strace v5.6 releases: diagnostic, debugging and instructional userspace utility

by do son · Published July 12, 2019 · Updated April 7, 2020

strace – the Linux syscall tracer

strace is a diagnostic, debugging and instructional userspace utility for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state.

System administrators, diagnosticians, and troubleshooters will find it invaluable for solving problems with programs for which the source is not readily available since they do not need to be recompiled in order to trace them.

The operation of strace is made possible by the kernel feature known as ptrace.

Some of the features

Attach to an already running process
```
$ strace -p 26380
strace: Process 26380 attached
...
```

Filter by type of syscall

-e trace=%desc     Trace all file descriptor related system calls.
         %file     Trace all system calls which take a file name as an argument.
         %fstat    Trace fstat and fstatat syscall variants.
         %fstatfs  Trace fstatfs, fstatfs64, fstatvfs, osf_fstatfs, and osf_fstatfs64 system calls.
         %ipc      Trace all IPC related system calls.
         %lstat    Trace lstat syscall variants.
         %memory   Trace all memory mapping related system calls.
         %network  Trace all the network related system calls.
         %process  Trace all system calls which involve process management.
         %pure     Trace syscalls that always succeed and have no arguments.
         %signal   Trace all signal related system calls.
         %stat     Trace stat syscall variants.
         %statfs   Trace statfs, statfs64, statvfs, osf_statfs, and osf_statfs64 system calls.
         %%stat    Trace syscalls used for requesting file status.
         %%statfs  Trace syscalls related to file system statistics.

Trace only system calls accessing given path

$ strace -P /etc/ld.so.cache ls /var/empty
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=22446, ...}) = 0
mmap(NULL, 22446, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b7ac2ba9000
close(3) = 0
+++ exited with 0 +++

Perform a full hexadecimal and ASCII dump of all the data read from/written to file descriptors

$ strace -ewrite=1 -e trace=sendmsg ./recvmsg > /dev/null
sendmsg(1, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="012", iov_len=3},
{iov_base="34567", iov_len=5}, {iov_base="89abcde", iov_len=7}], msg_iovlen=3,
msg_controllen=0, msg_flags=0}, 0) = 15
 * 3 bytes in buffer 0
 | 00000  30 31 32                                          012              |
 * 5 bytes in buffer 1
 | 00000  33 34 35 36 37                                    34567            |
 * 7 bytes in buffer 2
 | 00000  38 39 61 62 63 64 65                              89abcde          |
+++ exited with 0 +++

Perform a syscall fault injection

$ strace -e trace=open -e fault=open cat
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOSYS (Function not implemented) (INJECTED)
open("/lib/x86_64-linux-gnu/tls/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOSYS (Function not implemented) (INJECTED)
open("/lib/x86_64-linux-gnu/tls/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOSYS (Function not implemented) (INJECTED)
open("/lib/x86_64-linux-gnu/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOSYS (Function not implemented) (INJECTED)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOSYS (Function not implemented) (INJECTED)
cat: error while loading shared libraries: libc.so.6: cannot open shared object file: Error 38
+++ exited with 127 +++

Count time, calls, and errors for each system call

$ strace -c ls > /dev/null
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 89.76    0.008016           4      1912           getdents
  8.71    0.000778           0     11778           lstat
  0.81    0.000072           0      8894           write
  0.60    0.000054           0       943           open
  0.11    0.000010           0       942           close
  0.00    0.000000           0         1           read
  0.00    0.000000           0       944           fstat
  0.00    0.000000           0         8           mmap
  0.00    0.000000           0         4           mprotect
  0.00    0.000000           0         1           munmap
  0.00    0.000000           0         7           brk
  0.00    0.000000           0         3         3 access
  0.00    0.000000           0         1           execve
  0.00    0.000000           0         1           sysinfo
  0.00    0.000000           0         1           arch_prctl
------ ----------- ----------- --------- --------- ----------------
100.00    0.008930                 25440         3 total

Changelog v5.6

Changes in behaviour
- Messages about unknown tracees are now subject to the strace’s quietness
  setting (-q/--quiet).
- If -A option is provided without -o, or -S option without -c/-C, a warning
  about its uselessness is printed now.
- The usage of --seccomp-bpf without -f has no effect now.
Improvements
- Every short option now has a long option alias, which also has enabled
  the following improvements:
  - Ability to use human-readable settings for -I/--interruptible,
    -D/--daemonize options.
  - Ability to silence specific messages using -e quiet/--quiet qualifier
    (an alias for the -q option), including those that couldn’t be silenced
    previously (path resolution messages and "superseded by execve").
  - Ability to specify selected fd decoding features using
    -e decode-fds/--decode-fds qualifier (an alias for the -y option).
  - Ability to set precision for the absolute timestamp, relative timestamp,
    and syscall time output (using --absolute-timestamps,
    --relative-timestamps, and --syscall-times options, respectively).
- Implemented ability to select the set of displayed columns in the call
  summary output (-U/--summary-columns option).
- Implemented ability to sort on any summary column.
- Implemented ability to show information about minimum and maximum call
  duration in the call summary output (addresses Debian bug #240945).
- Implemented printing of PIDs associated with pidfds in -yy mode.
- Implemented PTRACE_GETREGS API support on hppa, sh, sh64, and xtensa.
- Improved performance of libdw-based stack traces printing by implementing
  a symbol-to-address cache.
- Implemented decoding of openat2 and pidfd_getfd syscalls.
- Enhanced io_uring_register, prctl, sched_getattr, and sched_setattr syscall
  decoding.
- Implemented decoding of BPF_MAP_LOOKUP_BATCH,
  BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, and
  BPF_MAP_DELETE_BATCH bpf syscall commands.
- Enhanced decoding of BPF_MAP_CREATE and BPF_PROG_ATTACH bpf syscall
  commands.
- Enhanced decoding of RTC_VL_READ ioctl command.
- Enhanced decoding of IFLA_\* netlink attributes.
- Implemented HIDIOCGRAWUNIQ() ioctl command number printing.
- Wired up kexec_file_load syscall on hppa.
- Updated lists of AUDIT_\*, BPF_\*, CLONE_\*, GRND_\*, IFLA_\*, IORING_\*,
  IPPROTO_\*, KEY_\*, KVM_\*, RTM_F_\*, SCHED_\*, and \*_MAGIC constants.
- Updated lists of ioctl commands from Linux 5.6.
Bug fixes
- Fixed build on csky abiv1 architecture.
- Various minor fixes in VIDIOC_\* ioctl output formatting.
- Fix printing of the size field for _IOC_NONE ioctl command numbers on sparc.
Portability
- On hppa, linux kernel >= 4.7 is required.
  On sh and sh64, linux kernel >= 2.6.28 is required.
  Older versions without a decent PTRACE_GETREGS support will not work.

Install

git clone https://github.com/strace/strace.git
cd strace
./configure && make && make install

Tutorial

Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
Copyright (c) 1993 Ulrich Pegelow <pegelow@moorea.uni-muenster.de>
Copyright (c) 1995, 1996 Michael Elizabeth Chastain <mec@duracef.shout.net>
Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
Copyright (c) 1998-2001 Wichert Akkerman <wakkerma@deephackmode.org>
Copyright (c) 2001-2018 The strace developers.
All rights reserved.

Source: https://github.com/strace/

strace v5.6 releases: diagnostic, debugging and instructional userspace utility

Search

Suggested Reading