7 strace examples to debug the execution of a program in linux

18 13Like

HomeAboutFree eBookArchivesBest of the BlogContact

7 Strace Examples to Debug the Execu5on of a Program in Linuxby Balakrishnan Mariyappan on November 23, 2011

TweetTweet 33

Strace is a debugging tool that will help you troubleshoot issues.

Strace monitors the system calls and signals of a specific program. It is helpful when you do not have the source code and would like to debug the execuIon ofa program. strace provides you the execuIon sequence of a binary from start to end.

This arIcle explains 7 strace examples to get you started.

1. Trace the Execu5on of an Executable

You can use strace command to trace the execuIon of any executable. The following example shows the output of strace for the Linux ls command.

$ strace lsexecve("/bin/ls", ["ls"], [/* 21 vars */]) = 0brk(0) = 0x8c31000access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)mmap2(NULL, 8192, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb78c7000access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)open("/etc/ld.so.cache", O_RDONLY) = 3fstat64(3, {st_mode=S_IFREG|0644, st_size=65354, ...}) = 0.........

2. Trace a Specific System Calls in an Executable Using Op5on -‐e

Be default, strace displays all system calls for the given executable. To display only a specific system call, use the strace -‐e opIon as shown below.

$ strace -e open lsopen("/etc/ld.so.cache", O_RDONLY) = 3open("/lib/libselinux.so.1", O_RDONLY) = 3open("/lib/librt.so.1", O_RDONLY) = 3open("/lib/libacl.so.1", O_RDONLY) = 3open("/lib/libc.so.6", O_RDONLY) = 3open("/lib/libdl.so.2", O_RDONLY) = 3open("/lib/libpthread.so.0", O_RDONLY) = 3open("/lib/libattr.so.1", O_RDONLY) = 3open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 3open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3Desktop Documents Downloads examples.desktop libflashplayer.soMusic Pictures Public Templates Ubuntu_OS Videos

The above output displays only the open system call of the ls command. At the end of the strace output, it also displays the output of the ls command.

If you want to trace mulIple system calls use the “-‐e trace=” opIon. The following example displays both open and read system calls.

7 Strace Examples to Debug the ExecuIon of a Program in Linux hVp://www.thegeekstuff.com/2011/11/strace-‐examples/

1 of 7 18 Apr 12 7:28 pm

$ strace -e trace=open,read ls /homeopen("/etc/ld.so.cache", O_RDONLY) = 3open("/lib/libselinux.so.1", O_RDONLY) = 3read(3, "\177ELF\1\1\1\3\3\1\260G004"..., 512) = 512open("/lib/librt.so.1", O_RDONLY) = 3read(3, "\177ELF\1\1\1\3\3\1\300\30004"..., 512) = 512..open("/lib/libattr.so.1", O_RDONLY) = 3read(3, "\177ELF\1\1\1\3\3\1\360\r004"..., 512) = 512open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 3read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tb"..., 1024) = 315read(3, "", 1024) = 0open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3open("/home", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3bala

3. Save the Trace Execu5on to a File Using Op5on -‐o

The following examples stores the strace output to output.txt file.

$ strace -o output.txt lsDesktop Documents Downloads examples.desktop libflashplayer.soMusic output.txt Pictures Public Templates Ubuntu_OS Videos

$ cat output.txtexecve("/bin/ls", ["ls"], [/* 37 vars */]) = 0brk(0) = 0x8637000access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)mmap2(NULL, 8192, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7860000access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)open("/etc/ld.so.cache", O_RDONLY) = 3fstat64(3, {st_mode=S_IFREG|0644, st_size=67188, ...}) = 0......

4. Execute Strace on a Running Linux Process Using Op5on -‐p

You could execute strace on a program that is already running using the process id. First, idenIfy the PID of a program using ps command.

For example, if you want to do strace on the firefox program that is currently running, idenIfy the PID of the firefox program.

$ ps -C firefox-bin PID TTY TIME CMD 1725 ? 00:40:50 firefox-bin

Use strace -‐p opIon as shown below to display the strace for a given process id.

$ sudo strace -p 1725 -o firefox_trace.txt

$ tail -f firefox_trace.txt

Now the execuIon trace of firefox process will be logged into firefox_trace.txt text file. You can tail this text file to watch the live trace of the firefox executable.

Strace will display the following error when your user id does not match the user id of the given process.

$ strace -p 1725 -o output.txtattach: ptrace(PTRACE_ATTACH, ...): Operation not permittedCould not attach to process. If your uid matches the uid of the targetprocess, check the setting of /proc/sys/kernel/yama/ptrace_scope, or tryagain as the root user. For more details, see /etc/sysctl.d/10-ptrace.conf

5. Print Timestamp for Each Trace Output Line Using Op5on -‐t

To print the Imestamp for each strace output line, use the opIon -‐t as shown below.

$ strace -t -e open ls /home20:42:37 open("/etc/ld.so.cache", O_RDONLY) = 320:42:37 open("/lib/libselinux.so.1", O_RDONLY) = 320:42:37 open("/lib/librt.so.1", O_RDONLY) = 320:42:37 open("/lib/libacl.so.1", O_RDONLY) = 3


2 of 7 18 Apr 12 7:28 pm

18 TweetTweet 33 13Like Share

20:42:37 open("/lib/libc.so.6", O_RDONLY) = 320:42:37 open("/lib/libdl.so.2", O_RDONLY) = 320:42:37 open("/lib/libpthread.so.0", O_RDONLY) = 320:42:37 open("/lib/libattr.so.1", O_RDONLY) = 320:42:37 open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 320:42:37 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 320:42:37 open("/home", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3bala

6. Print Rela5ve Time for System Calls Using Op5on -‐r

Strace also has the opIon to print the execuIon Ime for each system calls as shown below.

$ strace -r ls 0.000000 execve("/bin/ls", ["ls"], [/* 37 vars */]) = 0 0.000846 brk(0) = 0x8418000 0.000143 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 0.000163 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb787b000 0.000119 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 0.000123 open("/etc/ld.so.cache", O_RDONLY) = 3 0.000099 fstat64(3, {st_mode=S_IFREG|0644, st_size=67188, ...}) = 0 0.000155 mmap2(NULL, 67188, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb786a000 ... ...

7. Generate Sta5s5cs Report of System Calls Using Op5on -‐c

Using opIon -‐c, strace provides useful staIsIcal report for the execuIon trace. The “calls” column in the following output indicated how many Imes thatparIcular system call was executed.

$ strace -c ls /homebala% time seconds usecs/call calls errors syscall------ ----------- ----------- --------- --------- ---------------- -nan 0.000000 0 9 read -nan 0.000000 0 1 write -nan 0.000000 0 11 open -nan 0.000000 0 13 close -nan 0.000000 0 1 execve -nan 0.000000 0 9 9 access -nan 0.000000 0 3 brk -nan 0.000000 0 2 ioctl -nan 0.000000 0 3 munmap -nan 0.000000 0 1 uname -nan 0.000000 0 11 mprotect -nan 0.000000 0 2 rt_sigaction -nan 0.000000 0 1 rt_sigprocmask -nan 0.000000 0 1 getrlimit -nan 0.000000 0 25 mmap2 -nan 0.000000 0 1 stat64 -nan 0.000000 0 11 fstat64 -nan 0.000000 0 2 getdents64 -nan 0.000000 0 1 fcntl64 -nan 0.000000 0 2 1 futex -nan 0.000000 0 1 set_thread_area -nan 0.000000 0 1 set_tid_address -nan 0.000000 0 1 statfs64 -nan 0.000000 0 1 set_robust_list------ ----------- ----------- --------- --------- ----------------100.00 0.000000 114 10 total

Comment

If you enjoyed this ar5cle, you might also like..

50 Linux Sysadmin Tutorials1. Awk IntroducIon – 7 Awk Print Examples


3 of 7 18 Apr 12 7:28 pm

50 Most Frequently Used Linux Commands (With Examples)2.Top 25 Best Linux Performance Monitoring and Debugging Tools3.Mommy, I found it! – 15 PracIcal Linux Find Command Examples4.Linux 101 Hacks 2nd EdiIon eBook 5.

Advanced Sed SubsItuIon Examples8 EssenIal Vim Editor NavigaIon Fundamentals25 Most Frequently Used Linux IPTables Rules ExamplesTurbocharge PuTTY with 12 Powerful Add-‐Ons

{ 7 comments… read them below or add one }

1 dariusz November 23, 2011 at 4:16 am

One of the opIon I use for process which can spool many children is “-‐f -‐ff” to ensure you follow all threads.

This is the case for example for Apache or Squid

2 ronik November 23, 2011 at 6:28 am

very useful.. thanks a lot

3 Lakshmanan November 23, 2011 at 6:45 am

Good one sir

4 TedSki November 23, 2011 at 9:02 am

Another opIon I find useful more onen than not is the –size switch. By default, strace only shows the first 32 bytes of each call. When debuggingwrites, it is onen useful to see more than 32 bytes. To remedy this, use:

$ strace -‐sx …

where x is the number of bytes you’d like to see.

5 jalal hajigholamali November 23, 2011 at 2:58 pm

Hi,

Thanks a lot

6 rakesh November 23, 2011 at 10:10 pm

Good One

7 sungjin February 16, 2012 at 1:53 am

Very good, thanks a lot.

Leave a Comment

Name

E-‐mail

Website


4 of 7 18 Apr 12 7:28 pm

NoIfy me of followup comments via e-‐mail

Submit

Previous post: RAID 2, RAID 3, RAID 4, RAID 6 Explained with Diagram

Next post: How to Detect Memory Leaks Using Valgrind memcheck Tool for C / C++

Sign up for our free email newsleVer [email protected] Sign Up

RSS TwiVer Facebook

Search

EBOOKS


5 of 7 18 Apr 12 7:28 pm

POPULAR POSTS

12 Amazing and EssenIal Linux Books To Enrich Your Brain and Library50 UNIX / Linux Sysadmin Tutorials50 Most Frequently Used UNIX / Linux Commands (With Examples)How To Be ProducIve and Get Things Done Using GTD30 Things To Do When you are Bored and have a ComputerLinux Directory Structure (File System Structure) Explained with ExamplesLinux Crontab: 15 Awesome Cron Job ExamplesGet a Grip on the Grep! – 15 PracIcal Grep Command ExamplesUnix LS Command: 15 PracIcal Examples15 Examples To Master Linux Command Line HistoryTop 10 Open Source Bug Tracking SystemVi and Vim Macro Tutorial: How To Record and PlayMommy, I found it! -‐-‐ 15 PracIcal Linux Find Command Examples15 Awesome Gmail Tips and Tricks15 Awesome Google Search Tips and TricksRAID 0, RAID 1, RAID 5, RAID 10 Explained with DiagramsCan You Top This? 15 PracIcal Linux Top Command ExamplesTop 5 Best System Monitoring ToolsTop 5 Best Linux OS DistribuIonsHow To Monitor Remote Linux Host using Nagios 3.0Awk IntroducIon Tutorial – 7 Awk Print ExamplesHow to Backup Linux? 15 rsync Command ExamplesThe UlImate Wget Download Guide With 15 Awesome ExamplesTop 5 Best Linux Text EditorsPacket Analyzer: 15 TCPDUMP Command ExamplesThe UlImate Bash Array Tutorial with 15 Examples3 Steps to Perform SSH Login Without Password Using ssh-‐keygen & ssh-‐copy-‐idUnix Sed Tutorial: Advanced Sed SubsItuIon ExamplesUNIX / Linux: 10 Netstat Command ExamplesThe UlImate Guide for CreaIng Strong Passwords6 Steps to Secure Your Home Wireless NetworkTurbocharge PuTTY with 12 Powerful Add-‐Ons

About The Geek Stuff

My name is Ramesh Natarajan. I will be posIng instrucIon guides, how-‐to, troubleshooIng Ips and tricks on Linux, database,hardware, security and web. My focus is to write arIcles that will either teach you or help you resolve a problem. Read more about Ramesh Natarajanand the blog.

Support Us

Support this blog by purchasing one of my ebooks.

Bash 101 Hacks eBook

Sed and Awk 101 Hacks eBook


6 of 7 18 Apr 12 7:28 pm

Vim 101 Hacks eBook

Nagios Core 3 eBook

Contact Us

Email Me : Use this Contact Form to get in touch me with your comments, quesIons or suggesIons about this site. You can also simply drop me a lineto say hello!.

Follow us on TwiVer

Become a fan on Facebook

Copyright © 2008–2012 Ramesh Natarajan. All rights reserved | Terms of Service | AdverIse


7 of 7 18 Apr 12 7:28 pm

Technology

7 strace examples to debug the execution of a program in linux