STRACE Thread Tracking

Brief Introduction

Strace is commonly used to track system calls and received signals when a process executes. In the Linux world, processes cannot directly access hardware devices, and when processes need access to hardware devices (such as reading disk files, receiving network data, and so on), they must be switched from User state mode to kernel mode to access hardware devices through system calls. Strace can track system calls generated by a process, including parameters, return values, and time spent executing. Related Knowledge common system call functions

Eg:
fork        Create a new process  
clone       Create a subprocess on a specified condition  
execve run the      executable  
exit        abort process 
nanosleep   Causes the process to sleep the specified time 
pause       suspend process, wait for signal wait        waiting for child process to terminate   
waitpid     wait for specified child process to terminate  
socket      Establish  
a socket bind        bind socket to port connect     Connect remote host  
Accept      response Socket connection request  
send        Send information via socket  
recv  
mmap        Map Virtual memory page
munmap      remove memory page map      by socket receive information Mremap Remap virtual memory address   
Msync       writes data from mapped memory back to disk   
Listen      listens for socket port  
Select to poll      multiple sync I/O  
Shutdown    Closes the connection on the socket  
READV       reads data from the file into the buffer array  
Writev      writes the data in the buffer array to the file  
pread reads the       file randomly  
pwrite      file random write  
lseek       move file pointer    
dup         copy an open file descriptor    
flock       file Add/unlock   
poll        I/O multipath conversion   
truncate    

part of the detailed description mmap Poll & Select Analysis of Linux signal (signal) mechanism

The nature of the signal, soft interrupt signal (signal, also referred to as signal) is used to inform the process of an asynchronous event occurred. At the software level is a simulation of the interrupt mechanism, in principle, a process received a signal and the processor received an interrupt request can be said to be the same. The signal is the only asynchronous communication mechanism in the interprocess communication mechanism, a process does not have to wait for the signal to arrive by any operation, in fact, the process does not know exactly when the signal arrives. Processes can send soft interrupt signals to each other through system call kill. The kernel can also send a signal to the process because of an internal event, notifying the process that an event has occurred. In addition to the basic notification function, the signaling mechanism can also pass additional information.

The process of receiving signals has different processing methods for various signals. The processing methods can be divided into three categories:

The first is an interrupt-like handler, and for the signal to be processed, the process can specify the processing function to be processed by the function.

The second approach is to ignore a signal and do nothing with the signal, as if it had not happened.

The third method is that the processing of the signal retains the default value of the system, which, by default, is the default operation for most of the signals, which causes the process to terminate. The process specifies the processing behavior of a signal by a process through system call signal. strace Parameters

-C counts the time, times, and number of errors that each system call performs. 
-D Output strace debugging information about standard errors. 
-F tracks the subprocess generated by the fork call. 
-FF If you provide-o filename, the trace results for all processes are output to the corresponding filename.pid, and the PID is the process number of each process. 
-F attempts to trace vfork calls. When-F, vfork are not tracked. 
-H output brief help information. 
-I output system call entry pointer. 
-Q suppresses the output of messages about secession. 
-R prints out relative time about, each system calls. 
-T adds time information before each line in the output. 
-tt the time information before each line in the output, microsecond level. 
-TTT microsecond output, in seconds to indicate the time. 
-T displays the elapsed time for each call. 
-V outputs all system calls. Some calls about environment variables, states, input and output calls due to frequent use, the default does not output. 
-V Output strace version information. 
-X outputs the nonstandard string in 16- 
-xx all strings are output in 16-in-form.
-   A column sets the output position of the return value. The default is. 
-E expr   specifies an expression that controls how the-
o filename   is tracked to write the strace output to the file filename-P- 
PID-Trace-specified process PID. Typically used to track background programs
-S strsize Specifies the maximum length of the string to output. The default is. 
-u username  commands that are tracked with username UID and GID

strace-e trace option

-e trace=file     Trace and file access related calls (with file names in parameters)-
e-trace=process  and process-management-related calls, such as Fork/exec/exit_group-
e trace= Network  and network communication related calls, such as Socket/sendto/connect-
e trace=signal    signal sending and processing, such as Kill/sigaction-
e trace= Desc  and file descriptor related, such as Write/read/select/epoll-
e TRACE=IPC process to see the classmate related, such as Shmget

Strace Sample

1. Track Nginx to see which files are accessed at startup Strace-tt-t-f-e trace=file-o/data/log/strace.log-s 1024 2>&1./nginx

2. The locator program exits abnormally STRACE-TTF-T-P 10893-o tmp-e trace=process 2>&1

3. Program Startup loading file Strace-e open,acces./sh 2>&1 | grep fileName

4. The selection process is time-consuming Strace-c-P 11084

5. View all system calls Trace-t-tt-f-S 3000-o tmp1.out./tmp.sh | while read line; Do echo $line | Sed '/'/,/'/s#x#\\x#g ' |xargs-0 printf;d One

6. Linked Server failed STRACE-E poll,select,connect,recvfrom,sendto NC www.baidu.com 80

Note: pstree-p PID can view the process tree of the multithreaded procedure. To track specific child processes