strace is a debugging utility for tracing system calls and signals under Linux.

learn more… | top users | synonyms

1
vote
1answer
19 views

where does go data written to file descriptor that was never opened

I have output captured by following command: $ strace -f -e trace=process,socketpair,open,close,dup,dup2,read,write -o rsync.log rsync -avcz --progress src/ dst/ it is a bit long so I've uploaded ...
1
vote
0answers
13 views

strace for troubleshooting inter process communication

I have output captured by following command: strace -f -e trace=process,socketpair,open,close,dup,dup2,read,write -o rsync.log rsync -avcz --progress src/ dst/ it is a bit long so I've uploaded it ...
2
votes
1answer
52 views

Strace output not showing system call

I am reading the source code of coreutils and I came to read tty.c code. Main function of tty is as follows: int main (int argc, char **argv) { char *tty; int optc; initialize_main (&argc, ...
5
votes
4answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
0
votes
1answer
1k views

Monitor com port with strace

I have written a small application in Java that writes two strings – 'dddd' and 'ffff' – to a com port. I used strace -s9999 -o serialtrace.log -eread,write,ioctl to inspect how it writes. I found ...
0
votes
1answer
28 views

qemu infinite loop on boot

I'm currently trying to set up a virtual machine emulating a ARMv7 Cortex-A8 on a x64 host running qemu. I've got a zImage which was built with the realview defconfig and a rootfs in cpio format. ...
2
votes
2answers
28 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
6
votes
1answer
373 views

Unkillable apache2 processes

After upgrading from debian lenny to squeeze (apache2 2.2.16-6+squeeze4 and php 5.3.10-1~dotdeb.1), my apache processes started to exit with segmentation fault. It happens every 5-30 minutes (for 1 ...
2
votes
2answers
56 views

How can strace monitor itself?

I have a Hypothetical Situation. (1) Let us say we have two strace Processes S1 & S2, which are simply monitoring each other. How can this be possible ? Well, in the command-line options for ...
1
vote
2answers
82 views

Exclude PIDs when comparing strace output

I want to debug like: strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello.log strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello2.log Then use kdiff3 to compare ...
1
vote
0answers
69 views

How to understand the output of tracing running an external command in background via strace

In Ubuntu, I run date & in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. The output of tracing the first ...
1
vote
3answers
139 views

How can I find which user is accessing a file using strace?

My actual problem is that Nginx is not able to render pages (403 forbidden) despite the permissions being set to appropriately (in my opinion) The directory of stackoverflow at default location: ...
1
vote
1answer
97 views

How to understand the output of tracing running an external command in bash?

In Ubuntu, I run date directly in an interactive bash shell whose pid is 6913. $ date Wed Mar 2 23:57:44 EST 2016 At the same time, I trace the bash shell 6913 from another interactive bash shell ...
0
votes
0answers
58 views

Compare running a command directly and in background

In Ubuntu, I run date in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. By using tracing, I would like to ...
0
votes
0answers
74 views

What differences are between running a command in shell with and without `bash -c`?

What is the difference of running a command directly in a bash shell, and run it as bash -c <command> in a bash shell? The purpose of my question is that I would like to know how a command is ...
2
votes
2answers
155 views

Debugging a kernel shut down?

I'm on Linux 4.2.0, the Ubuntu Wily HWE kernel for Ubuntu 14.04 (which is what I'm running). There's a nasty bug on MacBook 11,4 and 11,5 models where the laptops won't actually ever shut off, they ...
0
votes
2answers
80 views

Why doesn't strace report that the parent shell fork() a child process before execve() a command?

strace runs a specified command until it exits. It intercepts and records the system calls which are called by a process and the signals which are received by a process. When running an external ...
1
vote
1answer
45 views

Most elegant way to terminate straced program

I want to capture a certain thing with strace and then immediately exit. This way the program stays alive: strace ... program 2>&1 | grep --line-buffered ... | read line. Is there a simple way ...
28
votes
3answers
17k views

List the files accessed by a program

time is a brilliant command if you want to figure out how much CPU time a given command takes. I am looking for something similar that can list the files being accessed by a program and its children. ...
1
vote
1answer
73 views

exit status of command is different when it is run via strace

I can normaly mount/umount FTP as file system using following commands: └──> curlftpfs -o codepage=windows-1250 anonymous:anonymous@192.168.3.13 /home/marek/ftpfs └──> ls /home/marek/ftpfs/ 1 2 ...
4
votes
0answers
156 views

Linux strace not following child processes even with -f (multithreaded parent)

Note: there are several similar questions, with the general answer being "If you want to trace a multithreaded process, or follow children, use -f". This doesn't help me, as i am using -f already. I ...
1
vote
0answers
30 views

How to debug a bash script in a qemu-arm chroot

I'm running a debian debootstrap script which creates an arm system. However, the script fails at some point and the error message does not really help. So I'll have to do some more debugging which is ...
1
vote
0answers
16 views

How can I see file events of all processes matching those with keyword in path?

How can I see file events of all processes matching only those with keyword in path ? Here is my typical usecase. I'm investigating why Docker can't authorize with 3rd-party service using credentials ...
0
votes
1answer
35 views

strace vs web browser

I was trying to strace an iceweasel like this: strace -e trace=connect iceweasel And I was expecting to see calls to connect when I load new pages. Surprisingly, there weren't any. Why so? Am I ...
1
vote
0answers
70 views

SIGSEGV: 0x0000000000000000 in ?? ()

I am executing an iperf connection between two UML machines running the following kernel: Linux client 4.1.0-ga61e56d #55 Mon Nov 30 13:51:59 CET 2015 x86_64 GNU/Linux I am working on the TCP/IP ...
0
votes
0answers
56 views

spstack, ptrace stopped a process

My server is busy with sys CPU, so I used pstrace to trace it but no output, so I cancel the command inside putty, and then use pstack to trace it again, but no result return either and I closed the ...
1
vote
0answers
77 views

Tracing syscalls of chromium or setting chromium configuration

Given complex application like for example chromium, does anyone now convenient (and actually working) method of tracing it's syscalls? What i am doing Starting chromium in temporary profile but ...
4
votes
2answers
1k views

running strace for specific period of time

How to run strace on a user process for specific period of time, say 1 minute, without terminating the user process and without using Ctrl+C? I want to create a script to automating strace execution ...
3
votes
1answer
52 views

How does ssh always manage to reset the terminal attributes?

If I run strace -e trace=ioctl -v ssh some_remote_host I see a line like this: ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {c_iflags=0x6006, c_oflags=0x4, c_cflags=0x 4bf, c_lflags=0xa00, c_line=0, c_cc[...
0
votes
1answer
63 views

Citrix Receiver - 13.2.1 - hangs forever

I had Citrix Receiver working on funtoo linux a while back, but made some changes and could not figure for the life of me what it was. I thought perhaps Funtoo was not stable or there was a conflict ...
0
votes
0answers
677 views

How do I make strace “decode” AF_NETLINK communication as with ioctl?

strace usually "deciphers" ioctl calls, showing what they mean, even resolving network interface names and so on. But the same operation performed using AF_NETLINK stays opaque in strace. How can I ...
3
votes
1answer
200 views

Deleting an empty file, why there are so many sys calls ?

Try to create an empty file and strace the operations that are involved to delete it. The list is very long: touch a strace rm a execve("/bin/rm", ["rm", "a"], [/* 20 vars */]) = 0 brk(0) ...
-1
votes
2answers
68 views

Getting filename based on filehandle number

I am running strace -p 1234 -o strace.out on a system where process it is suspected that process 1234 is performing badly. I see these reads that take almost a minute to complete: read(11, "\0\335\0\...
2
votes
1answer
364 views

Why am I unable to attach `strace` to a kworker process?

As root, I try to attach strace to a running kworker process, without success. root@rasal# whoami root root@rasal:/# cat /proc/sys/kernel/yama/ptrace_scope 0 ...
14
votes
4answers
2k views

What system call is used to load libraries in Linux?

In strace outputs, the paths to the libraries that executables call are in calls to open(). Is this the system call used by executables that are dynamically linked? What about dlopen()? open() isn't a ...
0
votes
0answers
28 views

strace | Who's making syscalls ? | Where are the instructions?

I've been told that strace is used to track all the system calls made while running an application. I see that there are a lot of system calls made even before the first printf ( now write ) call. ...
2
votes
1answer
289 views

Strace - Filedescriptor 3

I am not sure what the filedescriptor number 3 means here? Is this descriptor some kind of pointer to the connection made to the harddrive to get the file datlog.txt? I guess so because the subroutine ...
3
votes
1answer
229 views

BASH: Fifo troubles - seems selective about input

So I am having a problem with a BASH service in Debian 7 that I've been working on for quite a while and that randomly started having trouble with its fifo, or so it seems. It is based on kind of your ...
2
votes
1answer
3k views

How is it that I can attach strace to a process that isn't in the output of ps?

I'm trying to debug why our integration tests are taking so long and it looks like they're hanging part way through. I logged onto our test service and saw the following behaviour: root@colossus:~# ...
17
votes
1answer
470 views

Tracing executable without read permissions

I found some surprising behavior on Ubuntu 14.04 when using strace on an executable, which I do not have read permission on. I wonder if this is a bug, or if some standard mandates this obscure ...
1
vote
1answer
77 views

Why doesn't /bin/login appear in ps output when someone is logging in

I wanted to monitor what happens when a test user logs in to my CentOS 6.4 system, so I tried this to poll ps for /bin/login and strace the pid when it appears: until [[ $(ps -ef|grep -q [l]ogin)$? -...
9
votes
2answers
2k views

Is it possible to strace the builtin commands to Bash?

Inspired by this question, titled: When are the built-in commands loaded to memory, while attempting to answer this I tried the following command and was a bit surprised that I couldn't run it: $ ...
1
vote
1answer
79 views

how do applications communicate via sockets

On my computer audio works sometimes and sometimes not. I want to troubleshoot this. First I verified I am using pulseaudio. I did this by strace'ing the pulseaudio process: [pid 2289] send(28, "\0\...
2
votes
1answer
114 views

Monitor and alert user when stty settings change?

A particularly large (~10^6 LOC) program causes my stty settings to change from echo ixon icanon to -echo -ixon -icanon and I would like to find the function in this massive program that causes this ...
8
votes
6answers
842 views

why strace ignores my alias for rm?

I have an alias set for my rm command. If I run alias command, this is what I get as output. alias rm='rm -i' Now, when I run the rm command it works fine as expected. rm ramesh rm: remove ...
8
votes
4answers
873 views

How could running strace be fixing my OpenGL issue?

Since a recent major upgrade to my distribution (PLD Linux), I have been having trouble with a whole slew of programs. As best I can tell, anything that touches OpenGL or PulseAudio segfaults. I'm ...
2
votes
1answer
135 views

Sending a string to strace for “printf debugging”

While there are command line versions of strace for windows, the defacto GUI equivalent of strace on windows is Sysinternals procmon. In addition to letting you view file, registry, network and other ...
3
votes
1answer
421 views

Decode / summarise strace logs

OK, so it's no secret that strace produces vast amounts of output. (I'm aware there are various options to filter the output a bit.) Are there any tools to process a raw strace log into something ...
2
votes
1answer
495 views

Tracing the node process executing my script from “npm start”

I am attempting to debug a cli node project. Its easier to do npm start than npm install -g . && libgrabber. However, I'd like to run strace on the process. The output of strace -f on the npm ...
2
votes
1answer
378 views

Strace Hello World program

So I am trying to understand systemcalls with the following "Hello World!" program: #include <stdio.h> int main(){ printf("Hello World!\n"); return 0; } and then I run strace on the ...