strace is a utility that can trace system calls. How to use strace for debugging applications or executables ?
strace is a utility that can trace system calls.
System calls are the fundamental interfaces between an applications and the kernel.
They are generally not invoked directly, but rather via wrapper functions in glibc (or perhaps some other library).
For examples: fstat, mmap, open, close
By using strace, we can intercept these system calls for a given process or a given command.
strace is a powerful troubleshooting tool for all unix/linux admins and users.
Strace basic usage
System calls in file
I you want to store strace output in a file, use
strace -o filename command
System call report/summary
strace -c command allows to make a report of system calls. For example:
Here, syscall open generates 14 erros. How to trace these specific calls ?
Trace specific system call
We can use -e option of strace:
We can see clearly that ifconfig try to open missing files. How many ?
Exactly 14 !!! Like in the summary system call report.
Trace multipe system calls
We can use the -e trace=function1,function2, … option
For example to trace mprotect or brk system calls:
Trace specific category of system calls
You can think of this as an abbreviation for -e trace=open,stat,chmod,unlink,… which is useful to seeing what files the process is referencing.
Furthermore, using the abbreviation will ensure that you don’t accidentally forget to include a call like lstat in the list
Trace all system calls which involve process management. This is useful for watching the fork, wait,and exec steps of a process.
Trace all the network related system calls.
Trace all signal related system calls.
Trace all IPC related system calls.
Trace all file descriptor related system calls.
For example to trace specific category network:
Get timestamps operation and time calls
It could be useful to get time entry of a system call or timestamps system calls:
strace -r Relative timestamp upon entry to each system call.
strace -t Prefix each line of the trace with the time of day.
strace -tt Time printed will include the microseconds.
strace -ttt Time printed will include the microseconds and the leading portion will be printed as the number of seconds since the epoch.
What happens if a process fork ?
You can follow system calls if a process fork, -f option follows child process
Attach to an existing process
To attach strace to an existing process:
strace -p PID
Try to connect to the server kali (IP:192.168.1.14):
Now you have something like:
A pair of connected sockets is created: socketpair(…) with the foreign address–>192.168.1.23:45468
Moreover, we can see that a connection is established:
I hope I could help you !!! Strace is a very powerful tool, do not forget man strace !!!
If you found this post or this website helpful and would like to support our work, please consider making a donation. Thank you!