strace is a diagnostic and debugging tool for the command line that can be used to trace system calls that are made and received by a running process. It records the name of each system call, its arguments, and its return value, as well as signals received by the process and other interactions with the kernel, and prints this record to standard error output or a selected file.

Red Hat Developer Toolset is distributed with strace 5.13.

In Red Hat Enterprise Linux, the strace utility is provided by the devtoolset-11-strace package and is automatically installed with devtoolset-11-toolchain as described in Section 1.5, “Installing Red Hat Developer Toolset”.

To run the strace utility on a program you want to analyze:

Replace program with the name of the program you want to analyze, and argument with any command line options and arguments you want to supply to this program. Alternatively, you can run the utility on an already running process by using the -p command line option followed by the process ID:

Note that you can execute any command using the scl utility, causing it to be run with the Red Hat Developer Toolset binaries used in preference to the Red Hat Enterprise Linux system equivalent. This allows you to run a shell session with Red Hat Developer Toolset strace as default:

To verify the version of strace you are using at any point:

Red Hat Developer Toolset’s strace executable path will begin with /opt. Alternatively, you can use the following command to confirm that the version number matches that for Red Hat Developer Toolset strace:

By default, strace prints the name of each system call, its arguments and the return value to standard error output. To redirect this output to a file, use the -o command line option followed by the file name:

Replace file_name with the name of the file.

Example 9.1. Redirecting Output to a File

Consider a slightly modified version of the fibonacci file from Example 8.1, “Compiling a C Program With Debugging Information”. This executable file displays the Fibonacci sequence and optionally allows you to specify how many members of this sequence to list. Run the strace utility on this file and redirect the trace output to fibonacci.log:

This creates a new plain-text file called fibonacci.log in the current working directory.

To trace only a selected set of system calls, run the strace utility with the -e command line option:

Replace expression with a comma-separated list of system calls to trace or any of the keywords listed in Table 9.1, “Commonly Used Values of the -e Option”. For a detailed description of all available values, see the strace(1) manual page.

Table 9.1. Commonly Used Values of the -e Option

%file

System calls that accept a file name as an argument.

%process

System calls that are related to process management.

%network

System calls that are related to networking.

%signal

System calls that are related to signal management.

%ipc

System calls that are related to inter-process communication (IPC).

%desc

System calls that are related to file descriptors.

Note that the syntax -e expression is a shorthand for the full form -e trace=expression.

Example 9.2. Tracing Selected System Calls

Consider the employee file from Example 11.1, “Using memstomp”. Run the strace utility on this executable file and trace only the mmap and munmap system calls:

To prefix each line of the trace with the exact time of the day in hours, minutes, and seconds, run the strace utility with the -t command line option:

To also display milliseconds, supply the -t option twice:

To prefix each line of the trace with the time required to execute the respective system call, use the -r command line option:

Example 9.3. Displaying Time Stamps

Consider an executable file named pwd. Run the strace utility on this file and include time stamps in the output:

To display a summary of how much time was required to execute each system call, how many times were these system calls executed, and how many errors were encountered during their execution, run the strace utility with the -c command line option:

Example 9.4. Displaying a Summary

Consider an executable file named lsblk. Run the strace utility on this file and display a trace summary:

Simulating errors returned from system calls can help identify missing error handling in programs.

To make a program receive a generic error as the result of a particular system call, run the strace utility with the -e fault= option and supply the system call:

To specify the error type or return value, use the -e inject= option:

Note that specifying the error type and return value is mutually exclusive.

Example 9.5. Tampering with System Call Results

Consider an executable file named lsblk. Run the strace utility on this file and make the mmap() system call return an error:

For more information about strace and its features, see the resources listed below.

strace(1) — The manual page for the strace utility provides detailed information about its usage. To display the manual page for the version included in Red Hat Developer Toolset: