Decode fds with timing

Show paths/sockets behind fds plus per-call duration and timestamps for file ops

strace -yy -T -tt -e trace=%file -p <pid>
tool
strace13 commands
tags
stracedebugdisktroubleshooting

More strace commands

  • Stack trace per syscall
    strace -k -e trace=openat -f -p <pid>

    Print user stack on each openat to find which code path opens a file; needs debug symbols

  • Syscall fault injection
    strace -f -e inject=openat:error=ENOENT:when=3 -p <pid>

    Force the 3rd openat to fail with ENOENT to test error handling; chaos testing without code

  • Trace signals delivered
    strace -f -e signal=all -e trace=none -p <pid>

    Show only signals (SIGTERM/SIGCHLD) and skip syscalls; debug mysterious kills. note: ltrace for libcalls

  • Trace a new process
    strace -o trace.log ls /tmp

    Run a command under strace and save output to file

  • Attach to running process
    strace -p $(pgrep nginx | head -1) -o /tmp/nginx.trace

    Trace syscalls of an already-running process by PID

all 13 strace commands