strace

strace is an open source and freely distributed software designed for developers and system administrators, providing a system call tracer implemented in C and designed to run exclusively under GNU/Linux operating systems.

The program is a very useful debugging, instructional and diagnostic utility that can gather all the system calls generated by a program or a process, and print out a trace. It’s a command-line program that can only be used from a console environment or via a terminal emulator app.

The tool can be used by diagnosticians, troubleshooters, as well as system administrators who want a priceless solution for solving problems with closed-source programs. It is written by Dmitry V. Levin, Roland McGrath and Wichert Akkerman.

Command-line options

Like any other command-line software, strace offers a wide variety of command-line options that allow the user to easily use all of its functionality and features in order to achieve their tasks. All of its command-line options can be viewed at a glance by running the ‘strace --help’ command.

Among the most interesting command-line options, we can mention support for counting times, calls and errors for each syscall, support for summarizing syscall latency, support for tracing accesses to a certain path, support for enabling debug output to stderr, as well as support for running a tracer process as a detached grandchild, not as a parent.

Additionally, you will be able to send trace information to a specific file instead of stderr, to set the overhead for tracking syscalls to an overhead usecs, to set a PID file for the trace process, to limit the length of print strings to strsize chars, to run commands as username handling setgid and/or setuid, and to detach on a specific syscall.

Getting started with strace

strace is only distributed as a source tarball, but it can be easily installed on numerous distributions of Linux from their main software repositories. To install it from sources, simply download the latest version from Softoware, save the archive on a location of your choice and unpack it.

Open a Terminal app, go to the location of the extracted archive files (e.g. cd /home/softoware/strace-4.9), run the ./configure && make’ command to configure and compile strace, and then execute the ‘make install’ command as root or the ‘sudo make install’ command as a privileged user to install strace system wide.

What is new in this release:

• Improvements:
• Added -yy option to print protocol and address information associated with socket descriptors.
• Extended "-e read=set" and "-e write=set" options to cover sendmsg, recvmsg, sendmmsg, and recvmmsg syscalls.
• Implemented full 32-bit decoding of ioctl commands (addresses Debian bug #692913 and Fedora bug #902788).
• Implemented PTRACE_GETREGS API support on ia64.
• Implemented PTRACE_GETREGS API support on mips.
• Implemented PTRACE_GETREGSET API support on s390/s390x.
• Implemented decoding of getrandom and seccomp syscalls.
• Implemented full decoding of 64-bit capability sets.
• Implemented decoding of all prctl commands.
• Implemented decoding of parametrized ioctl commands.
• Implemented decoding of evdev ioctl commands.
• Implemented decoding of v4l ioctl commands.
• Implemented decoding of SG_IO v4 ioctl commands.
• Implemented decoding of FIFREEZE/FITHAW/FITRIM ioctl commands.
• Implemented decoding of FALLOC_FL_* fallocate flags.
• Implemented decoding of rt_sigreturn signal mask on aarch64, x32, and x86_64.
• Enhanced socket decoder to support bluetooth sockets.
• Enhanced decoding of unlisted ioctl commands.
• Enhanced decoding of getsockopt and setsockopt syscall.
• Enhanced decoding of sysinfo syscall.
• Enhanced decoding of struct cmsghdr.
• Enhanced decoding of wait status.
• Enhanced aio support on non-x86 architectures by using external libaio.h.
• Added O_TMPFILE to the list of recognized open mode flags.
• Updated the list of filesystem type constants that is used in decoding statfs family syscalls.
• Updated lists of CAP_*, PR_*, PTRACE_*, SCHED_*, SO_*, SOL_*, SWAP_FLAG_*, and TFD_* constants.
• Updated lists of signal constants from Linux 3.19.
• Updated lists of errno constants from Linux 3.19.
• Updated lists of ioctl commands from Linux 3.9.
• Added new syscall entries to match Linux 3.19.
• Bug fixes:
• Fixed various errors in mapping between syscall numbers and associated information like the number of syscall arguments, the name of syscall, and syscall decoder.
• Fixed quoting issues in printing descriptors, filenames, network interface names, struct utsname members, device/volume names of BLK* ioctl commands.
• Fixed uid_t/git_t decoding.
• Fixed potential out-of-bounds read issues in getdents/getdents64 decoders.
• Fixed potential open flags truncation on some architectures.
• Fixed decoding of struct ifreq.ifr_name.
• Fixed decoding of SIOCSIFNAME ioctl command.
• Fixed decoding of RENAME_* renameat2 flags.
• Fixed decoding of UTIME_NOW/UTIME_OMIT timeval structures.
• Fixed decoding of indirect ipc subcalls on some architectures.
• Fixed decoding of fanotify_mark syscall on 32-bit architectures.
• Fixed decoding of 32-bit stat structures on 64-bit architectures.
• Fixed decoding of 32-bit struct cmsghdr on 64-bit architectures.
• Fixed decoding of 32-bit preadv/pwritev offset on 64-bit architectures.
• Fixed decoding of sigreturn/rt_sigreturn signal mask on ia64, ppc, ppc64, sparc, sparc64, mips, and s390.
• Fixed instruction pointer output (-i option) on architectures that support several personalities.
• Fixed behaviour of "-e read=set" and "-e write=set" when read and write sets intersect.
• Fixed build on systems where struct sigaction has no sa_restorer member.
• Fixed build with uclibc and musl libc.
• Portability:
• Linux kernel >= 2.5.46 is required. Older versions without a decent PTRACE_SETOPTIONS support will not work.
• On mips, linux kernel >= 2.6.15 is required. Older versions without a decent PTRACE_GETREGS support will not work.
• On s390 and s390x, linux kernel >= 2.6.27 is required. Older versions without a decent PTRACE_GETREGSET support will not work.

What is new in version 4.9:

• Changes in behavior:
• Disabled OABI support on ARM EABI systems by default, added --enable-arm-oabi option to enable it at configure time.
• Improvements:
• Added experimental -k option to print stack trace after each traced syscall.
• Added -w option to produce stats on syscall latency. (addresses Debian bug #457497).
• Added ARC architecture support.
• Added PTRACE_GETREGS API support on PowerPC.
• Enhanced Bionic libc and musl libc support.
• Enhanced tracing of x86 personality processes on x86_64 and x32.
• Enhanced tracing of ARM personality processes on AArch64.
• Enhanced 32/64bit personality detection on PowerPC.
• Implemented decoding of add_key, ioprio_get, ioprio_set, kexec_load, keyctl, renameat2, and request_key syscalls.
• Robustified decoding of select, pselect, and io_submit syscalls.
• Enhanced decoding of delete_module, fanotify_init, fanotify_mark, fcntl, setdomainname, sethostname, setns, and sync_file_range syscalls.
• Enhanced decoding of signal bitmasks.
• Enhanced decoding of file descriptors.
• Enhanced siginfo_t decoding.
• Enhanced PF_NETLINK decoding.
• Updated CLOCK_* constants (addresses Fedora bug #1088455).
• Added new syscall entries to match Linux 3.16.
• Bug fixes:
• Added shmat and shmdt to the set of memory mapping related syscalls.
• Fixed detaching from stopped processes.
• Fixed fanotify_mark decoding on 32bit architectures.
• Fixed offset decoding in preadv and pwritev syscalls.
• Fixed select decoding for glibc in _FORTIFY_SOURCE mode.
• Fixed decoding of epoll_ctl syscall with EPOLL_CTL_DEL argument.
• Fixed build when and conflict (addresses Fedora bug #993384).
• Miscellaneous corrections in the manual page. (Addresses Debian bug #725987).

What is new in version 4.8:

• Changes in behavior:
• In case of normal strace termination, when the trace output is redirected to a pipe, strace now closes it and waits for the pipe process termination before exit.
• Improvements:
• Implemented tracing using PTRACE_SEIZE API (when available).
• Implemented more reliable PTRACE_GETREGSET-based process personality detection on x86-64 and x32 (when available).
• Added -e trace=memory option for tracing memory mapping related syscalls.
• Documented -b option.
• Allowed exit status messages to be suppressed by giving -q option twice.
• Added AArch64 architecture support (addresses Debian bug #693074 and Fedora bug #969858).
• Added support for OpenRISC 1000, Meta, and Xtensa architectures.
• Added tilegx personality support for Tile.
• Enhanced support of NOMMU architectures.
• Enhanced decoding of getdents, mmap, perf_event_open, ptrace, and quotactl syscalls.
• Added new syscall entries to match Linux 3.9.
• Regenerated the list of common ioctl names from Linux 3.9.
• Updated the list of errno constants.
• Updated lists of AF_*, MADV_*, MAP_*, MSG_*, MS_*, PF_*, PR_*, PTRACE_O_*, and TCP_* constants.
• Implemented decoding of UBI ioctls.
• Removed redundant "*32" ioctl names.
• Bug fixes:
• Fixed ERESTARTNOINTR leaking to userspace on ancient kernels (addresses Fedora bug #659382).
• Fixed kernel release string parsing (addresses Debian bug #702309).
• Fixed decoding of *xattr syscalls (addresses Fedora bug #885233).
• Fixed handling of files with 64-bit inode numbers by 32-bit strace (addresses Fedora bug #912790).
• Fixed tracing forks on SPARC.
• Fixed decoding of fadvise64, fallocate, ftruncate64, io_submit, pread, preadv, pwrite, pwritev, readahead, sigaltstack, sync_file_range, sysctl, and truncate64 syscalls.
• Fixed categories of multiple syscalls on most of supported architectures.
• Fixed decoding of non-native 32-bit personality recv[m]msg syscalls.
• Fixed decoding of multiple 32-bit personality syscalls on x32.
• Fixed decoding of long long syscall arguments on ARM, MIPS/o32, PowerPC, S390x, and Tile architectures.
• Fixed semtimedop decoding on S390x.
• Fixed sram_alloc decoding on Blackfin.
• Fixed build when process_vm_readv is a stab.
• Fixed build with older versions of libaio.h.

What is new in version 4.7:

• This is a stable release, with the usual bugfixes, enhanced support for fresh Linux kernels, and other improvements.

What is new in version 4.6:

• This is a stable release, with usual bugfixes, enhanced support for fresh Linux kernels, and other improvements, including a new method of following clone, fork, and vfork syscalls using the Linux kernel's explicit facilities for tracing creation of threads and child processes.

What is new in version 4.5.20:

• Improvements:
• Implemented decoding of new linux syscalls: inotify_init1, recvmmsg.
• Implemented basic decoding of new linux syscalls: preadv, pwritev, rt_tgsigqueueinfo, perf_event_open.
• Enhanced decoding of recently added syscalls on non-x86 architectures by replacing a bare decoder with elaborate parsers enabled earlier for x86/x86-64.
• Implemented -C option to combine regular and -c output. (Addresses Debian bug #466196)
• Enhanced decoding of mbind and mremap syscalls.
• Enhanced SOL_PACKET socket options decoding.
• Regenerated list of ioctl names from linux 2.6.33.
• Added TILE architecture support.
• Bug fixes:
• Fixed build with Linux kernel headers 2.6.32-rc5+. (Addresses Debian bug #560516 and Fedora bug #539044)
• Fixed build on mips.
• Fixed handling of Linux systems without struct statfs64.
• Fixed reporting signal mask by sigreturn on powerpc.
• Fixed potential stack buffer overflow in select decoder. (Addresses Fedora bug #556678)
• Corrected msgsnd indirect ipccall decoding.
• Corrected decoding of 64bit syscalls. (Addresses Debian bug #570603)
• Corrected getsockopt decoding on architectures where sizeof(long) > sizeof(int). (Addresses Debian bug #494844)
• Corrected decoding of epoll_pwait. (Addresses Debian bug #513014)
• Corrected handling of killed threads.