Introduction to Linux Strace programs __linux

1. Introduction

Strace is commonly used to track system calls and received signals when a process executes.

Strace can track system calls generated by a process, including parameters, return values, and time spent executing.

2. Parameter

-C counts the time, times, and number of errors that each system call performs.
-D Output strace debugging information about standard errors.
-F tracks the subprocess generated by the fork call.
-FF If you provide-o filename, the trace results for all processes are output to the corresponding filename.pid, and the PID is the process number of each process.
-F attempts to trace vfork calls. When-F, vfork are not tracked.
-H output brief help information.
-I output system call entry pointer.
-Q suppresses the output of messages about secession.
-R prints out relative time about, each system calls.
-T adds time information before each line in the output.
-tt the time information before each line in the output, microsecond level.
-TTT microsecond output, in seconds to indicate the time.
-T displays the elapsed time for each call.
-V outputs all system calls. Some calls about environment variables, states, input and output calls due to frequent use, the default does not output.
-V Output strace version information.
-X output non-standard string in 16-binary form
-XX all strings are output in 16-in-binary form.
-A column sets the output position of the return value. The default is 40.
-e expr specifies an expression that controls how to track. The format is as follows:
[Qualifier=] [!] Value1[,value2] ...
Qualifier can only be one of trace,abbrev,verbose,raw,signal,read,write. value is the symbol or number that is used to qualify. The default qualifier is trace. Exclamation marks are negative. For example:
-eopen is equivalent to-e Trace=open, which means that only the open call is tracked. and-etrace!=open represents tracking calls other than open. There are two special symbols all and none. Note that some shells use! To execute commands in the history, so use \ \.
-e Trace=set only trace the specified system call. For example:-e trace=open,close,rean,write indicates that only these four system calls are tracked. The default is Set=all.
-e trace=file tracks only system calls to file operations.
-e trace=process tracks only system calls to process control.
-e trace=network tracks all system calls related to the network.
-e strace=signal tracks all system calls related to system signals
-e TRACE=IPC tracks all system calls related to process communication
-e Abbrev=set Sets the result set of the system call Strace output.-V, and Abbrev=none. The default is Abbrev=all.
-e Raw=set Displays the parameters of the specified system call in hexadecimal.
-e signal=set Specifies the tracking system signal. The default is all. such as signal=! Sigio (or Signal=!io) means that the Sigio signal is not tracked.
-e read=set output data read from the specified file. For example:-E read=3,5
-e Write=set output writes to data in the specified file.
-o filename writes strace output to file filename
-p PID tracks the specified process PID.
-S strsize Specifies the maximum length of the string to output. The default is 32. The file name is always output.
-u username commands that are tracked with username UID and GID

3. Command instance

Strace-o output.txt-t-tt-e trace=all-p 28979
The above meaning is to track all system calls (-e Trace=all) of the 28979 process, and to count the time spent by the system call, as well as the start time (and display in the visual minutes), and finally the record result exists in the Output.txt file.