strace

Basic Usage of strace

The most straightforward way to use strace is to simply specify the process you want to monitor:

strace ls -l /tmp

This command will trace all system calls made by the ls -l /tmp command. The output will be a detailed list of each system call, its arguments, and the return value. You’ll see calls like open, read, write, stat, and many more, reflecting the file system operations involved in listing the /tmp directory.

The output can be quite verbose. To make it more manageable, you can filter the output. For instance, if you’re only interested in file I/O operations:

strace -e trace=open,read,write,close ls -l /tmp

This limits the tracing to the specified system calls.

Tracing Specific System Calls

Let’s look at a more targeted approach. Suppose you suspect a slow-down is related to network activity. You can focus on network-related system calls:

strace -e trace=socket,connect,recv,send,accept wget https://www.example.com

This will show you only the system calls related to establishing a network connection, sending requests, and receiving the response from wget.

Tracing a Specific Process by PID

Instead of specifying the command directly, you can trace a running process by its Process ID (PID). First, find the PID using ps aux | grep <process_name> (replace <process_name> with the name of your process). Then:

strace -p <PID>

Replace <PID> with the actual process ID. This is particularly useful when debugging a running application without restarting it.

Output Redirection and Filtering

The volume of output from strace can be overwhelming. To manage this, redirect the output to a file:

strace -f -o strace_output.log ./my_program

The -f flag follows forked processes, and -o redirects the output to strace_output.log. You can then analyze the log file at your leisure using tools like grep, awk, or even a text editor. Filtering within the strace command itself is also possible; for example:

strace -e trace=open,read,write -e openat=read ./my_program > strace_output.log

This filters for open, read, write system calls generally, and only allows read calls to be reported when the openat system call is involved.

Advanced Options: -T and -tt

The -T option displays the time spent in each system call. This is vital for performance analysis:

strace -T ls -l /tmp

The -tt option includes timestamps in the output, further helping pinpoint timing issues.

strace -tt ls -l /tmp

Combining these options with output redirection allows for detailed performance profiling.

Example: Investigating a Slow Program

Let’s imagine you have a program, my_slow_program, that’s unusually slow. To pinpoint the cause, you might use:

strace -T -o slow_program_trace.log ./my_slow_program

After the program finishes, examine slow_program_trace.log. Look for system calls with high execution times. These are the likely candidates for optimization.

Beyond the Basics: -s and -S

The -s option controls the string length displayed in the output, which is useful to avoid truncating important information. The -S option controls the size of the displayed arguments. Experiment with these to tailor your output for your specific needs.

Using strace effectively requires practice and understanding of Linux system calls. However, mastering this tool opens up a powerful avenue for debugging and optimizing your applications.