3.3.2. Monitoring an application’s system calls with strace

Procedure

1. Identify the system calls to monitor.

   • Start strace and attach it to the program.

     • If the program you want to monitor is not running, start strace and specify the program:

       $ strace -fvttTyy -s 256 -e trace=call program

     • If the program is already running, find its process id (pid):

       $ ps -C program

     • Attach strace to the process:

       $ strace -fvttTyy -s 256 -e trace=call -ppid

   • Replace call with the system calls to be displayed. You can use the -e trace=call option multiple times. If left out, strace will display all system call types. See the strace(1) manual page for more information.
   • If you do not want to trace any forked processes or threads, omit the -f option.

2. The strace tool displays the system calls made by the application and their details.

   In most cases, an application and its libraries make a large number of calls and strace output displays immediately, if no filter for system calls is set.

3. The strace tool exits when the program exits.

   To terminate the monitoring before the traced program exits, press Ctrl+C.

   • If strace started the program, the program terminates together with strace.
   • If you attached strace to an already running program, the program terminates together with strace.

4. Analyze the list of system calls done by the application.

   • Problems with resource access or availability are present in the log as calls returning errors.
   • Values passed to the system calls and patterns of call sequences provide insight into the causes of the application’s behaviour.
   • If the application crashes, the important information is probably at the end of log.

   • The output contains a large amount of unnecessary information. However, you can construct a more precise filter for the system calls of interest and repeat the procedure.

     注意

     It is advantageous to both see the output and save it to a file. Use the tee command to achieve this:

     $ strace ... |& tee your_log_file.log