How To Trace System calls and Signals With Strace Command With Examples

RSS
EMAIL
FACEBOOK
FACEBOOK
GOOGLE
GOOGLE
https://www.poftut.com/trace-system-calls-signals-strace-command-examples/
PINTEREST
PINTEREST
INSTAGRAM

Linux Operating systems provides ability to track system calls with strace utility. As simple explanation strace intercepts and prints system calls made by related process. We know that Linux is actually an operating system kernel.

Operating system kernel is responsible from low level operations like device and hardware management, memory management, processes management, providing interface for user level processes and applications.

Strace is especially used for diagnostic, instructional and debugging operations.

Syntax

Syntax of strace is like below.

Help

Simple and fast help about tool can be get with the following command.

Trace Execution

Linux processes are generally started by calling them from bash or running background commands. In this example we will start a process by calling the command. But by calling command we will send the command to the strace as a parameter like below. Keep in mind that this is not a emulation mode the command will be run and complete its job. While doing its job the system calls and related information will be printed to the console. While tracing information like system call name, address, library, file stat will be provided.

LEARN MORE  How To List All Partitions Of A Disk In Linux

Trace Execution

Trace Execution

Trace Specific System Calls

In the previous example we have traced a command completely. This have created a lot of information and related output. This may be too much for us because we are looking only some of them. To make things more clear to track we can provide the system call we want to trace. In the following example we have only want to list open system call which is used to open files.

Trace Specific System Calls

Trace Specific System Calls

Save Trace Result To File

Up to now we have print the trace result to the terminal. Our example process was simple to run and created smaller output. But what will happen if we want to run a long and complex process? Or we want to analyze the trace output later. In this situations we can save the trace output to a file. In this example we have saved the trace output to the file named ls-trace.txt by using -o option. Then we can read the file with cat command.

Save Trace Result To File

Save Trace Result To File

Trace Already Running Process

We have created new processes to trace in previous examples. But there are some situations we want to trace all ready fired and running process. For example we have web servers running Apache and we want to trace Apache. How can we trace all ready running process? First we will find our process PID.

LEARN MORE  How To Restart CentOS, Fedora, RedHat?

Find PID

Find PID

Trace With Process ID

We have learned  that our snap daemon named snapd have PID 1193. Than we will provide this PID to the strace to trace with -p option like below.

Trace All Ready Running Process

Trace Already Running Process

Write Output To A File

Another useful usage is saving the trace to a file with -o option

Trace To A File

Trace To A File

And using tail command reading the trace output in real time.

Read Trace With tail

Read Trace With tail

Print Time Stamp

Time stamp information is very important especially metering the performance. In normal usage of strace time information is not provided. Time stamp information can be printed with -t option. In the example we simply print time stamp which is consist of current hour, minute and second information.

Print Time Stamp

Print Time Stamp

Print Relative Timestamp

Previous example we have printed time stamp information in normal day format. But we may want to use relative time stamp. Relative time stamp is calculated according to the process start time and process start time is set as 0 and all other system calls time is expressed according to the process start time.

Print Relative Time Stamp

Print Relative Time Stamp

Print Time Stamp More Precise

In the previous example we have printed the time stamp. This time stamp have normal precision where hour, minute and second information is provided. In some situations we may need to get more precise metric from the trace. The -tt option will create more precise metrics in nano seconds about the  trace.

LEARN MORE  hdparm Command Tutorial with Examples For Linux

Print Time Stamp More Precise

Print Time Stamp More Precise

Generate Statistics Report of System Calls

While tracing a process there is a lot of system calls used. Metrics and statistics about these calls can be printed in a table. This table will include metrics like time, seconds, call count, errors and related system call.

Generate Statistics Report of System Calls

Generate Statistics Report of System Calls

Follow Forked Threads

Operating systems provides threads to multiple a processes for more performance. Some daemon or server processes like Apache, Nginx etc. uses mainly threads. Normally strace do not trace these threads. The -f and -ff options made the strace to find threads with the related process and trace them too.

Follow Forked Threads

Follow Forked Threads

RSS
EMAIL
FACEBOOK
FACEBOOK
GOOGLE
GOOGLE
https://www.poftut.com/trace-system-calls-signals-strace-command-examples/
PINTEREST
PINTEREST
INSTAGRAM

You may also like...

Leave a Reply

Your email address will not be published.

Enjoy this blog? Please spread the word :)