Strace

lastmod 2026-02-04created 2015-03-2415 edits

strace is a system call tracer, i.e. a debugging tool which prints out a trace of all the system calls made by a another process/program.

Lets you check which system function calls are used.

About

• [Recommended] strace, the magic tool ¹

strace is a debugging tool that traces the system calls and signals used by applications to check whether any part is causing performance degradation or errors.

Simple Usage

# 실행 중인 프로세스에 attach / Attach to running process
strace -p <PID> -e trace=openat,open,close -f -t 2>&1 | tee /tmp/trace.log

# 새로 실행하며 추적 / Trace from start
strace -e trace=openat,open,close -f -t -o /tmp/trace.log ./my_program

• -f - Also trace child processes
• -t - Print timestamps

See also

• Valgrind
• DrMemory
• Pin
• DynamoRIO
• ftrace
• syscall (System call)
• syslog
• ltrace
• fuser - Find processes using a specific file/port
• inotifywait - Watch a specific file/directory
• bpftrace/bcc - Minimal overhead, suitable for production environments
• auditd - System-level audit logs (can be configured persistently)
• lsof

Favorite site

• strace project site
• Wikipedia (en) description of strace
• Sourceforge strace project page
• strace, a tool for Linux debugging (1)
• (Linux) strace - Let's trace system calls and signals~ :: :: heestory.me ::
• [Recommended] UNIX as IDE: 6. Debugging (strace, ltrace)

References