strace in Linux: trace system calls

strace shows every system call a program makes to the kernel: which files it opens, what it reads, and where it fails.

Syntax

strace command   # or: strace -p PID

Common cases

strace ls                  # every system call of the ls command
strace -p 1234             # attach to a running process
strace -e trace=openat ls  # only file-open calls
strace -f ./app            # follow child processes too
strace -c ls               # a summary: which calls and how much time

How it works: the line between a program and the kernel

A program does almost nothing directly on its own: open a file, send a packet, allocate memory - these are all requests to the kernel, system calls. strace sits on that line and prints each call with its arguments and result. That makes it priceless when a program 'silently does not work': you see which file it failed to find (ENOENT) or which socket it could not connect to. The cost is a heavy slowdown, so in production you use it narrowly. strace needs the PTRACE privilege, which our sandbox does not have.

In the book

This topic is covered in full in the chapter System diagnosis and methodology.

See also

Open files: lsof, The /proc filesystem, Viewing processes.