> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/cheatsheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/cheatsheets/debugging-executables/strace.md).

# strace

strace cheatsheet by Thamizhiniyan C S

## Introduction

strace is a command-line linux tool used to trace system calls and signals

Use Cases:

* Debugging Programs
* Troubleshooting Programs
* Intercept System calls by a process
* Record system calls by a process
* Signals received by a process
* Trace running processes

***

## Installation

```bash
# Debian
sudo apt install strace

# Fedora
yum install strace
```

***

## Syntax

`strace [OPTIONS] [EXECUTABLE_FILE]`

***

## Important Flags

| Flag                              | Description                                                                                                                              |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| `-c, --summary-only`              | count time, calls, and errors for each syscall and report summary                                                                        |
| `-C, --summary`                   | like -c, but also print the regular output                                                                                               |
| `-e trace=TRACE`                  | trace only specified syscalls                                                                                                            |
| `-e signal=SET, --signal=SIGNALS` | trace only the specified set of signals. print only the signals from SET                                                                 |
| `-e status=SET, --status=STATUS`  | print only system calls with the return statuses in SET                                                                                  |
| `-f`                              | Follow threads and child processes that are created.                                                                                     |
| `-r`                              | print relative timestamp                                                                                                                 |
| `-i`                              | print instruction pointer at time of syscall                                                                                             |
| `-T, --syscall-times[=PRECISION]` | print time spent in each syscall \[precision: default is microseconds]                                                                   |
| `-t, --fields=LIS`                | print absolute timestamp of each system call (wall clock time)                                                                           |
| `-o FILE, --output=FILE`          | send trace output to FILE instead of stderr                                                                                              |
| `-p PID, --attach=PID`            | trace process with process id PID, may be repeated                                                                                       |
| `-u USERNAME, --user=USERNAME`    | run command as USERNAME handling setuid and/or setgid                                                                                    |
| `-s [size]`                       | Print \[size] characters per string displayed. This is useful if you are trying to trace what a program is writing to a file descriptor. |

### TRACE values

`open, close, write, network, signal`

### STATUS values

`successful, failed, unfinished, unavailable, detached`

### PRECISION values

`s, ms, us, ns`

***

## Examples

<table><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace ls
</code></pre></td><td>Trace system calls of the `ls` command.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -c ls
</code></pre></td><td>Count the number of system calls.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -e trace=write ls
</code></pre></td><td>Trace only the `write` system calls of the `ls` command.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -e trace=network nc -v -n 127.0.0.1 801
</code></pre></td><td>Trace network-related system calls of the `nc` command.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -e trace=signal nc -v -n 127.0.0.1 801
</code></pre></td><td>Trace signal-related system calls of the `nc` command.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -r ls
</code></pre></td><td>Print the timestamp of each system call.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -T ls
</code></pre></td><td>Print time spent on each system call.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -t ls
</code></pre></td><td>Print wall clock time of each system call.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -i ls
</code></pre></td><td>Print the instruction pointer of each system call.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace pid
</code></pre></td><td>Trace a running process by PID.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -p [pid]
</code></pre></td><td>Trace a running process by PID.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -fp [pid]
</code></pre></td><td>Trace a running process and its threads.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -s 80 -fp [pid]
</code></pre></td><td>Trace a running process, print first 80 characters of strings.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace ./program
</code></pre></td><td>Trace a program.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -f ./program
</code></pre></td><td>Trace a program and its threads.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -s 80 -f ./program
</code></pre></td><td>Trace a program, print first 80 characters of strings.</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -Tf ./program 2>&#x26;1 | grep -v futex
</code></pre></td><td>To exclude futex calls</td></tr><tr><td><pre class="language-bash" data-overflow="wrap"><code class="lang-bash">strace -Tfe trace=open,read,write ./program
</code></pre></td><td>Trace specific system calls (open, read, write) for a program and its threads.</td></tr></tbody></table>

***

## References

<https://www.geeksforgeeks.org/strace-command-in-linux-with-examples/>

<https://blog.packagecloud.io/strace-cheat-sheet/>