I use this command to trace all the things that are done or started from a shell.
sudo strace -e trace=memory -o outm -ff -p <the pid of the terminal instance I want to trace> -f
But the problem is When I for example start firefox or chromium, I get so many messages like:
strace: Process 16776 attached strace: Process 17508 attached strace: Process 17509 attached strace: Process 17512 attached
But then if open a new tab etc no new processes are created. My guess is that these applications create so many different processes and then kill the parent so
strace stops tracing the children. So, how can I make
strace keep following children after their father/mother is killed or terminated?
Also please tell me if my command is not doing what I want.
What I want is to trace all the memory allocations/deallocations of all of the processes and threads of the system. So when I'm sure this function is working fine I want to make a module out of it and put in in the kernel and try to trace the earliest process possible in the system.