I use this command to trace all the things that are done or started from a shell.

sudo strace -e trace=memory -o outm -ff -p <the pid of the terminal instance I want to trace> -f

But the problem is When I for example start firefox or chromium, I get so many messages like:

strace: Process 16776 attached
strace: Process 17508 attached
strace: Process 17509 attached
strace: Process 17512 attached

But then if open a new tab etc no new processes are created. My guess is that these applications create so many different processes and then kill the parent so strace stops tracing the children. So, how can I make strace keep following children after their father/mother is killed or terminated?

Also please tell me if my command is not doing what I want.

What I want is to trace all the memory allocations/deallocations of all of the processes and threads of the system. So when I'm sure this function is working fine I want to make a module out of it and put in in the kernel and try to trace the earliest process possible in the system.

  • 2
    why not instead write it using SystemTap or sysdig if it's going to be in the kernel?
    – thrig
    Jan 22, 2018 at 16:16
  • @thrig I don't know what they are. But I can't install anything on the system. it should be a module that works out of the box. Jan 22, 2018 at 16:38
  • how are you going to "make a module out of it[strace?] and put in[sic] in the kernel" if you can't install anything?
    – thrig
    Jan 22, 2018 at 17:39
  • I think I can have the same functionality with ptrace, can't I? Jan 22, 2018 at 18:09
  • I guess you could try to write something ptrace something. might be horrifically slow, or a reinvention of SystemTap or sysdig...
    – thrig
    Jan 22, 2018 at 18:25


You must log in to answer this question.

Browse other questions tagged .