Using strace
I started the chapter with the simple and ubiquitous tool, top, and I will finish with another: strace. It is a very simple tracer that captures system calls made by a program and, optionally, its children. You can use it to do the following:
- Learn which system calls a program makes
- Find those system calls that fail, together with the error code: I find this useful if a program fails to start but doesn't print an error message or if the message is too general
- Find which files a program opens
- Find out which
syscallsa running program is making, for example, to see whether it is stuck in a loop
There are many more examples online; just search for strace tips and tricks. Everybody has their own favorite story, for example, http://chadfowler.com/2014/01/26/the-magic-of-strace.html.
strace uses the ptrace(2) function to hook calls as they are made from user space to the kernel. If you want to know more about how ptrace works, the manual page is detailed and surprisingly readable.
The simplest...
