Follow child processes strace
Trace syscalls in all forked children (-f)
strace -f -e trace=process nginx -t
more strace
all 13 commands →
Show timestamps
strace -tt -T curl https://example.com 2>&1 | head -40
Trace file access
strace -e trace=openat -e trace=file myapp 2>&1 | grep 'ENOENT'
Trace network syscalls
strace -e trace=network,socket curl https://example.com 2>&1 | grep -v '^---'
Syscall count summary
strace -c -f -S time -p <pid>
Decode fds with timing
strace -yy -T -tt -e trace=%file -p <pid>