Linux strace使用

1、簡介

strace是Linux環境下的一款程式調試工具，用來監察一個應用程式所使用的系統呼叫及它所接收的系統資訊。

Strace是一個基礎的調試工具，strace常用來跟蹤進程執行時的系統調用和所接收的訊號。 在Linux世界，進程不能直接存取硬體裝置，當進程需要訪問硬體裝置(比如讀取磁碟檔案，接收網路資料等等)時，必須由使用者態模式切換至核心態模式，通過系統調用訪問硬體裝置。strace可以跟蹤到一個進程產生的系統調用,包括參數，傳回值，執行消耗的時間。

2、下載

：http://sourceforge.net/projects/strace/

[oracle@xml-ora1 ~]$ wgethttp://nchc.dl.sourceforge.net/project/strace/strace/4.7/strace-4.7.tar.xz

3、解壓安裝

這種檔案是使用tar打包後再壓縮產生的。解壓方法是：

　　1、xz -d **.tar.xz

　　2、tar -xvf **.tar

如沒有按照xz工具，則首先需要下載、安裝xz工具：http://tukaani.org/xz/

 

[oracle@xml-ora1 ~]$ wget http://tukaani.org/xz/xz-5.0.4.tar.gz

[oracle@xml-ora1 ~]$ tar -zxvf xz-5.0.4.tar.gz

[oracle@xml-ora1 ~]$ cd xz-5.0.4

[oracle@xml-ora1 xz-5.0.4]$ ./configure

[oracle@xml-ora1 xz-5.0.4]$ make

[oracle@xml-ora1 xz-5.0.4]$ sudo make install

[oracle@xml-ora1 ~]$ xz --help

Usage: xz [OPTION]... [FILE]...

Compress or decompress FILEs in the .xzformat.

  -z,--compress      force compression

  -d, --decompress    force decompression

  -t,--test          test compressed fileintegrity

  -l,--list          list information about.xz files

  -k,--keep          keep (don't delete) inputfiles

  -f,--force         force overwrite of outputfile and (de)compress links

  -c,--stdout        write to standard outputand don't delete input files

  -0... -9           compression preset;default is 6; take compressor *and*

                      decompressor memory usageinto account before using 7-9!

  -e,--extreme       try to improvecompression ratio by using more CPU time;

                      does not affectdecompressor memory requirements

  -q,--quiet         suppress warnings;specify twice to suppress errors too

  -v,--verbose       be verbose; specify twicefor even more verbose

  -h,--help          display this short helpand exit

  -H,--long-help     display the long help(lists also the advanced options)

  -V,--version       display the versionnumber and exit

With no FILE, or when FILE is -, readstandard input.

Report bugs to<lasse.collin@tukaani.org> (in English or Finnish).

XZ Utils home page:<http://tukaani.org/xz/>

 

[oracle@xml-ora1 ~]$ xz -d strace-4.7.tar.xz

[oracle@xml-ora1 ~]$ ls

strace-4.7.tar 

[oracle@xml-ora1 ~]$ tar -xvf strace-4.7.tar

[oracle@xml-ora1 strace-4.7]$ ./configure

[oracle@xml-ora1 strace-4.7]$ make

[oracle@xml-ora1 strace-4.7]$ sudo make install

4、命令說明

[oracle@xml-ora1 strace-4.7]$ strace --help

strace: invalid option -- -

usage: strace [-CdffhiqrtttTvVxxy] [-I n] [-eexpr]...

              [-a column] [-o file] [-sstrsize] [-P path]...

              -p pid... / [-D] [-E var=val]...[-u username] PROG [ARGS]

  or: strace -c[df] [-I n] [-e expr]... [-O overhead] [-S sortby]

              -p pid... / [-D] [-E var=val]...[-u username] PROG [ARGS]

-c -- count time, calls, and errors foreach syscall and report summary統計每一系統調用的所執行的時間,次數和出錯的次數等.

-C -- like -c but also print regular output和-c參數意義，但是輸出更多資訊

-d -- enable debug output to stderr 
輸出strace關於標準錯誤的調試資訊.

-D -- run tracer process as a detachedgrandchild, not as parent

-f -- follow forks, -ff -- with output intoseparate files
 告訴strace同時跟蹤fork出來的進程

-F -- attempt to follow vforks (deprecated,use -f)
告訴strace同時跟蹤vfork出來的進程

-i -- print instruction pointer at time ofsyscall   
輸出系統調用的入口指標.

-q -- suppress messages about attaching,detaching, etc. 
禁止輸出關於脫離的訊息

-r -- print relative timestamp, -t --absolute timestamp, -tt -- with usecs
列印出時間，tt表示微妙

-T -- print time spent in each syscall
列印出每個系統調用的耗費時間

-v -- verbose mode: print unabbreviatedargv, stat, termios, etc. args輸出strace的版本資訊

-x -- print non-ascii strings in hex, -xx-- print all strings in hex以十六進位形式輸出非標準字串

-y -- print paths associated with filedescriptor arguments

-h -- print help message, -V -- printversion輸出簡要的協助資訊.

-a column -- alignment COLUMN for printingsyscall results (default 40)設定結果的輸出預設位置40

-e expr -- a qualifying expression:
指定一個運算式,用來控制如何跟蹤.格式如下

option=[!]all or option=[!]val1[,val2]...

  options: trace, abbrev, verbose, raw, signal, read, or write

-e trace=set

只跟蹤指定的系統調用.例如:-e trace=open,close,rean,write表示只跟蹤這四個系統調用.預設的為set=all

-e trace=file

只跟蹤有關檔案操作的系統調用.

-e trace=process

只跟蹤有關進程式控制制的系統調用.

-e trace=network

跟蹤與網路有關的所有系統調用.

-estrace=signal

跟蹤所有與系統訊號有關的系統調用

-e trace=ipc

跟蹤所有與進程通訊有關的系統調用

-eabbrev=set

設定 strace輸出的系統調用的結果集.-v 等與 abbrev=none.預設為abbrev=all.

-e raw=set

將指 定的系統調用的參數以十六進位顯示.

-esignal=set

指定跟蹤的系統訊號.預設為all.如signal=!SIGIO(或者signal=!io),表示不跟蹤SIGIO訊號.

-e read=set

輸出從指定檔案中讀出的資料.例如:

-e read=3,5

-e write=set

輸出寫入到指定檔案中的資料.

-I interruptible --

   1:no signals are blocked

   2:fatal signals are blocked while decoding syscall (default)

   3:fatal signals are always blocked (default if '-o FILE PROG')

   4:fatal signals and SIGTSTP (^Z) are always blocked

     (useful to make 'strace -o FILE PROG' not stop on ^Z)

-o file -- send trace output to FILEinstead of stderr
將strace的輸出寫入檔案filename

-O overhead -- set overhead for tracingsyscalls to OVERHEAD usecs

-p pid -- trace process with process idPID, may be repeated跟蹤指定的進程pid.

-s strsize -- limit length of print stringsto STRSIZE chars (default 32)
指定輸出的字串的最大長度.預設為32.檔案名稱一直全部輸出

-S sortby -- sort syscall counts by: time,calls, name, nothing (default time)

-u username -- run command as usernamehandling setuid and/or setgid以username
的UID和GID執行被跟蹤的命令

-E var=val -- put var=val in theenvironment for command輸出變數值

-E var -- remove var from the environmentfor command

-P path -- trace accesses to path

 

5、執行個體使用5.1 一個簡單的跟蹤

有個檔案a.txt，我們跟蹤下cat檔案的系統調用過程：

[oracle@xml-ora1 ~]$ cat a.txt

hello welcome!

12344

[oracle@xml-ora1 ~]$ strace -o cat.log cat a.txt

hello welcome!

12344

[oracle@xml-ora1 ~]$ cat cat.log

execve("/bin/cat",["cat", "a.txt"], [/* 30 vars */]) = 0

open("/lib/libc.so.6",O_RDONLY)        = 3

open("/etc/ld.so.cache",O_RDONLY)      = 3

open("/lib64/libc.so.6",O_RDONLY)      = 3

open("a.txt", O_RDONLY)                 = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=21,...}) = 0

read(3, "hellowelcome!\n12344\n", 4096) = 21

write(1, "hellowelcome!\n12344\n", 21) = 21

read(3, "", 4096)                       = 0

close(3)                                = 0

close(1)                                = 0

exit_group(0)                           = ?

+++ exited with 0 +++

 

                追蹤檔案cat.log裡一大堆的東西，前面大部分都是在讀取系統內容資訊以及庫檔案，最後才是cat調用系統的資訊。同時可以看到一個現象，只有是Open=3的，則說明載入庫檔案成功，而=-1的載入失敗。

5.2 oracle sqlplus跟蹤

[oracle@xml-ora1 ~]$ strace -o sqlplus-trace.txtsqlplus / as sysdba

SQL*Plus: Release 10.2.0.4.0 - Productionon Wed Dec 19 15:32:39 2012

Copyright (c) 1982, 2007, Oracle.  All Rights Reserved.

Connected to:

Oracle Database 10g Enterprise EditionRelease 10.2.0.4.0 - 64bit Production

With the Partitioning, OLAP, Data Miningand Real Application Testing options

SQL> exit

 

[oracle@xml-ora1 ~]$ cat sqlplus-trace.txt | more

載入執行的程式路徑，環境變數，系統庫資訊

execve("/u01/app/oracle/product/10.2/db_1/bin/sqlplus",["sqlplus", "/", "as", "sysdba"], [/*30 vars */]) = 0

brk(0)                                  = 0xe747000

mmap(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ae1dec57000

uname({sys="Linux",node="xml-ora1", ...}) = 0

open("/u01/app/oracle/product/10.2/db_1/lib/libsqlplus.so",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/lib/libclntsh.so.10.1",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/lib/libnnz10.so",O_RDONLY) = 3

open("/lib/libdl.so.2",O_RDONLY)       = 3

open("/etc/ld.so.cache",O_RDONLY)      = 3

open("/lib64/libdl.so.2",O_RDONLY)     = 3

open("/lib/libm.so.6",O_RDONLY)        = 3

open("/lib64/libm.so.6",O_RDONLY)      = 3

open("/lib/libpthread.so.0", O_RDONLY)  = 3

open("/lib64/libpthread.so.0",O_RDONLY) = 3

open("/lib/libnsl.so.1",O_RDONLY)      = 3

open("/lib64/libnsl.so.1",O_RDONLY)    = 3

open("/lib/libc.so.6",O_RDONLY)        = 3

open("/lib64/libc.so.6",O_RDONLY)      = 3

以下是載入oracle字元集檔案

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx1boot.nlb",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx00001.nlb",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx20001.nlb",O_RDONLY) = 3                             

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx10001.nlb",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx31040.nlb",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/nls/data/lx40001.nlb",O_RDONLY) = 3

以下載入sqlplus的一些檔案，待研究，有些名字很清晰表達了組件的作用

open("/etc/hosts", O_RDONLY)            = 8

open("/u01/app/oracle/product/10.2/db_1/sqlplus/mesg/sp1us.msb",O_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db_1/sqlplus/mesg/sp2us.msb",O_RDONLY) = 4

open("/u01/app/oracle/product/10.2/db_1/sqlplus/mesg/cpyus.msb",O_RDONLY) = 5

open("/etc/localtime",O_RDONLY)        = 6

open("/u01/app/oracle/product/10.2/db_1/oracore/zoneinfo/timezlrg.dat",O_RDONLY) = 6

輸出互動資訊到螢幕

write(1, "\n", 1)                       = 1

write(1, "SQL*Plus: Release 10.2.0.4.0- P"..., 70) = 70

write(1, "\n", 1)                       = 1

write(1, "Copyright (c) 1982, 2007,Oracle"..., 56) = 56

write(1, "\n", 1)                       = 1

初始化sqlplus

getcwd("/home/oracle", 256)             = 13

access("/u01/app/oracle/product/10.2/db_1/network/admin/sqlnet.ora",F_OK) = 0

open("/u01/app/oracle/product/10.2/db_1/network/admin/sqlnet.ora",O_RDONLY) = 7

open("/etc/passwd",O_RDONLY)           = 7

open("/u01/app/oracle/product/10.2/db_1/sqlplus/admin/glogin.sql",O_RDONLY) = 8

write(1, "SQL> ", 5) 

                這個就是SQLPLUS初始化的過程，當然可以加上-f選項，此時看到的就是更詳細的調用了。