NAME

strace — trace system calls

SYNOPSIS

DESCRIPTION

strace executes program with the provided arguments in a new process, tracing all its system calls, and writing their invocations to the standard error.

Each output line contains the system call, the value of the parameters, and the return value. Every thread in the process is traced, but descendant processes are not traced unless the option -f is used. strace will exit when it is no longer tracing any processes.

The options are as follows:

-f

Recursively trace all descendant processes and all their threads.

-o file

Write the system call invocations to the file instead of the standard error. If -p is not used, then all signals will be blocked in order to make strace into a silent observer that doesn't act on the signals.

-p pid

Attach to the process with this pid instead of starting a new process.

FILES

/include/sortix/syscall.h

Public system call numbers.

/include/sortix/kernel/syscall.h

Internal kernel function signatures for each system call.

EXIT STATUS

strace will exit as the invoked program did when all traced processes have exited, exit 125 on an error, and exit 127 if the program does could not be executed.

If -p is used, then strace exits 0 on success instead.

HISTORY

strace is meant to be compatible with the traditional program that is portable to many systems. This implementation originally appeared in Sortix 1.1.

BUGS

The underlying psctl(2) PSTCTL_STRACE system call is not yet considered and and official kernel interface yet, and will be changed in the future, possibly to become ptrace(2). This interface is not subject to the usual kernel ABI compatibility rules. The strace program and the kernel(7) must be synchronized as compatible versions from the same base system.

strace is using a fundamentally asynchronous kernel implementation, where the kernel fill a pipe(2) buffer with system call details, which strace will report after the fact. Traditionally strace is synchronous, which is not the case here yet.

strace is not able to peek inside the memory of processes, and cannot deference pointers to input/output data. It also is not aware of the format of the data structures, even if it could access the memory. Pointers will be written only as their numeric value and type.

SEE ALSO

gdb(1), time(1), timeout(1), psctl(2), syscall(2)