3.3.3. Monitoring application’s library function calls with ltrace

Procedure

1. Identify the libraries and functions of interest, if possible.

2. Start ltrace and attach it to the program.

   注意

   In Red Hat Enterprise Linux 10, a known issue prevents ltrace from tracing system executable files. This limitation does not apply to executable files built by users.

   • If the program you want to monitor is not running, start ltrace and specify program:

     $ ltrace -f -l library -e function program

   • If the program is already running, find its process id (pid):

     $ ps -C program

   • Attach ltrace to the process:

     $ ltrace -f -l library -e function -ppid program

   • Use the -e, -f and -l options to filter the output:

     • Supply the function names to be displayed as function. The -e function option can be used multiple times. If left out, ltrace displays calls to all functions.
     • Instead of specifying functions, you can specify whole libraries with the -l library option. This option behaves similarly to the -e function option.
     • If you do not want to trace any forked processes or threads, omit the -f option.

     See the ltrace(1)_ manual page for more information.

3. ltrace displays the library calls made by the application.

   In most cases, an application makes a large number of calls and ltrace output displays immediately, if no filter is set.

4. ltrace exits when the program exits.

   To terminate the monitoring before the traced program exits, press ctrl+C.

   • If ltrace started the program, the program terminates together with ltrace.
   • If you attached ltrace to an already running program, the program terminates together with ltrace.
5. Stop ltrace by pressing Ctrl+C.

6. Analyze the list of library calls done by the application.

   • If the application crashes, the important information is probably at the end of log.

   • The output contains a large amount of unnecessary information. However, you can construct a more precise filter and repeat the procedure.

     注意

     It is advantageous to both see the output and save it to a file. Use the tee command to achieve this:

     $ ltrace ... |& tee your_log_file.log