{"id":303540,"date":"2021-07-20T13:00:08","date_gmt":"2021-07-20T10:00:08","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/"},"modified":"2021-07-20T13:00:08","modified_gmt":"2021-07-20T10:00:08","slug":"how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/","title":{"rendered":"#How to Use ltrace to Trace Library Calls \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a42b3b347fdb\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a42b3b347fdb\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/#What_Is_a_Library\" >What Is a Library?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/#what_is_ltrace\" >what is ltrace?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/#Installing_ltrace\" >Installing ltrace<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/#Using_ltrace\" >Using ltrace<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-ltrace-to-trace-library-calls-cloudsavvy-it\/#Wrapping_up\" >Wrapping up<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#How to Use ltrace to Trace Library Calls \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage alignnone size-full wp-image-4038\" srcset=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png?width=398&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 400w, https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 1200w\" sizes=\"auto, 400w, 1200w\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Bash Shell\" width=\"1400\" height=\"600\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Interesting in fixing those library errors and bugs you observe when installing a cool new program on Linux? Check out this article which shows how to use ltrace, arming you with the tool needed to debug library calls.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"What_Is_a_Library\"><\/span>What Is a <i>Library<\/i>?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most people are familiar with <code>.dll\/.DLL<\/code> files (Dynamic Link Libraries) in Windows. The Linux equivalent is a <code>.so<\/code> file, a Shared Object, often referred to as just Library.<\/p>\n<p>A library can be used by an <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>lication allowing that program to utilize functionality from outside its program code. For example, a web server may want to use a disk I\/O library written by the operating system vendor or another third party. It is a way of sharing common goods and interests in most, if not all, operating systems.<\/p>\n<p>Libraries can be loaded either dynamically at run time (when the calling program is starting, for example), or they can be compiled into a target application\/binary. They will thus always be loaded (whether used or not), as part of, and whenever the application which has them compiled-in\/built-in is started.<\/p>\n<p>To learn more about libraries, their dependencies, and the <code>ldd<\/code> tool, you may like to read about\u00a0how to work with shared object dependencies in linux. The <code>ldd<\/code> tool is another handy tool to have in any more advanced Linux user toolbox.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"what_is_ltrace\"><\/span>what is <i>ltrace<\/i>?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>There are various trace utilities in Linux, like\u00a0strace for tracing system calls and signals and the <code>traceroute<\/code> to trace network routing. The <code>ltrace<\/code> utility\/tool traces all library calls.<\/p>\n<p>If you have read our working with Shared Object (Library) dependencies in the Linux article (linked above), you will have already seen how you can find out what libraries a particular binary is linked to by using the <code>ldd<\/code> tool. The purpose and functionality of <code>ltrace<\/code> is somewhat different; much in line with <code>strace<\/code>, the <code>ltrace<\/code> command traces all library calls a particular program is making while it is executing.<\/p>\n<p>Alike to <code>strace<\/code>, we can start a program <i>under<\/i> (think about it like a hierarchy) <code>ltrace<\/code>. We simply specify the program which <code>ltrace<\/code> should start as the first option to <code>ltrace<\/code>, and <code>ltrace<\/code> will start that program for us and im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>tely commence (on a higher level) to track all calls to any (operating system or third party installed) libraries.<\/p>\n<p>It does so by intercepting and recording the <i>dynamic<\/i> library calls made by the program being executed. It will also track any signals sent to the program being executed, very similar to <code>strace<\/code> (and, if so desired, this functionality can be disabled by specifying the <code>-b<\/code> or equivalent <code>--no-signals<\/code> option to <code>ltrace<\/code>).<\/p>\n<p>Note that the term <i>dynamic<\/i> is of significant importance here; <code>ltrace<\/code> will trace calls to <i>external<\/i> libraries (under the form of <code>.so<\/code> or <code>.a<\/code> files), i.e. libraries not directly compiled into a program; <i>dynamic<\/i> libraries. Thus, if you have a binary with statically (compiled-in) libraries, <code>ltrace<\/code> will not be able to see\/trace such internal calls.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Installing_ltrace\"><\/span>Installing <i>ltrace<\/i><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11424\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/1e412544.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Installing ltrace at the command line with apt\" width=\"835\" height=\"306\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>To install <i>ltrace<\/i> on your Debian\/Apt based Linux distribution (Like Ubuntu and Mint), execute the following command in your terminal:<\/p>\n<p><code>sudo apt install ltrace<\/code><\/p>\n<p>To install <i>ltrace<\/i> on your RedHat\/Yum based Linux distribution (Like RHEL, Centos and Fedora), execute the following command in your terminal:<\/p>\n<p><code>sudo yum install ltrace<\/code><\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Using_ltrace\"><\/span>Using ltrace<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Let\u2019s set up a small test environment:<\/p>\n<pre>sudo apt install tar xz-utils&#13;\nmkdir ~\/workspace &amp;&amp; cd ~\/workspace&#13;\ntouch a b c&#13;\n<\/pre>\n<p>Here we installed <code>tar<\/code> and <code>xz<\/code> by installing <code>xz-utils<\/code> (you can use <code>sudo yum install tar xz<\/code> instead if you are using Centos\/RHEL\/Fedora). Next we created a directory <code>~\/workspace<\/code> and jumped into it. We then made three empty files using the <code>touch<\/code> command, namely files <code>a<\/code>, <code>b<\/code> and <code>c<\/code>.<\/p>\n<p>Let\u2019s start by compressing our three files into an (<i>tar<\/i> combined and <i>xz<\/i> compressed) <code>archive.tar.xz<\/code> archive, whilst executing the same under <code>ltrace<\/code>, and observing the <code>ltrace<\/code> output:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11425\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/c9baca3c.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Our first ltrace run of tar\" width=\"391\" height=\"86\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<pre>ltrace tar -hcf --xz archive.tar.xz *&#13;\n<\/pre>\n<p>We only see a small amount of output. We can see that our program terminated successfully (the archive file was created), i.e., <code>status 0<\/code>: an exit code of <code>0<\/code> always means success in Linux (though the program needs to have exit codes implemented correctly).<\/p>\n<p>This is not very useful this far. Reasoning for a few seconds about how <code>tar<\/code> will operate here will quickly reveal our next approach. The avid reader may have also understood that the <code>tar<\/code> command internally would call the <code>xz<\/code> command. The <code>--xz<\/code> option passed to our <code>tar<\/code> command line will ensure that the <code>xz<\/code> program is used for compression.<\/p>\n<p>The secondary process (or the third in the overall hierarchy) namely <code>xz<\/code> (hierarchy: <code>ltrace<\/code> &gt; <code>tar<\/code> &gt; <code>xz<\/code>) will be started by <code>tar<\/code> when necessary. As such, we need to trace the child processes of the program running under <code>ltrace<\/code>, i.e. <code>tar<\/code>. We can do this by specifying the follow (<code>-f<\/code>) option to <code>ltrace<\/code>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11426\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/88399fdc.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"ltrace of tar with follow (-f) to trace child processes\" width=\"379\" height=\"157\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<pre>ltrace -f tar -hcf --xz archive.tar.xz *&#13;\n<\/pre>\n<p>Note that it is important to specify the <code>-f<\/code> option directly behind <code>ltrace<\/code> and not later in the command line after <code>tar<\/code> for example. The reason is that we want to specify this option to <code>ltrace<\/code> and not to the <code>tar<\/code> command. All options after the <code>tar<\/code> command are <code>tar<\/code> specific options whereas <code>-f<\/code> is an option specific to <code>ltrace<\/code>.<\/p>\n<p>The output is a bit more interesting. We do not observe any library calls (of any form) yet, but we at least see that two subprocesses are forked (note <code>exec()<\/code>) and that both subprocesses terminate with status <code>0<\/code>. Handy and all good.<\/p>\n<p>So, where are our library calls? Checking <code>tar<\/code> and <code>xz<\/code> (the two programs which will be used by the command to create the archive file) with <code>ldd<\/code>, we quickly realize that most libraries that both programs use are system libraries:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11427\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/ba6beb7a.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Discovering more about the libraries used by tar and xz using the ldd command\" width=\"777\" height=\"322\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<pre>whereis tar&#13;\nwhereis xz&#13;\nldd \/bin\/tar&#13;\nldd \/usr\/bin\/xz&#13;\n<\/pre>\n<p>We must thus go one step further and enable tracing of system library calls by specifying the <code>-S<\/code> option to <code>ltrace<\/code>. This option is disabled\/turned off by default as the output would get a little verbose, and it is likely assumed that system libraries are <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">general<\/a>ly much more stable and, as such, do not need to be traced to start with. Let\u2019s have a look.<\/p>\n<pre>ltrace -fS tar -hcf --xz archive.tar.xz * &#13;\n<\/pre>\n<p>Or, for testing purposes:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11428\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/079f4fb5.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"ltrace -S allows us to see system calls also\" width=\"708\" height=\"393\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<pre>ltrace -fS tar -hcf --xz archive.tar.xz * 2&gt;&amp;1 | head -n10&#13;\nltrace -fS tar -hcf --xz archive.tar.xz * 2&gt;&amp;1 | tail -n10&#13;\n<\/pre>\n<p>As the output was substantial we had to capture the first and last ten lines using a <code>head<\/code> and <code>tail<\/code> command. To be able to use these commands we had to redirect <code>stderr<\/code> to <code>stdout<\/code> using the <code>2&gt;&amp;1<\/code> redirection as <code>ltrace<\/code> will by default report on <code>stderr<\/code>. If you are interested in learning more about redirection see Bash Automation and Scripting Basics (Part 3).<\/p>\n<p>Now that we added the <code>-S<\/code> option, we can see all libraries being accessed. For example, we see <code>\/etc\/ld.so.preload<\/code> being accessed. The output is sequential (top to bottom), so if there are other events (sub-processing being forked, etc.) in between, these will be shown inline at the moment they take place. We could also add the <code>-t<\/code> option for time-based output:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-11429\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/05\/7134f8f5.png?trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"ltrace -t allows us to see timed output\" width=\"750\" height=\"206\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Wrapping_up\"><\/span>Wrapping up<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In this article, we introduced and discussed the versatile <code>ltrace<\/code> program, which is a great tool allowing one to trace all dynamic library calls a given program makes. We installed <code>ltrace<\/code>, set up a test environment, and executed some <code>ltrace<\/code> commands with the most commonly used options.\n<\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/11423\/how-to-use-ltrace-to-trace-library-calls\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#How to Use ltrace to Trace Library Calls \u2013 CloudSavvy IT&#8221; Interesting in fixing those library errors and bugs you observe when installing a cool new program on Linux? Check out this article which shows how to use ltrace, arming you with the tool needed to debug library calls. What Is a Library? Most people&#8230;<\/p>\n","protected":false},"author":1,"featured_media":303541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2017\/07\/add8ac45.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-303540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/303540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=303540"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/303540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/303541"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=303540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=303540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=303540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}