I use this command to trace all the things that are done or started from a shell.

sudo strace -e trace=memory -o outm -ff -p <the pid of the terminal instance I want to trace> -f

But the problem is When I for example start firefox or chromium, I get so many messages like:

strace: Process 16776 attached
strace: Process 17508 attached
strace: Process 17509 attached
strace: Process 17512 attached

But then if open a new tab etc no new processes are created. My guess is that these applications create so many different processes and then kill the parent so strace stops tracing the children. So, how can I make strace keep following children after their father/mother is killed or terminated?

Also please tell me if my command is not doing what I want.

What I want is to trace all the memory allocations/deallocations of all of the processes and threads of the system. So when I'm sure this function is working fine I want to make a module out of it and put in in the kernel and try to trace the earliest process possible in the system.

  • 2
    why not instead write it using SystemTap or sysdig if it's going to be in the kernel? – thrig Jan 22 '18 at 16:16
  • @thrig I don't know what they are. But I can't install anything on the system. it should be a module that works out of the box. – yukashima huksay Jan 22 '18 at 16:38
  • how are you going to "make a module out of it[strace?] and put in[sic] in the kernel" if you can't install anything? – thrig Jan 22 '18 at 17:39
  • I think I can have the same functionality with ptrace, can't I? – yukashima huksay Jan 22 '18 at 18:09
  • I guess you could try to write something ptrace something. might be horrifically slow, or a reinvention of SystemTap or sysdig... – thrig Jan 22 '18 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.