strace commands

13 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 13 shown

  • Trace a new process
    strace -o trace.log ls /tmp

    Run a command under strace and save output to file

    linux · debug

  • Attach to running process
    strace -p $(pgrep nginx | head -1) -o /tmp/nginx.trace

    Trace syscalls of an already-running process by PID

    linux · debug

  • Trace only specific syscalls
    strace -e trace=openat,read,write curl https://example.com

    Filter to file-related syscalls only

    linux · debug

  • Count syscall statistics
    strace -c -e trace=all python3 app.py

    Summary table of syscall counts and time spent

    linux · debug · performance

  • Follow child processes
    strace -f -e trace=process nginx -t

    Trace syscalls in all forked children (-f)

    linux · debug

  • Show timestamps
    strace -tt -T curl https://example.com 2>&1 | head -40

    -tt adds absolute time; -T shows time spent in each call

    linux · debug · performance

  • Trace file access
    strace -e trace=openat -e trace=file myapp 2>&1 | grep 'ENOENT'

    Find files the process tries to open but cannot find

    linux · debug

  • Trace network syscalls
    strace -e trace=network,socket curl https://example.com 2>&1 | grep -v '^---'

    Capture all network-related syscalls

    linux · debug · network

  • Syscall count summary
    strace -c -f -S time -p <pid>

    Aggregate syscall counts/time across forks, sorted by time; pinpoints the costly call

    performance · debug · troubleshooting

  • Decode fds with timing
    strace -yy -T -tt -e trace=%file -p <pid>

    Show paths/sockets behind fds plus per-call duration and timestamps for file ops

    debug · disk · troubleshooting

  • Stack trace per syscall
    strace -k -e trace=openat -f -p <pid>

    Print user stack on each openat to find which code path opens a file; needs debug symbols

    debug · troubleshooting · disk

  • Syscall fault injection
    strace -f -e inject=openat:error=ENOENT:when=3 -p <pid>

    Force the 3rd openat to fail with ENOENT to test error handling; chaos testing without code

    debug · troubleshooting · ci

  • Trace signals delivered
    strace -f -e signal=all -e trace=none -p <pid>

    Show only signals (SIGTERM/SIGCHLD) and skip syscalls; debug mysterious kills. note: ltrace for libcalls

    debug · troubleshooting · kernel