Code Yarns ‍👨‍💻
Tech BlogPersonal Blog

How to use strace

📅 2017-Oct-30 ⬩ ✍️ Ashwin Nanjappa ⬩ 📚 Archive

strace is a tool that shows you the system calls and signals called by a program. It is a very useful tool, especially to check what files and libraries are opened, read or written by a program.

$ sudo apt install strace
$ strace ./foobar

You will see that strace prints out every system call made by the program, with its input arguments and its output. However, since this verbose listing is printed to the console, you will find it difficult to view the actual output of the program or to interact with it.

$ strace -o strace.log ./foobar
$ strace -f -o strace.log ./foobar
$ strace -e trace=open -o strace.log ./foobar
$ strace -e trace=open,close -o strace.log ./foobar
$ strace -e trace=file -o strace.log ./foobar

The other categories include process, network, signal, ipc, desc and memory. See the strace manpage for more details on these categories.

$ strace -e signal=sigkill,sigint -o strace.log ./foobar

The full list of signals can be seen in man 7 signal.

$ strace -P /home/joe/somefile -o strace.log ./foobar

Note that strace is clever enough to show all calls related to the file descriptor produced by the particular path too.

$ strace -v -o strace.log ./foobar
$ strace -s 100 -o strace.log ./foobar
$ strace -a 100 -o strace.log ./foobar
$ strace -y -o strace.log ./foobar

Tried with: strace 4.11 and Ubuntu 16.04