strace
13 commands
13 shown
Trace a new process
Run a command under strace and save output to file
strace -o trace.log ls /tmp
Attach to running process
Trace syscalls of an already-running process by PID
strace -p $(pgrep nginx | head -1) -o /tmp/nginx.trace
Trace only specific syscalls
Filter to file-related syscalls only
strace -e trace=openat,read,write curl https://example.com
Count syscall statistics
Summary table of syscall counts and time spent
strace -c -e trace=all python3 app.py
Follow child processes
Trace syscalls in all forked children (-f)
strace -f -e trace=process nginx -t
Show timestamps
-tt adds absolute time; -T shows time spent in each call
strace -tt -T curl https://example.com 2>&1 | head -40
Trace file access
Find files the process tries to open but cannot find
strace -e trace=openat -e trace=file myapp 2>&1 | grep 'ENOENT'
Trace network syscalls
Capture all network-related syscalls
strace -e trace=network,socket curl https://example.com 2>&1 | grep -v '^---'
Syscall count summary
Aggregate syscall counts/time across forks, sorted by time; pinpoints the costly call
strace -c -f -S time -p <pid>
Decode fds with timing
Show paths/sockets behind fds plus per-call duration and timestamps for file ops
strace -yy -T -tt -e trace=%file -p <pid>
Stack trace per syscall
Print user stack on each openat to find which code path opens a file; needs debug symbols
strace -k -e trace=openat -f -p <pid>
Syscall fault injection
Force the 3rd openat to fail with ENOENT to test error handling; chaos testing without code
strace -f -e inject=openat:error=ENOENT:when=3 -p <pid>
Trace signals delivered
Show only signals (SIGTERM/SIGCHLD) and skip syscalls; debug mysterious kills. note: ltrace for libcalls
strace -f -e signal=all -e trace=none -p <pid>
no commands match