Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [strace]

strace is a debugging utility for tracing system calls and signals under Linux.

1
vote
0answers
16 views

Change format of syscall event trace output to ftrace

I enabled ftrace event tracing for sys_enter_openat syscall. The respective output format given at events/syscalls/sys_enter_openat/format is print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%...
-2
votes
1answer
30 views

Linux Prog has 24 Libs Fails LDD, and strace shows 692 “1 ENOENT” during prog library reads

I am requesting opinions on expected and desired outcome of prog initialization, specifically loading of shared libraries for a program that I do not have source code. All code delivered via RPMs. ...
0
votes
0answers
27 views

Which one to use Cross Memory Attach or ptrace?

I'm trying out ptrace system calls, I just discovered Cross Memory Attach from Christopher Yeoh. I wonder which one is better in term of performance between Cross Memory Attach and ptrace. Thanks in ...
12
votes
1answer
1k views

Executable file named 'test' is in $PATH but won't run

I have a file in $HOME/bin (before you ask, yes, it is in my path) called test which I've confirmed can be executed fine when I run it with the full path to the file. However, I get a really weird ...
6
votes
1answer
144 views

ld.so.cache and libc.so.6 memory-mapped for every call?

Playing with strace, it appears to me that ld.so.cache and libc.so.6 are opened and mapped to memory for almost every process. At least those processes that I experimented with. Doesn't this mean ...
0
votes
1answer
26 views

What are the relations between the tracer, tracee and calling processes in strace with -D and without -D?

I have some difficulty understanding the -D option of strace. strace manpage says -D Run tracer process as a detached grandchild, not as parent of the tracee. This ...
1
vote
1answer
62 views

Run program and intercept and redirect syscalls

I would like to run a program, and when that program attempts to read a specific file, I would like it to read a different file of my choosing instead. Specifically, the program attempts to read a ...
0
votes
1answer
42 views

How to avoid multiple 'libFoo.so' open() calls at application launch? [closed]

I have the next so file in /UNI/System/Libs/libmbedcrypto.so.3 directory. When I launch my application, that use libmbedcrypto.so.3 with strace I see: open("/UNI/System/Libs/tls/v7l/neon/vfp/...
1
vote
0answers
69 views

Programs fail to run after moving /home to a different partition on same drive

I am running Arch and was having no difficulties until I moved my home dir to a different partition on the same drive. The sequence of events: Format other partition to ext4; mount it to /mnt Move ...
0
votes
1answer
67 views

why I dont see malloc and free systemcall when run strace on stress command

The --vm flag of stress command says that, -m, --vm N spawn N workers spinning on malloc()/free() I wanted to see what it is actually doing so I ran this command, strace stress --vm 1 I get the ...
1
vote
0answers
70 views

apt-cacher-ng doesn't responce after start

Problem apt-get command (on Debian) cannot access repos via apt-cacher-ng proxy (installed on Centos). Environment # /etc/centos-release CentOS Linux release 7.5.1804 (Core) $ yum -q info apt-...
0
votes
1answer
59 views

How to list all the processes which have accessed a particular file? [duplicate]

strace can monitor only one single processes not all, lsof is not a good way too, it's not a real time tool, maybe I need a real time version of lsof? How to list all the processes which have accessed ...
10
votes
3answers
1k views

What is the time unit that strace uses when displaying time spent in syscalls?

When using the command strace with the flag -T, I would like to know what is the time unit used to display time spent in syscalls? I assume it should be in seconds, but I am not quite sure and it ...
1
vote
2answers
510 views

Is there a way to use strace to trace different parts of a command pipeline?

I have a pipeline like this: command1 | command2 Is there a way to trace both commands simultaneously?
7
votes
2answers
1k views

Why is there no apparent clone or fork in simple bash command and how it's done?

Consider the following (with sh being /bin/dash): $ strace -e trace=process sh -c 'grep "^Pid:" /proc/self/status /proc/$$/status' execve("/bin/sh", ["sh", "-c", "grep \"^Pid:\" /proc/self/status /".....
3
votes
1answer
137 views

Why do strace and ltrace cause EINTR to happen?

Consider this program: #include <stdio.h> #include <sys/epoll.h> int main(void) { int epfd = epoll_create1(0); struct epoll_event event; event.events = EPOLLIN; ...
1
vote
1answer
318 views

Monitoring page cache / memory mapped files access

I have an app that uses multiple memory mapped files. If I check the major page faults numbers (with /proc/<pid>/stat), they skyrocket. I was wondering if it's possible to monitor somehow what ...
4
votes
1answer
687 views

syscall number → name mapping at runtime

Is there a way to resolve the number of an observed syscall: SYS_345(0xe, 0xbff94188, 0x2, 0x4000, 0xb6526000) = 2 to its symbolic name in the running kernel without looking it up, in the sources? ...
0
votes
0answers
162 views

See other process previous output with strace

Fedora installed Accessing machine through PuTTY. Somewhere I found that I can see process output by strace -p <pid> -s 9999 -e write But this way I cannot see previous output, only ongoing. ...
1
vote
3answers
736 views

Filter out failed syscalls from strace log

I can run strace on a command like sleep 1 and see what files it's accessing like this: strace -e trace=file -o strace.log sleep 1 However, on my machine, many of the calls have a return value of -1 ...
2
votes
1answer
76 views

What is the format of the address used by buffer of system call read?

I'm using strace, and the following line appears: read(3,"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\3\2\0\0\0\0\0@\0\0\0\0\0\00P\265\31\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0G\0F\0\6\0\0\0\5\0\0\0@...
1
vote
1answer
153 views

strace output: disabling abbreviation completely changes the output

A normal strace call gave me this output: ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 I want to see the other terminal flags and tried -v and -e abbrev=none: Print unabbreviated ...
2
votes
1answer
212 views

Compile ptrace() program on OSX

I have this simple C program on MacOS: #include <stdlib.h> #include <sys/wait.h> #include <stdio.h> #include <sys/ptrace.h> int main(int argc, char *argv[]) { pid_t pid = ...
1
vote
1answer
55 views

Speed up creation of temp files in linux

I have an application for linux I use quite frequently which loves to make a lot of temporary files while it does its work. Basically its software which routes circuit boards automatically and during ...
11
votes
1answer
746 views

Why doesn't `strace` show this process is waiting for something?

The mighty strace has let me down. How is this possible? time foo shows that foo takes several seconds to run ("real"), but uses negligible cpu time, both in userspace ("user") and in the kernel ("...
1
vote
1answer
437 views

How to strace all write calls (to stdout/stderr) from all child processes inside a docker container?

I'm running this command: strace -f -e trace=desc ./my-program (So you see I'm running the -f parameter) Which lets me see the stdout/stderr write commands of the parent process: [pid 10] 07:36:...
37
votes
1answer
7k views

Connecting to IP 0.0.0.0 succeeds. How? Why?

We are serving a port on localhost and want to check in another process if the port is available. Due to a bug in our code, it is actually trying to connect to the IP 0.0.0.0:<port>, and for ...
3
votes
1answer
195 views

How can I determine if a latency is due to a driver or the scheduler?

Using an oscilloscope and toggling some pins I sometimes see latencies of 1-2 seconds from when an 8-byte UART packet is transmitted to when a blocking read returns. The packets are 1 second part with ...
2
votes
4answers
167 views

Why does number of backslashes increase in strace as opposed to being reduced by bash rules?

This question is related to How do I print backslash followed by newline with printf?, where OP tries to print \\\n as single backslash followed by newline (not literal \n). While by shell rules it ...
2
votes
0answers
269 views

How to make strace keep following children after the death of the father/mother:))?

I use this command to trace all the things that are done or started from a shell. sudo strace -e trace=memory -o outm -ff -p <the pid of the terminal instance I want to trace> -f But the ...
1
vote
1answer
184 views

Service snmpd calls gettimeofday syscall too many times

Recently I am facing an issue with snmpd service. I have a Linux box running CentOS 6.9, when I issue an snmpwalk on localhost usually all I get is a timeout, then I try adding a timeout value of 10 ...
3
votes
3answers
344 views

Process creation time, shell script and system call overhead

I have a machine dual booted with Arch Linux and Ubuntu (16.04). I have recently started using the Kakoune text editor, and noticed that its startup time is drastically different depending on which ...
0
votes
1answer
60 views

timeout + root password + strace in one line

I'm trying to run a timeout command, with root password and strace all in one line, the original cmmand is sudo -S timeout 4 strace -p 2829 -f -e trace=write -s 9999 but that promps for entering the ...
3
votes
1answer
122 views

Can getauxval be used to determine whether or not you're being traced?

Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down, strstr("TracerPid:\t0\n", "TracerPid:") ...
5
votes
2answers
693 views

How do I hide TracerPID from a process?

I'm conjecturing SQL Server on Linux is checking /proc/self/status for TracerPID and then dying if it's not 0. I want to test that. Playing around, here is the strace, ... lots of stuff openat(...
0
votes
2answers
710 views

How does networkmanager (nmcli) able to get my wifi signal strength without root privilege?

On my system, to find out the quality of the connected wifi signal I'd have to run sudo iwconfig wlp6s0 where wlp6s0 is the name of the device interface I'm using to connect to the wifi. The output ...
5
votes
1answer
311 views

Why do `time` and `strace -c` differ?

To my understanding, time would record the total amount of time spend in syscalls. Then I would expect the cumulative totals for sys time as reported by time and strace -fc to be the same. But they ...
1
vote
0answers
126 views

Function profiling on multi-core platform for specific PID using ftrace

I'm trying to use ftrace for function profiling based on function_profile_enabled as described here. I would like to capture function calls only for a certain PID using set_ftrace_pid as described in ...
0
votes
2answers
3k views

File create permission error although dir has 777 permission

On running command touch file I am getting error touch: cannot touch 'file': permission denied Although I have 777 permissions on the dir where I am trying to create file but still not able to ...
2
votes
2answers
513 views

strace -p with number of lines of context/history

I'd like to strace a running process, which I know I can do with strace -p <pid>, but I believe the process has hung on some blocking call, e.g. sem_wait() on a semaphore that's never posted, ...
0
votes
4answers
145 views

Intentionally create a graphical process that does not respond to `_NET_WM_PING`

Sometimes I am curious how a window manager treats an application that does not respond to _NET_WM_PING, e.g. that pop-up that says "Do you want to terminate this application?" This is useful for ...
2
votes
0answers
89 views

How to limit strace `file` tracing to only /proc/*/mem?

I'm straceing a program with the following command: strace -o /tmp/program.trace -e trace=ptrace,process,file -s 1000 -y program --arguments This works almost perfectly except one thing: for file ...
12
votes
4answers
14k views

How to trace networking activity of a command?

I want to trace the networking activity of a command, I tried tcpdump and strace without success. For an example, If I am installing a package or using any command that tries to reach some site, I ...
1
vote
2answers
598 views

sudo command does not work when strace is attached with PID of bash

I am taking logs of command executed by user in a output file by attaching PID of BASH in strace. $ strace -q -f -e execve -p $$ -o <outputFile> It is working fine and I am getting all ...
1
vote
1answer
806 views

Very slow auto-completion in Linux for Windows

For some reason auto-completion is very slow for me in WSL, it always takes several seconds display the result of, for example ll ~/Te<tab> (which would, after 2-3 seconds, print ll ~/Temp). I'...
3
votes
1answer
2k views

ptrace: Operation not permitted when attaching to a zombie process

I have a reproducible situation where a compiler instance goes into a zombie state when I rebuild a package, but gdb won't permit me to attach: serenity ~ # ps ax | grep defunct 11351 pts/1 Z+ ...
2
votes
1answer
717 views

Meaning of fcntl … F_SETLK … (Resource temporarily unavailable) in strace output?

When I use straceon Apache while it acts unresponsive, I get the following output: [pid 13704] fcntl(57, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741824, len=1}) = -1 EAGAIN (Resource ...
6
votes
1answer
9k views

Where to get “/etc/ld.so.nohwcap” file from? [duplicate]

When I run a command through strace utility I can see access errors such as access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) Now I've read somewhere that what's ...
2
votes
1answer
2k views

Using strace for a C file

I have a C file that I want to trace what is going on. I'm trying to use: strace -o trace.txt random.c But it says that: strace: Can't stat 'random.c': No such file or directory I've been looking ...
0
votes
1answer
49 views

Why does `w` here require more system calls than a simple python script?

I would like to dive deep into under Linux more and have been playing with a nice tool strace (Version: 4.11) on Ubuntu 16.04 LTS and I am curious as to why call like the following # strace -c w ...