Questions tagged [strace]

strace is a debugging utility for tracing system calls and signals under Linux.

Filter by
Sorted by
Tagged with
1
vote
1answer
36 views

Can I trace a program that “broke out of jail”?

If a process can actually interfere with the others, is it possible to trace it down? By breaking the jail, I mean it overcame the virtualization that prevents one process to interact with the others ...
0
votes
1answer
11 views

Find the short-lived process that is polling my port?

I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and ...
2
votes
2answers
71 views

Why does strace show that syscall =?

I made a system call and recompiled the kernel, however upon running the system call it returned Killed. So, to trace it, I used strace, which shows the following message: syscall_0x224(0x7ffda7199738,...
2
votes
1answer
31 views

I have a tab completion that hangs, is it possible to use strace to find out what is going on?

In my example I start typing sudo su dkay...<tab>... and the command hangs for about a minute before tab completing to sudo su dkayton. I got advised to use strace to find out what is happening....
1
vote
0answers
54 views

What does this entry in an strace mean?

I already asked the question on reddit, but it unfortunately received no responses. I have the following shell output: [OP@~]$ strace okular file.pdf /* snipped */ write(13, "\1\0\0\0\0\0\0\0", 8) ...
0
votes
1answer
34 views

why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?

using strace I have found a behaviour of ldconfig (glibc), I can make no sense of lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0 unlink("/usr/lib/libext2fs.so.2") ...
1
vote
1answer
25 views

How to track down reason of suddenly appearing non-termination of a programme, while with `strace` it terminates?

I have a programme that suddenly started to not terminate (I was not updating the programme, but my system & the kernel, I do not remember what was causing the effect. Recompiling the programme ...
5
votes
1answer
367 views

Change format of syscall event trace output to ftrace

I enabled ftrace event tracing for sys_enter_openat syscall. The respective output format given at events/syscalls/sys_enter_openat/format is print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%...
-2
votes
1answer
32 views

Linux Prog has 24 Libs Fails LDD, and strace shows 692 “1 ENOENT” during prog library reads

I am requesting opinions on expected and desired outcome of prog initialization, specifically loading of shared libraries for a program that I do not have source code. All code delivered via RPMs. ...
0
votes
0answers
52 views

Which one to use Cross Memory Attach or ptrace?

I'm trying out ptrace system calls, I just discovered Cross Memory Attach from Christopher Yeoh. I wonder which one is better in term of performance between Cross Memory Attach and ptrace. Thanks in ...
12
votes
1answer
2k views

Executable file named 'test' is in $PATH but won't run

I have a file in $HOME/bin (before you ask, yes, it is in my path) called test which I've confirmed can be executed fine when I run it with the full path to the file. However, I get a really weird ...
6
votes
1answer
184 views

ld.so.cache and libc.so.6 memory-mapped for every call?

Playing with strace, it appears to me that ld.so.cache and libc.so.6 are opened and mapped to memory for almost every process. At least those processes that I experimented with. Doesn't this mean ...
0
votes
1answer
27 views

What are the relations between the tracer, tracee and calling processes in strace with -D and without -D?

I have some difficulty understanding the -D option of strace. strace manpage says -D Run tracer process as a detached grandchild, not as parent of the tracee. This ...
1
vote
1answer
86 views

Run program and intercept and redirect syscalls

I would like to run a program, and when that program attempts to read a specific file, I would like it to read a different file of my choosing instead. Specifically, the program attempts to read a ...
0
votes
1answer
42 views

How to avoid multiple 'libFoo.so' open() calls at application launch? [closed]

I have the next so file in /UNI/System/Libs/libmbedcrypto.so.3 directory. When I launch my application, that use libmbedcrypto.so.3 with strace I see: open("/UNI/System/Libs/tls/v7l/neon/vfp/...
1
vote
0answers
74 views

Programs fail to run after moving /home to a different partition on same drive

I am running Arch and was having no difficulties until I moved my home dir to a different partition on the same drive. The sequence of events: Format other partition to ext4; mount it to /mnt Move ...
0
votes
1answer
130 views

why I dont see malloc and free systemcall when run strace on stress command

The --vm flag of stress command says that, -m, --vm N spawn N workers spinning on malloc()/free() I wanted to see what it is actually doing so I ran this command, strace stress --vm 1 I get the ...
1
vote
0answers
86 views

apt-cacher-ng doesn't responce after start

Problem apt-get command (on Debian) cannot access repos via apt-cacher-ng proxy (installed on Centos). Environment # /etc/centos-release CentOS Linux release 7.5.1804 (Core) $ yum -q info apt-...
0
votes
1answer
63 views

How to list all the processes which have accessed a particular file? [duplicate]

strace can monitor only one single processes not all, lsof is not a good way too, it's not a real time tool, maybe I need a real time version of lsof? How to list all the processes which have accessed ...
10
votes
3answers
2k views

What is the time unit that strace uses when displaying time spent in syscalls?

When using the command strace with the flag -T, I would like to know what is the time unit used to display time spent in syscalls? I assume it should be in seconds, but I am not quite sure and it ...
1
vote
2answers
670 views

Is there a way to use strace to trace different parts of a command pipeline?

I have a pipeline like this: command1 | command2 Is there a way to trace both commands simultaneously?
7
votes
2answers
1k views

Why is there no apparent clone or fork in simple bash command and how it's done?

Consider the following (with sh being /bin/dash): $ strace -e trace=process sh -c 'grep "^Pid:" /proc/self/status /proc/$$/status' execve("/bin/sh", ["sh", "-c", "grep \"^Pid:\" /proc/self/status /".....
3
votes
1answer
194 views

Why do strace and ltrace cause EINTR to happen?

Consider this program: #include <stdio.h> #include <sys/epoll.h> int main(void) { int epfd = epoll_create1(0); struct epoll_event event; event.events = EPOLLIN; ...
1
vote
1answer
377 views

Monitoring page cache / memory mapped files access

I have an app that uses multiple memory mapped files. If I check the major page faults numbers (with /proc/<pid>/stat), they skyrocket. I was wondering if it's possible to monitor somehow what ...
4
votes
1answer
870 views

syscall number → name mapping at runtime

Is there a way to resolve the number of an observed syscall: SYS_345(0xe, 0xbff94188, 0x2, 0x4000, 0xb6526000) = 2 to its symbolic name in the running kernel without looking it up, in the sources? ...
0
votes
0answers
180 views

See other process previous output with strace

Fedora installed Accessing machine through PuTTY. Somewhere I found that I can see process output by strace -p <pid> -s 9999 -e write But this way I cannot see previous output, only ongoing. ...
3
votes
3answers
954 views

Filter out failed syscalls from strace log

I can run strace on a command like sleep 1 and see what files it's accessing like this: strace -e trace=file -o strace.log sleep 1 However, on my machine, many of the calls have a return value of -1 ...
3
votes
1answer
92 views

What is the format of the address used by buffer of system call read?

I'm using strace, and the following line appears: read(3,"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\3\2\0\0\0\0\0@\0\0\0\0\0\00P\265\31\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0G\0F\0\6\0\0\0\5\0\0\0@...
1
vote
1answer
184 views

strace output: disabling abbreviation completely changes the output

A normal strace call gave me this output: ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 I want to see the other terminal flags and tried -v and -e abbrev=none: Print unabbreviated ...
2
votes
1answer
233 views

Compile ptrace() program on OSX

I have this simple C program on MacOS: #include <stdlib.h> #include <sys/wait.h> #include <stdio.h> #include <sys/ptrace.h> int main(int argc, char *argv[]) { pid_t pid = ...
1
vote
1answer
56 views

Speed up creation of temp files in linux

I have an application for linux I use quite frequently which loves to make a lot of temporary files while it does its work. Basically its software which routes circuit boards automatically and during ...
11
votes
1answer
824 views

Why doesn't `strace` show this process is waiting for something?

The mighty strace has let me down. How is this possible? time foo shows that foo takes several seconds to run ("real"), but uses negligible cpu time, both in userspace ("user") and in the kernel ("...
1
vote
1answer
573 views

How to strace all write calls (to stdout/stderr) from all child processes inside a docker container?

I'm running this command: strace -f -e trace=desc ./my-program (So you see I'm running the -f parameter) Which lets me see the stdout/stderr write commands of the parent process: [pid 10] 07:36:...
40
votes
1answer
7k views

Connecting to IP 0.0.0.0 succeeds. How? Why?

We are serving a port on localhost and want to check in another process if the port is available. Due to a bug in our code, it is actually trying to connect to the IP 0.0.0.0:<port>, and for ...
3
votes
1answer
239 views

How can I determine if a latency is due to a driver or the scheduler?

Using an oscilloscope and toggling some pins I sometimes see latencies of 1-2 seconds from when an 8-byte UART packet is transmitted to when a blocking read returns. The packets are 1 second part with ...
1
vote
4answers
193 views

Why does number of backslashes increase in strace as opposed to being reduced by bash rules?

This question is related to How do I print backslash followed by newline with printf?, where OP tries to print \\\n as single backslash followed by newline (not literal \n). While by shell rules it ...
2
votes
0answers
298 views

How to make strace keep following children after the death of the father/mother:))?

I use this command to trace all the things that are done or started from a shell. sudo strace -e trace=memory -o outm -ff -p <the pid of the terminal instance I want to trace> -f But the ...
1
vote
1answer
200 views

Service snmpd calls gettimeofday syscall too many times

Recently I am facing an issue with snmpd service. I have a Linux box running CentOS 6.9, when I issue an snmpwalk on localhost usually all I get is a timeout, then I try adding a timeout value of 10 ...
3
votes
3answers
389 views

Process creation time, shell script and system call overhead

I have a machine dual booted with Arch Linux and Ubuntu (16.04). I have recently started using the Kakoune text editor, and noticed that its startup time is drastically different depending on which ...
0
votes
1answer
66 views

timeout + root password + strace in one line

I'm trying to run a timeout command, with root password and strace all in one line, the original cmmand is sudo -S timeout 4 strace -p 2829 -f -e trace=write -s 9999 but that promps for entering the ...
3
votes
1answer
141 views

Can getauxval be used to determine whether or not you're being traced?

Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down, strstr("TracerPid:\t0\n", "TracerPid:") ...
3
votes
2answers
780 views

How do I hide TracerPID from a process?

I'm conjecturing SQL Server on Linux is checking /proc/self/status for TracerPID and then dying if it's not 0. I want to test that. Playing around, here is the strace, ... lots of stuff openat(...
0
votes
2answers
787 views

How does networkmanager (nmcli) able to get my wifi signal strength without root privilege?

On my system, to find out the quality of the connected wifi signal I'd have to run sudo iwconfig wlp6s0 where wlp6s0 is the name of the device interface I'm using to connect to the wifi. The output ...
5
votes
1answer
378 views

Why do `time` and `strace -c` differ?

To my understanding, time would record the total amount of time spend in syscalls. Then I would expect the cumulative totals for sys time as reported by time and strace -fc to be the same. But they ...
1
vote
0answers
135 views

Function profiling on multi-core platform for specific PID using ftrace

I'm trying to use ftrace for function profiling based on function_profile_enabled as described here. I would like to capture function calls only for a certain PID using set_ftrace_pid as described in ...
0
votes
2answers
4k views

File create permission error although dir has 777 permission

On running command touch file I am getting error touch: cannot touch 'file': permission denied Although I have 777 permissions on the dir where I am trying to create file but still not able to ...
2
votes
2answers
577 views

strace -p with number of lines of context/history

I'd like to strace a running process, which I know I can do with strace -p <pid>, but I believe the process has hung on some blocking call, e.g. sem_wait() on a semaphore that's never posted, ...
0
votes
4answers
184 views

Intentionally create a graphical process that does not respond to `_NET_WM_PING`

Sometimes I am curious how a window manager treats an application that does not respond to _NET_WM_PING, e.g. that pop-up that says "Do you want to terminate this application?" This is useful for ...
2
votes
0answers
100 views

How to limit strace `file` tracing to only /proc/*/mem?

I'm straceing a program with the following command: strace -o /tmp/program.trace -e trace=ptrace,process,file -s 1000 -y program --arguments This works almost perfectly except one thing: for file ...
13
votes
4answers
16k views

How to trace networking activity of a command?

I want to trace the networking activity of a command, I tried tcpdump and strace without success. For an example, If I am installing a package or using any command that tries to reach some site, I ...