How to know which commands are executed when I do something in GUI

Question

This is for academic purpose. I want to know which commands are executed when we do something in GUI, for example creating a folder. I want to show that both the mkdir shell command and create folder option from GUI does the same thing.

Answer 1

You can observe what the process does with the strace command. Strace shows the system calls performed by a process. Everything¹ a process that affects its environment is done through system calls. For example, creating a directory can only be done by ultimately calling the mkdir system call. The mkdir shell command is a thin wrapper around the system call of the same name.

To see what mkdir is doing, run

strace mkdir foo

You'll see a lot of calls other than mkdir (76 in total for a successful mkdir on my system), starting with execve which loads the process binary image, then calls to load the libraries and data files used by the program, calls to allocate memory, calls to observe the system state, … Finally the command calls mkdir and wraps down, finishing with exit_group.

To observe what a GUI program is doing, start it and only observe it during one action. Find out the process ID of the program (with ps x, htop or any other process viewer), then run

strace -o file_manager.mkdir.strace -p1234

This puts the trace from process 1234 in the file file_manager.mkdir.strace. Press Ctrl+C to stop strace without stopping the program. Note that something like entering the name of the directory may involve thousands or tens of thousands of system calls: handling mouse movements, focus changes and so on is a lot more complex at that level than creating a directory.

You can select what system calls are recorded in the strace output by passing the -e option. For example, to omit read, write and select:

strace -e \!read,write,select …

To only record mkdir calls:

strace -e mkdir …

¹ _{Ok, almost everything. Shared memory only involves a system call for the initial setup.}