{"id":264277,"date":"2021-06-01T19:00:48","date_gmt":"2021-06-01T16:00:48","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/"},"modified":"2021-06-01T19:00:48","modified_gmt":"2021-06-01T16:00:48","slug":"how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/","title":{"rendered":"#How to Use strace to Trace System Calls and Signals \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a382eb58709b\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a382eb58709b\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/#What_Is_strace\" >What Is strace?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/#Installing_strace\" >Installing strace<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/#Using_strace\" >Using strace<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/#Tracing_Child_Processes\" >Tracing Child Processes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-strace-to-trace-system-calls-and-signals-cloudsavvy-it\/#Wrapping_up\" >Wrapping up<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#How to Use strace to Trace System Calls and Signals \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage alignnone size-full wp-image-4038\" data-pagespeed-lazy-src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Bash Shell\" width=\"1400\" height=\"600\" src=\"\/pagespeed_static\/1.JiBnMqyl6S.gif\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Tracing a computer program is not reserved for only those who have the source code, can read it, and know how to use a debugger. Any Linux user can trace an executable with strace. Find out how!<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"What_Is_strace\"><\/span>What Is <i>strace<\/i>?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>strace is a Linux utility that lets you trace the system calls that a given <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>lication makes. It will also pick up on signals and produce a detailed output of all the information that it observes.<\/p>\n<p>A person new to strace and tracing, in <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">general<\/a>, might ask why this is helpful. A professional IT engineer might ask how much information strace can really pick up, especially if they know how much can be glanced from a debugger like GDB.<\/p>\n<p>If you are interested in debugging computer code and programs, take a look at our Debugging with GDB: Getting Started article.<\/p>\n<p>There\u2019s good <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">news<\/a> in both cases! Tracing all system calls and signals provides a comprehensive picture of a program\u2019s operation, and it\u2019s an excellent troubleshooting and even debugging tool. Additionally, it runs during runtime (as a wrapper process), yet can trace easily into a logfile and makes for an easy-to-digest overview of a program\u2019s actions.<\/p>\n<p>Comparing this with GDB, which is also a wrapper process, things are substantially different. For example, in GDB, one could trace a program step by step (for example, one line of code at a time or a logical block of code\u2014or by using breakpoints in the code). However, such steps are made <i>during<\/i> runtime, whereas strace simply runs the program as a whole until some error occurs or until completion.<\/p>\n<p>The engineer or user can then go and analyze the full (text-based) log, search for interesting strings, etc. Additionally, GDB would allow one to see signals and system calls also, although setting that up and analyzing the same is much more complex than with <code>strace<\/code>.<\/p>\n<p>With strace, you can simply execute the program under <code>strace<\/code> (i.e. <code>strace some_program<\/code>), and while this is about the same as GDB, the operation differs significantly, as described above.<\/p>\n<p>As for the amount of information that can be glanced from a trace, it\u2019s good to take a step back and remember where most computer problems come from\u2014disk full, memory exhausted, some file wasn\u2019t found, incorrect input, etc.<\/p>\n<p>Especially in the areas of disk access,\u00a0<code>strace<\/code> really shines. As it records all system calls, every disk access is very visible in the log. Again, you can search for relevant text strings and file names, although be aware that sometimes, strings could be length-reduced, so only the partial output might be visible.<\/p>\n<p>In summary, if we had to rate <code>strace<\/code> as either a debugging and\/or troubleshooting tool and assign it a place into a newer or more proficient Linux user toolbox, then in both cases, the answer is <i>approximately in the middle<\/i>, although leaning a bit more toward troubleshooting than debugging. Let\u2019s install <code>strace<\/code> next.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>How Logic Gates Work: OR, AND, XOR, NOR, NAND, XNOR, and NOT<\/em><\/strong><\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Installing_strace\"><\/span>Installing <i>strace<\/i><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>To install <i>strace<\/i> on your Debian\/Apt-based Linux distribution (like Ubuntu and Mint), execute the following command in your terminal:<\/p>\n<p><code>sudo apt install strace<\/code><\/p>\n<p>To install <i>strace<\/i> on your RedHat\/Yum-based Linux distribution (like RHEL, Centos, and Fedora), execute the following command in your terminal:<\/p>\n<p><code>sudo yum install strace<\/code><\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Using_strace\"><\/span>Using <i>strace<\/i><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>After installing <code>strace<\/code>, it\u2019s quite simple to get started. We can, for example, trace the Linux <code>sleep<\/code> command\/utility:<\/p>\n<pre>strace sleep 1&#13;\n<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11259\" data-pagespeed-lazy-src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/d642f8c3.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"strace of a one second sleep process\" width=\"957\" height=\"752\" src=\"\/pagespeed_static\/1.JiBnMqyl6S.gif\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>tely, the output proves the statement made above. There\u2019s a plethora of information on all of the actions taken by the (very) simple <code>sleep 1<\/code> command, which, after all, only actions sleeping for a single second.<\/p>\n<p>Let\u2019s look at a few things that we can immediately observe:<\/p>\n<pre>access(\"\/etc\/ld.so.preload\", R_OK)      = -1 ENOENT (No such file or directory)&#13;\n<\/pre>\n<p>We can see that quite shortly after starting, the program tried to access (on disk) the file <code>\/etc\/ld.so.preload<\/code>. We can also see that this failed (<code>-1 status<\/code>), as the file wasn\u2019t found (<code>ENOENT<\/code>) with the descriptive error message <code>No such file or directory<\/code>.<\/p>\n<p>Just this single line of output could lead to further research. For example, we can scan our favorite search engine for what the file <code>\/etc\/ld.so.preload<\/code> is\/does and what happens when a program can\u2019t find it, as well as for how we can install it.<\/p>\n<p>As you can see, if you would run a more complicated software\/program under <code>strace<\/code>, you might find that it\u2019s trying to access a file\u2014for example, a shared <code>.so<\/code> library\u2014and can\u2019t find it. It\u2019s easily analyzed and likely easily fixed thanks to <code>strace<\/code>.<\/p>\n<p>Next, we see the <code>conf.d<\/code> binary cache being opened successfully as <i>read only<\/i> (<code>O_RDONLY<\/code>), with the close-on-exec flag (used in multithreaded programs to avoid race conditions) <code>O_CLOEXEC<\/code> flag set:<\/p>\n<pre>openat(AT_FDCWD, \"\/etc\/ld.so.cache\", O_RDONLY|O_CLOEXEC) = 3&#13;\n<\/pre>\n<p>Even if one doesn\u2019t know what each item means, a simple search online will quickly provide information on each specific term or word, helping one to understand the information presented and what\u2019s happening.<\/p>\n<p>Also of particular interest is this line toward the end:<\/p>\n<pre>+++ exited with 0 +++&#13;\n<\/pre>\n<p>This indicates that the program exited successfully with exit code <code>0<\/code>. An exit code of 0 generally indicates successful execution and termination in Linux programs.<\/p>\n<p>As you can see from the examples above, it\u2019s easy to see what a program is doing by using <code>strace<\/code>. Each line and even each word in each line can be analyzed, and often, a search engine is required to shed some light. However, even glancing over the output of a failing program might be enough to find the exact cause and fix it, and especially so when, for example, a required file is missing, etc.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>How Linux Runlevels Affect Running Services<\/em><\/strong><\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Tracing_Child_Processes\"><\/span>Tracing Child Processes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>When using <code>strace<\/code>, it will sometimes seem that <code>strace<\/code> is not correctly tracing all of the program\u2019s system calls, etc. This could simply be because the program being traced has initiated\/started a number of child processes, for example, by forking child processes.<\/p>\n<p>It\u2019s simple to include these child processes in the strace capture: Simply add the <code>-f<\/code> option to the command line (i.e., <code>strace -f your_program<\/code>), and all system calls, etc., of all child processes will also be tracked.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Wrapping_up\"><\/span>Wrapping up<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In this article, we discussed the <code>strace<\/code> tool, which can be used to make traces of any program or application running on a Linux-based computer.<\/p>\n<p>After installing the tool, we can simply and directly start the program under <code>strace<\/code> and enjoy the high level of troubleshooting and debugging information that the <code>strace<\/code> wrapper will present us with.\n<\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/11258\/how-to-use-strace-to-trace-system-calls-and-signals\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#How to Use strace to Trace System Calls and Signals \u2013 CloudSavvy IT&#8221; Tracing a computer program is not reserved for only those who have the source code, can read it, and know how to use a debugger. Any Linux user can trace an executable with strace. Find out how! What Is strace? strace is&#8230;<\/p>\n","protected":false},"author":1,"featured_media":264278,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-264277","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/264277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=264277"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/264277\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/264278"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=264277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=264277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=264277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}