Attach to running process strace
Trace syscalls of an already-running process by PID
strace -p $(pgrep nginx | head -1) -o /tmp/nginx.trace
more strace
all 13 commands →
Trace only specific syscalls
strace -e trace=openat,read,write curl https://example.com
Count syscall statistics
strace -c -e trace=all python3 app.py
Follow child processes
strace -f -e trace=process nginx -t
Show timestamps
strace -tt -T curl https://example.com 2>&1 | head -40
Trace file access
strace -e trace=openat -e trace=file myapp 2>&1 | grep 'ENOENT'