Summary of strace command usage in Linux (1)

1. Function Description

 

The strace command is a powerful tool that can display any system call sent by a user space program. strace displays the parameters of these calls and Returns signed values. strace receives information from the kernel, and does not need to build the kernel in any special way. each line of strace output includes the system call name, followed by parameters and return values.

The following describes several common options:

The-f option tells strace to track both fork and vfork processes.

-O xxx.txt is output to a document.

-E execve only records system calls such as execve.

 

 

2 Usage Details

 

Usage: strace [-dffhiqrttttvvxx] [-a column] [-e expr]... [-o file]

[-P pid]... [-s strsize] [-u username] [-e Var = Val]...

[Command [arg...]

Or: strace-C [-e expr]... [-O overhead] [-s sortby] [-e Var = Val]...

[Command [arg...]

-C -- count time, cballs, and errors for each syscall and report summary

-F -- follow forks,-FF -- with output into separate files

-F -- attempt to follow vforks,-h -- print help message

-I -- print instruction pointer at time of syscall

-Q -- suppress messages about attaching, detaching, etc.

-R -- print relative timestamp,-t -- absolute timestamp,-TT -- with usecs

-T -- print time spent in each syscall,-V -- print version

-V -- verbose mode: Print unabbreviated argv, stat, termio [s], etc. ARGs

-X -- print non-ASCII strings in Hex,-xx -- print all strings in hex

-A column -- alignment column for printing syscall results (default 40)

-E expr -- a qualifying expression: option = [!] All or option = [!] Val1 [, val2]...

Options: trace, abbrev, verbose, raw, signal, read, or write

-O file -- send Trace Output to file instead of stderr

-O overhead -- set overhead for tracing syscallto overhead usecs

-P pid -- Trace process with process id pid, may be repeated

-S strsize -- limit length of print strings to strsize Chars (default 32)

-S sortby -- Sort syscall counts by: time, call, name, nothing (Default Time)

-U username -- Run Command as Username Handling setuid and/or setgid

-E Var = Val -- put Var = Val in the environment for command

-E var -- remove var from the environment for command

 

 

3 parameter description

 

-C: Calculate the execution time, number of times, and number of errors of each system call.

-D: Output strace debugging information about standard errors.

-F tracks the sub-processes generated by the fork call.

-FF if-O filename is provided, the trace results of all processes are output to the corresponding filename. PID, which is the process number of each process.

-F attempts to trace vfork calls. In-F, vfork is not tracked.

-H outputs brief help information.

-I output the entry pointer of the system call.

-Q: Do not output the message about the disconnection.

-R prints the relative time for each system call.

-T add time information before each row in the output.

-TT adds time information before each row in the output, in microseconds.

-TTT microsecond-level output, expressed in seconds.

-T shows the time consumed by each call.

-V outputs all system calls. Some calls about environment variables, status, input and output are not output by default due to frequent calls.

-V outputs the version information of strace.

-X outputs non-standard strings in hexadecimal format.

-Xx all strings are output in hexadecimal format.

-A column: Set the output position of the returned value. The default value is 40.

-E expr specifies an expression to control how to trace. The format is as follows:

[Qualifier =] [!] Value1 [, value2]...

Qualifier can only be trace, abbrev, verbose, raw, signal, read, or write. value is a symbol or number used to limit. the default qualifier is trace. the exclamation point is a negative sign. for example,-eopen is equivalent to-e trace = open, indicating that only open calls are tracked. and-etrace! = Open indicates the tracing of calls other than open. There are two special symbols: All and none. Note that some shells are used! To execute the commands in the history, so use \\.

-E trace = set: only trace the specified system call. For example,-e trace = open, close, rean, write indicates that only the four system calls are tracked. The default value is set = All.

-E trace = file only tracks system calls related to file operations.

-E trace = process only traces system calls related to process control.

-E trace = network traces all network-related system calls.

-E strace = signal tracks all system calls related to system signals.

-E trace = IPC tracks all system calls related to process communication.

-E abbrev = set the result set of the System Call output by strace.-V and abbrev = none. The default value is abbrev = All.

-E raw = set: displays the specified system call parameters in hexadecimal format.

-E signal = set indicates the system signal of the trail. The default value is all. For example, signal =! Sigio (or signal =! Io), indicating that the sigio signal is not tracked.

-E read = set outputs the data read from the specified file. For example,-e READ =

-E write = set output data written to the specified file.

-O filename: writes strace output to the file filename.

-P pid: tracks the specified process PID.

-S strsize specifies the maximum length of the output string. The default value is 32. The file name is always output.

-U Username: run the tracked command with the UID and gid of username.

-- End --

From: http://hi.baidu.com/edeed/blog/item/e3eba40f227021e6ab6457bf.html