Strace is a diagnostic, debugging, and teaching tool for Linux that helps analyze problems by intercepting system calls when a program runs and outputting detailed information. Its core principle is to use the ptrace() system call to control the target process and pause the process every time the system call is to record the call details. Common uses include debugging applications, identifying dependencies, performance analysis, and security auditing. Typical scenarios include failed opening of the location configuration file, blocking network connections, or memory mapping errors. When using it, you can use strace -f mycommand to start a new process, or use strace -p PID to attach to an existing process; common options include -o output to a file, -tt add timestamp, -T display call time, -s increase string display length, and -e trace=xxx specify the tracked system call type. It should be noted that strace will bring performance overhead and is not suitable for long-term operation in production environments.

Strace is a powerful diagnostic, debugging, and instructional tool for Linux. It lets you see what system calls a program is making while it runs — which can be super helpful when trying to understand why something isn't working as expected.

What Happens When You Run strace

When you run a program with strace, it attaches to that process and intercepts all the system calls it makes. These include things like opening files, reading from or writing to sockets, memory allocations, and more. Strace then prints out each call, along with its arguments and return values.

This works by using the ptrace() system call under the hood — a special interface provided by the Linux kernel that allows one process (like strace) to control another (like your application). So every time the traced process tries to make a system call, the kernel pauses it and hands control over to strace so it can log what's happening.

You'll typically see output like this:

 execve("./myprogram", ["./myprogram"], 0x7ffec13c020) = 0
brk(NULL) = 0x55d6e9a0d000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3

Each line shows the system call name, the arguments passed, and the result.

Common Use Cases for Strace

• Debugging applications : If a program crashes or hangs without clear logs, strace helps pinpoint where it's getting stuck.
• Understanding dependencies : You can see which files or libraries a program opens at runtime.
• Performance analysis : Spot slow operations like repeated disk reads or network calls.
• Security audits : Check if a binary is accessing unexpected files or resources.

Some typical scenarios include:

• A script fails to open a config file — strace shows it's looking in the wrong directory.
• A network app hangs — strace reveals it's waiting on a socket connection that never comes.
• A binary segfaults — strace might show it's failing to mmap memory properly.

How to Use Strace Effectively

Start simple:
strace -f mycommand
The -f flag tells strace to follow forks, which is important because many programs spawn child processes.

If you're dealing with an already running process, use:
strace -p PID
That attaches strace to the process ID you specify.

Other useful flags:

• -o filename : Save output to a file instead of printing to screen.
• -tt : Add timestamps to each line.
• -T : Show how much time was spent in each system call.
• -s : Increase the string size displayed (default is short, sometimes not enough).

For example, to trace a long-running service and save output:

 strace -f -o debug.log -p 1234

One thing to keep in mind: strace adds overhead. Programs will run slower under tracing, especially if they make lots of system calls. So don't rely on it in performance-critical environments unless you really need to dig deep.

Also, some system calls are easy to miss if you're not filtering correctly. That's where options like -e trace=open,read,write come in handy — you can focus only on specific calls relevant to your issue.

Basically that's it. Once you get used to reading the output and knowing which flags to reach for, strace becomes a go-to tool for figuring out what's really going on behind the scenes.

The above is the detailed content of How does the strace command work?. For more information, please follow other related articles on the PHP Chinese website!