Use of strace

Strace command usage
Author: Source: ZZ published on:
Http://blog.linuxmine.com/i554
 
Strace command usage

Call:
Strace [-dffhiqrttttvxx] [-Acolumn] [-eexpr]...
[-Ofile] [-ppid]... [-sstrsize] [-uusername] [Command [arg...]
 
Strace-C [-eexpr]... [-ooverhead] [-ssortby] [Command [arg...]
Function:

-F tracks the sub-processes generated by the fork call.
-FF if-O filename is provided, the trace results of all processes are output to the corresponding filename. PID, which is the process number of each process.
-F attempts to trace vfork calls. In-F, vfork is not tracked.
-H outputs brief help information.
-I output the entry pointer of the system call.
-Q: Do not output the message about the disconnection.
-R prints the relative time, which is called by every system.

Write strace output to file filename
-P PID

 
_ Kde_icetranssocketcreatelistener: failed to bind listener
_ Kde_icetranssocketunixcreatelistener:... socketcreatelistener () failed
_ Kde_icetransmakeallcotsserverlisteners: failed to create listener for local
 
Cannot establish any listening sockets dcopserver self-test failed.
 
 
This error message does not make much sense for me, but a program that is crucial to KDE for inter-process communication cannot be started.
I can also know that this error is related to the ice protocol (Inter client exchange). Besides, I don't know what KDE is
The cause of an error.
 
I decided to use strace to check what the program did when I started dcopserver:
 

27207 mkdir ("/tmp/. Ice-Unix", 0777) =-1 eexist (file exists)
27207 lstat64 ("/tmp/. Ice-Unix", {st_mode = s_ifdir | s_isvtx | 0755, st_size = 4096,...}) = 0
27207 unlink ("/tmp/. Ice-UNIX/dcop27207-1066844596") =-1 enoent (no such file or directory)
27207 BIND (3, {sin_family = af_unix, Path = "/tmp/. Ice-UNIX/dcop27207-1066844596"}, 38) =-1 eacces (permission
Denied)
27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "socketcreatelistener: failed to"..., 46) = 46
27207 close (3) = 0 27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "socketunixcreatelistener:... Soc"..., 59) = 59
27207 umask (0) = 0 27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "makeallcotsserverlisteners: fail"..., 64) = 64
27207 write (2, "cannot establish any listening s"..., 39) = 39
 
 
The/tmp/. Ice-Unix directory has the permission of 0777. This operation fails because the directory already exists.
Lstat64) checks the directory status and displays that the permission for this directory is 0755.
Line Error clue: The program tries to create a directory with the property of 0777, but a directory with the property of 0755 already exists. The
The Unified Call (unlink) tries to delete a file, but this file does not exist. This is not surprising, because this operation is just trying to delete
An old file may exist.
 
However, the fourth line confirms the error/tmp/. Ice-UNIX/dcop27207-1066844596, but a rejection occurs.
Access Error .. The users and groups in the ice_unix directory are root and only the owner has the write permission. A non-root user cannot
If a file is created under this directory and the Directory attribute is changed to 0777, the previous operation may be executed.
The operation that you performed when the error occurs.
 
So after I run chmod 0777/tmp/. Ice-Unix, Kde can be started normally. The problem is solved, and strace is used
Tracing debugging only takes a few minutes to track the program running and then check and analyze the output file.

Bit (Sticky Bit ). Setting a sticky position for a directory prevents a user from deleting files of others under the writable directory at will. Average
The/tmp directory is set to a sticky bit for this reason. After KDE can be started normally, run chmod + T/tmp/. Ice-Unix to. Ice
_ Unix: sets the sticky bit.
 
[Bold] solve the library dependency problem [/bold]

-T add time information before each row in the output.
-TT adds time information before each row in the output, in microseconds.
-TTT microsecond-level output, expressed in seconds.
-T shows the time consumed by each call.
-V outputs all system calls. Some calls about environment variables, status, input and output are not output by default due to frequent calls.
-V outputs the strace version.
-X outputs non-standard strings in hexadecimal format
-Xx all strings are output in hexadecimal format.
-A column
Set the output position of the returned value. The default value is 40.
-E expr
Specify an expression to control how to trace. The format is as follows:
[Qualifier =] [!] Value1 [, value2]...
Qualifier can only be trace, abbrev, verbose, raw, signal, read, and write. value is a defined symbol or number.
The qualifier is a trace. Exclamation point is a negative symbol. For example:
-Eopen is equivalent to-e trace = open, indicating that only open calls are tracked.-etrace! = Open indicates other calls except open
Use. There are two special symbols: All and none.
Note that some shells are used! To execute the commands in the history, so use //.

-E trace = Set
Only trace the specified system calls. For example,-e trace = open, close, rean, write indicates that only the four system calls are tracked. The default value is set =.
Ll.
-E trace = File
Only system calls related to file operations are tracked.
-E trace = Process
Only system calls related to process control are tracked.
-E trace = Network
Tracks all network-related system calls.
-E strace = Signal
Tracks all system calls related to system signals
-E trace = IPC
Trace all system calls related to process Communication
-E abbrev = Set
Set the result set of the System Call output by strace, such as-V and abbrev = none. The default value is abbrev = All.
-E raw = Set
Displays the specified system call parameters in hexadecimal format.
-E signal = Set
System signal of the trail. The default value is all. For example, signal =! Sigio (or signal =! Io), indicating that the sigio signal is not tracked.
-E read = Set
Output the data read from the specified file. For example:
-E read = 3, 5
-E write = Set
Output data written to the specified file.
-O filename

Write strace output to file filename
-P PID
Trace the specified process PID.
-S strsize
Specify the maximum length of the output string. The default value is 32. The file name is always output.
-U Username
Run the following command with the UID and gid of username.


Use strace to debug programs
In the ideal world, whenever a program cannot normally execute a function, it will give a useful error message, telling you
Enough clues to correct errors. Unfortunately, we do not live in the ideal world, at least not always. Yes
When a program has a problem, you cannot find the cause.
 
This is why debugging Programs appear. Strace is an essential debugging tool used to monitor system calls. You can
Debug a new program or a running program (BIND strace to an existing PID ).
 
First, let's look at a real example:
 
[Bold] a problem occurs when KDE is started. [/bold]
 
Some time ago, I had a problem when I started Kde, And the KDE error message could not help me with any clues.
 
Code:

 
_ Kde_icetranssocketcreatelistener: failed to bind listener
_ Kde_icetranssocketunixcreatelistener:... socketcreatelistener () failed
_ Kde_icetransmakeallcotsserverlisteners: failed to create listener for local
 
Cannot establish any listening sockets dcopserver self-test failed.
 
 
This error message does not make much sense for me, but a program that is crucial to KDE for inter-process communication cannot be started.
I can also know that this error is related to the ice protocol (Inter client exchange). Besides, I don't know what KDE is
The cause of an error.
 
I decided to use strace to check what the program did when I started dcopserver:
 
Code:
 
Strace-f-o ~ /Dcop-strace.txt dcopserver
 
 
Here, the-f option tells strace to track both the fork and vfork processes. The-O option writes all strace output ~ /Dcop-St
In race.txt, dcopserver is the program to be started and debugged.
 
After an error occurs again, I checked the dcop-strace.txt OF THE ERROR output file, which contains many records of system calls. Run the program
The relevant records before the error are as follows:
 
Code:

27207 mkdir ("/tmp/. Ice-Unix", 0777) =-1 eexist (file exists)
27207 lstat64 ("/tmp/. Ice-Unix", {st_mode = s_ifdir | s_isvtx | 0755, st_size = 4096,...}) = 0
27207 unlink ("/tmp/. Ice-UNIX/dcop27207-1066844596") =-1 enoent (no such file or directory)
27207 BIND (3, {sin_family = af_unix, Path = "/tmp/. Ice-UNIX/dcop27207-1066844596"}, 38) =-1 eacces (permission
Denied)
27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "socketcreatelistener: failed to"..., 46) = 46
27207 close (3) = 0 27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "socketunixcreatelistener:... Soc"..., 59) = 59
27207 umask (0) = 0 27207 write (2, "_ kde_icetrans", 13) = 13
27207 write (2, "makeallcotsserverlisteners: fail"..., 64) = 64
27207 write (2, "cannot establish any listening s"..., 39) = 39
 
 
The/tmp/. Ice-Unix directory has the permission of 0777. This operation fails because the directory already exists.
Lstat64) checks the directory status and displays that the permission for this directory is 0755.
Line Error clue: The program tries to create a directory with the property of 0777, but a directory with the property of 0755 already exists. The
The Unified Call (unlink) tries to delete a file, but this file does not exist. This is not surprising, because this operation is just trying to delete
An old file may exist.
 
However, the fourth line confirms the error/tmp/. Ice-UNIX/dcop27207-1066844596, but a rejection occurs.
Access Error .. The users and groups in the ice_unix directory are root and only the owner has the write permission. A non-root user cannot
If a file is created under this directory and the Directory attribute is changed to 0777, the previous operation may be executed.
The operation that you performed when the error occurs.
 
So after I run chmod 0777/tmp/. Ice-Unix, Kde can be started normally. The problem is solved, and strace is used
Tracing debugging only takes a few minutes to track the program running and then check and analyze the output file.
 
Note: Running chmod 0777 is only a test, generally

Bit (Sticky Bit ). Setting a sticky position for a directory prevents a user from deleting files of others under the writable directory at will. Average
The/tmp directory is set to a sticky bit for this reason. After KDE can be started normally, run chmod + T/tmp/. Ice-Unix to. Ice
_ Unix: sets the sticky bit.
 
[Bold] solve the library dependency problem [/bold]
 
Another use of starce is to solve problems related to dynamic libraries. When you run LDD on an executable file, it tells you how
Use the dynamic library and find the location of the dynamic library. However, if you are using an older glibc version (2.2 or earlier), you may
There is a bug in the LDD program, it may report that a dynamic library is found in a directory, but dynamic connection is true when the program is running
The Program (/lib/ld-linux.so.2) may go to another directory to find the dynamic Connection Library. This is usually because/etc/lD. So. conf and/etc/lD.
The so. cache file is inconsistent, or/etc/lD. So. cache is damaged. LD-li in glibc 2.3.2
This Nux bug has been fixed.
 
In this case, LDD does not list the dynamic libraries that all programs depend on. The system calls dlopen to automatically call
Dynamic library, which may not be listed by LDD. The NSS (name server switch) library is part of glibc.
A typical example is that NSS is used to tell the application where to find the system account database. The application is not straight
Connect to the NSS library, and glibc will automatically transfer to the NSS library through dlopen. If such a database is accidentally lost, you will not be notified of its existence.
Library dependency problems, but such a program can not get the user ID through username resolution. Let's take an example:
 
The whoami program will give your own user name. This program is used in scripts of real users who need to know the program.
Useful. An example of whoami output is as follows:
Code:
 
# Whoami
Root

 
 
Assume that the library NSS responsible for user name and user ID conversion is lost during glibc upgrade for some reason, we can
Library name to simulate this environment:
Code:
 
# Mv/lib/libnss_files.so.2/lib/libnss_files.so.2.backup
# Whoami
Whoami: cannot find username for UID 0
 
 
Here you can see that an error occurs when running whoami, and the output of the LDD program does not provide useful help:
Code:
 
# LDD/usr/bin/whoami
Libc. so.6 =>/lib/libc. so.6 (0x4001f000)
/Lib/ld-linux.so.2 =>/lib/ld-linux.so.2 (0x40000000)
 
 
You will only see whoami dependent on libc. so.6 and ld-linux.so.2, it does not give other libraries necessary to run whoami. Used here
Output of strace when tracking whoami:
Code:
 
Strace-O whoami-strace.txt whoami
 
Open ("/lib/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Open ("/lib/i686/MMX/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Stat64 ("/lib/i686/MMX", 0xbffff190) =-1 enoent (no such file or directory)
Open ("/lib/i686/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Stat64 ("/lib/i686", 0xbffff190) =-1 enoent (no such file or directory)

Open ("/lib/MMX/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Stat64 ("/lib/MMX", 0xbffff190) =-1 enoent (no such file or directory)
Open ("/lib/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Stat64 ("/lib", {st_mode = s_ifdir | 0755, st_size = 2352,...}) = 0
Open ("/usr/lib/i686/MMX/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
Stat64 ("/usr/lib/i686/MMX", 0xbffff190) =-1 enoent (no such file or directory)
Open ("/usr/lib/i686/libnss_files.so.2", o_rdonly) =-1 enoent (no such file or directory)
 
 
You can find libnss. so.2 attempts in different directories, but all failed. Without tools like strace, it's hard
This error is caused by the lack of dynamic libraries. Now you only need to find libnss. so.2 and put it back to the correct position.
 
[Bold] Restrict strace to only trace specific system calls. [/bold]
 
If you already know what you are looking for, you can have strace trace only some types of system calls. For example, you need to check whether
Re script execve. Let strace record only execve calls with this life
Order:
 
Code:
 
Strace-f-o configure-strace.txt-e execve./configure
 
 
Some output results are as follows:
Code:
 
2720 execve ("/usr/bin/expr", ["expr", "A", ":", "(a)"], [/* 31 vars */]) = 0
2725 execve ("/bin/basename", ["basename", "./configure"], [/* 31 vars */]) = 0
2726 execve ("/bin/chmod", ["chmod", "+ X", "conftest. Sh"], [/* 31 vars */]) = 0

2729 execve ("/bin/RM", ["RM", "-F", "conftest. Sh"], [/* 31 vars */]) = 0
2731 execve ("/usr/bin/expr", ["expr", "99", "+", "1"], [/* 31 vars */]) = 0
2736 execve ("/bin/ln", ["ln", "-s", "conf2693.file", "conf2693"], [/* 31 vars */]) = 0
 
 
As you can see, strace can be used not only by programmers, but also by Common System Administrators and Users to debug system errors.
Error. It must be admitted that the output of strace is not always easy to understand, but many outputs are not important to most people. You will learn
Find the information you may need from a large number of outputs, such as permission errors and files not found, then strace will become a powerful
.