Strace command in Linux with Examples

Strace is one of the most powerful process monitoring, diagnostic, instructional tool of Linux. It also acts as a debugging tool that helps in troubleshooting issues. It is majorly used for the following purposes:

• Debugging Programs
• Troubleshooting Programs
• Intercept System calls by a process
• Record system calls by a process
• Signals received by a process
• Trace running processes

In case the source code is not available, strace is used to analyze how a program interacts with the system to debug the executing of program. It returns the name of each system call along with its argument enclosed in parenthesis and its return value to standard error.

Installing strace Process Monitoring Tool

To install the strace tool use the following commands as per your Linux distribution.

In case of Debian/Ubuntu

$sudo apt install strace

In case of CentOS/RedHat

$yum install strace

Working with Strace Process Monitoring Tool

1. To get the system call, argument, and the result of the call.

$strace ls

Note: Here “ls” is the command whose system call is to be traced.

As can be seen, it displays the system call, argument(in parenthesis), and result of the call of ls command. And +++ exited with 0 +++, in the last line states that exit status is 0 which means there was no error. In case of an error, the exit code is -1.

2. To count number of system calls.

$strace -c ls

Note: Here “ls” is the command whose system call is to be traced.

As can be seen, it displays the number of times each system call was made and prints the total and even showing the number and time spent in each call.

3. To trace particular or specific system calls.

$strace -e trace=write ls

Note: Here “ls” is the command whose system call is to be traced. And the name of the system call which is to be traced is write.

As can be seen, it only displays the name, argument, and result of write system call.

4. To trace network related system calls

$strace -e trace=network nc -v -n 127.0.0.1 801

Note: Here “nc -v -n 127.0.0.1 801” is the command whose system call is to be traced. And the name of the system call which is to be traced is the network.

As can be seen, it only displays the name, argument, and result of the network system call.

5. To trace signal related system calls

$strace -e trace=signal nc -v -n 127.0.0.1 801

Note: Here “nc -v -n 127.0.0.1 801” is the command whose system call is to be traced. And the name of the system call which is to be traced is signal.

As can be seen, it only displays the name, argument, and result of the signal system call.

6. To print timestamp of each call.

$strace -r ls

Note: Here “ls” is the command whose system call is to be traced.

As can be seen, it displays a relative timestamp upon entry to each system call. It records the time difference between the beginning of successive system calls.

7. To print time spent on system calls.

$strace -T ls

Note: Here “ls” is the command whose system call is to be traced.

As can be seen the time spent on each call is printed at the end of each line.

8. To print wall clock time of each system call.

$strace -t ls

Note: Here “ls” is the command whose system call is to be traced.

As it can be seen that the prefix of each line if the wall clock time itself of the system call.

9. To print instruction pointer.

$strace -i ls

Note: Here “ls” is the command whose system call is to be traced.

As can be seen, the instruction pointer is printed in each line of output.

10. To print output to a file

$strace -o output.txt ls

Note: Here “ls” is the command whose system call is to be traced. And output.txt is the name of the file in which output is to be stored.

As can be seen, the output of the command is stored in the output.txt file.