are displayed as appropriate. Character pointers are dereferenced and printed as a quoted string. Non-printing characters in strings are represented by escape codes. Only the first strsize (32 by default) bytes of strings are printed; longer strings have two dots appended following the closing quote. On system call failure, structures or strings which would have carried results of the call are printed in hexadacimal format.

OPTIONS

-t  Prefix each line of the trace with the time of day. If the -t option is given twice, the time printed will be in microseconds.

-T  Show the time spent in system calls.

-d  Show some debugging output of strace itself on stderr.

-o filename
    Write the trace output to the file filename rather than to stderr.

-f  Trace child processes as they are created by currently traced processes as a result of the fork(2) system call. The new process is attached to as soon as its pid is known (through the return value of fork(2) in the parent process). This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the parent is scheduled again to complete its (v)fork(2) call. If the parent process decides to wait(2) for a child that is currently being traced, it is suspended until an appropriate child process either terminates or incurs a signal (with the exception of SIGCHLD, SIGSTOP, SIGCONT, SIGALRM). If the -o option is in effect, the child's trace is written to filename.pid.

-p pid
    Attach to the process with the process ID pid and begin tracing. The trace may be terminated at any time by a keyboard interrupt signal (CTRL-C); trace will respond by detaching itself from the traced process(es) leaving it to continue running.

EXAMPLES
bridei% strace -s 16 -f ldd /bin/ls
open("/usr/lib/ld.so", RDONLY, 4000000021) = 3
read(3, "\81\3\1\b\0\0\80\0\0\0 \0\0\0\0\0".., 32) = 32
smmap(0, 40960, READ|EXEC, PRIVATE, 3, 0) = 0xf77e0000
smmap(0xf77e8000, 8192, READ|WRITE|EXEC, PRIVATE|FIXED, 3, 0x8000) = 0xf77e8000
open("/dev/zero", RDONLY, 7) = 4
getrlimit(STACK, {cur: 8388608, max: 402653184}) = 0
smmap(0xf7800000, 8192, READ|WRITE, PRIVATE|FIXED, 4, 0) = 0xf7800000
close(3) = 0
getuid([euid 548]) = 548
getgid([egid 501]) = 501
open("/etc/ld.so.cache", RDONLY, 5000000021) = 3
fstat(3, [dev 7 0 ino 21 nlnks 1 ...]) = 0
smmap(0, 4096, READ, SHARED, 3, 0) = 0xf77c0000
close(3) = 0
open("/usr/lib/libc.so.1.6", RDONLY, 25424) = 3
read(3, "\81\3\1\b\0\6\c0\0\0\0@\0\0\0\0\0".., 32) = 32
smmap(0, 458764, READ|EXEC, PRIVATE, 3, 0) = 0xf7730000
smmap(0xf779c000, 16384, READ|WRITE|EXEC, PRIVATE|FIXED, 3, 0x6c000) = 0xf779c000
close(3) = 0
close(4) = 0
getpagesize(0) = 4096
brk(6560) = 0
brk(7560) = 0
open("/bin/ls", RDONLY, 666) = 3
read(3, "\81\3\1\8\0\0+\d8\0\0\8 \0\0\t\e8".., 32) = 32
close(3) = 0
fork( - Process 28611 attached
) = 28611
 [pid 28610]: wait4(0,
Process 28610 suspended
 [pid 28611]: execve("/bin/ls", , env: ["LD_TRACE_LOADED_OBJECTS=placehol"..""SHELL=/bin/csh""TERM=sun-cmd"]) = 0
 [pid 28611]: open("/usr/lib/ld.so", RDONLY, 5000000021) = 3
 [pid 28611]: read(3, "81310080         ".., 32) = 32
 [pid 28611]: smmap(0, 40960, READ|EXEC, PRIVATE, 3, 0) = 0xf77e0000
 [pid 28611]: smmap(0xf77e8000, 8192, READ|WRITE|EXEC, PRIVATE|FIXED, 3, 0x8000) = 0xf77e8000
 [pid 28611]: open("/dev/zero", RDONLY, 7) = 4
 [pid 28611]: getrlimit(STACK, {cur: 8388608, max: 402653184}) = 0
 [pid 28611]: smmap(0xf7800000, 8192, READ|WRITE, PRIVATE|FIXED, 4, 0) = 0xf7800000
 [pid 28611]: close(3) = 0
 [pid 28611]: getuid([euid 548]) = 548
 [pid 28611]: getgid([egid 501]) = 501
 [pid 28611]: open("/etc/ld.so.cache", RDONLY, 5000000021) = 3
 [pid 28611]: fstat(3, [dev 7 0 ino 21 nlnks 1 ...]) = 0
 [pid 28611]: smmap(0, 4096, READ, SHARED, 3, 0) = 0xf77c0000
 [pid 28611]: close(3) = 0
 [pid 28611]: open("/usr/lib/libc.so.1.6", RDONLY, 45674) = 3
 [pid 28611]: read(3, "813106
 [pid 28611]: smmap(0, 458764, READ|EXEC, PRIVATE, 3, 0) = 0xf7730000
 [pid 28611]: smmap(0xf779c000, 16384, READ|WRITE|EXEC, PRIVATE|FIXED, 3, 0x6c000) = 0xf779c000
 [pid 28611]: close(3) = 0
 [pid 28611]: write(1, "\t-lc.1 => /usr/lib/l".., 31	-lc.1 => /usr/lib/libc.so.1.6
) = 31
 [pid 28611]: rexit(0) = ?
Process 28610 resumed
EXITED(0), 0, (struct rusage *)0) = 28611
 - [SIGCHLD]
close(0) = 0
close(1) = 0
close(2) = 0
close(3) = -1 (Bad file number)
rexit(0) = ?
bridei%

SEE ALSO
ptrace(2), trace(1)

NOTES
A process that has a system call trace applied to it with the -p option will receive a SIGSTOP. This signal may interrupt a system call that is not restartable. This may have an unpredictable effect on the process if the process takes no action to restart the system call.

BUGS

Programs that use the setuid bit do not have effective user ID privileges while being traced.

A traced process ignores SIGSTOP.

A traced process runs slowly.

Traced children are left running after an interrupt signal (CTRL-C).