Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This is for academic purpose. I want to know which commands are executed when we do something in GUI, for example creating a folder. I want to show that both the mkdir shell command and create folder option from GUI does the same thing.

share|improve this question
Use strace to see what system calls are being performed. –  Keith Dec 29 '12 at 7:43
and the thing is that the "create folder" option will probably not call mkdir (the command) but the mkdir() system function. This depends a lot on the GUI tool you use to do things, but I'd expect many of those to use system calls instead. –  njsg Dec 29 '12 at 21:15
add comment

1 Answer

up vote 3 down vote accepted

You can observe what the process does with the strace command. Strace shows the system calls performed by a process. Everything¹ a process that affects its environment is done through system calls. For example, creating a directory can only be done by ultimately calling the mkdir system call. The mkdir shell command is a thin wrapper around the system call of the same name.

To see what mkdir is doing, run

strace mkdir foo

You'll see a lot of calls other than mkdir (76 in total for a successful mkdir on my system), starting with execve which loads the process binary image, then calls to load the libraries and data files used by the program, calls to allocate memory, calls to observe the system state, … Finally the command calls mkdir and wraps down, finishing with exit_group.

To observe what a GUI program is doing, start it and only observe it during one action. Find out the process ID of the program (with ps x, htop or any other process viewer), then run

strace -o file_manager.mkdir.strace -p1234

This puts the trace from process 1234 in the file file_manager.mkdir.strace. Press Ctrl+C to stop strace without stopping the program. Note that something like entering the name of the directory may involve thousands or tens of thousands of system calls: handling mouse movements, focus changes and so on is a lot more complex at that level than creating a directory.

You can select what system calls are recorded in the strace output by passing the -e option. For example, to omit read, write and select:

strace -e \!read,write,select …

To only record mkdir calls:

strace -e mkdir …

¹ Ok, almost everything. Shared memory only involves a system call for the initial setup.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.