Strace

Quality 0.50 · 1 view · Updated 2 months ago

Diagnostic, debugging and instructional userspace utility for Linux

title: "Strace" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["command-line-software", "debuggers", "free-software-programmed-in-c", "software-using-the-gnu-lesser-general-public-license", "unix-programming-tools"] description: "Diagnostic, debugging and instructional userspace utility for Linux" topic_path: "technology/operating-systems" source: "https://en.wikipedia.org/wiki/Strace" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Diagnostic, debugging and instructional userspace utility for Linux ::

::data[format=table title="Infobox software"]

FieldValue
namestrace
logoStrace_logo.svg
logo_size100
collapsible4
authorPaul Kranenburg
developerDmitry Levin
latest release version
latest release date
programming languageC
operating systemLinux
platformAArch64, DEC Alpha, ARC, ARM EABI/OABI, AVR32, Blackfin, C-SKY, HP PA-RISC, IA-32, IA-64, LoongArch, Motorola 68k, Imagination META, MicroBlaze, MIPS, Nios II, OpenRISC, Power ISA 32/64 bit, RISC-V, System/390/z/Architecture, SuperH 32/64 bit, SPARC 32/64 bit, TILE, TILEPro, TILE-Gx, x86-64, x32 ABI, Xtensa
languageEnglish{{refn
urlhttps://lists.strace.io/pipermail/strace-devel/2018-April/008103.html
title[PATCH] Add i18n support
authorDmitry V. Levin
date2018-04-01
accessdate2021-09-02
genreDebugging
licenseLGPL v2.1+The test suite is licensed under GPL v2.0+.{{cite mailing list
urlhttps://lists.strace.io/pipermail/strace-devel/2018-December/008548.html
titleI: changing the license of strace to a copyleft license
authorDmitry V. Levin
date2018-12-15
accessdate2021-09-02
::

|name = strace |logo = Strace_logo.svg |logo_size = 100 |screenshot = |caption = |collapsible =4 |author = Paul Kranenburg |developer = Dmitry Levin |released = |discontinued = | latest release version = | latest release date = |latest preview version = |latest preview date = |programming language = C |operating system = Linux |platform = AArch64, DEC Alpha, ARC, ARM EABI/OABI, AVR32, Blackfin, C-SKY, HP PA-RISC, IA-32, IA-64, LoongArch, Motorola 68k, Imagination META, MicroBlaze, MIPS, Nios II, OpenRISC, Power ISA 32/64 bit, RISC-V, System/390/z/Architecture, SuperH 32/64 bit, SPARC 32/64 bit, TILE, TILEPro, TILE-Gx, x86-64, x32 ABI, Xtensa |size = |language = English{{refn|group=note|Decoding of system error messages, however, is performed in accordance with the current locale since strace 4.22.{{cite mailing list | url = https://lists.strace.io/pipermail/strace-devel/2018-April/008103.html | title = [PATCH] Add i18n support | author = Dmitry V. Levin | date = 2018-04-01 | accessdate= 2021-09-02 |genre = Debugging |license = LGPL v2.1+The test suite is licensed under GPL v2.0+.{{cite mailing list | url = https://lists.strace.io/pipermail/strace-devel/2018-December/008548.html | title = I: changing the license of strace to a copyleft license | author = Dmitry V. Levin | date = 2018-12-15 | accessdate= 2021-09-02

strace is a diagnostic, debugging and instructional userspace utility for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state. The operation of strace is made possible by the kernel feature known as ptrace.

Some Unix-like systems provide other diagnostic tools similar to strace, such as truss.

History

Strace was originally written for SunOS by Paul Kranenburg in 1991, according to its copyright notice, and published early in 1992, in volume three of comp.sources.sun. The initial README file contained the following:

::quote

is a system call tracer for Sun(tm) systems much like the Sun supplied program . is a useful utility to sort of debug programs for which no source is available which unfortunately includes almost all of the Sun supplied system software. ::

Later, Branko Lankester ported this version to Linux, releasing his version in November 1992 with the second release following in 1993. Richard Sladkey combined these separate versions of strace in 1993, and ported the program to SVR4 and Solaris in 1994, resulting in strace 3.0 that was announced in comp.sources.misc in mid-1994.

Beginning in 1996, strace was maintained by Wichert Akkerman. During his tenure, strace development migrated to CVS; ports to FreeBSD and many architectures on Linux (including ARM, IA-64, MIPS, PA-RISC, PowerPC, s390, SPARC) were introduced. In 2002, the burden of strace maintainership was transferred to Roland McGrath. Since then, strace gained support for several new Linux architectures (AMD64, s390x, SuperH), bi-architecture support for some of them, and received numerous additions and improvements in syscalls decoders on Linux; strace development migrated to git during that period. Since 2009, strace is actively maintained by Dmitry Levin. strace gained support for AArch64, ARC, AVR32, Blackfin, Meta, Nios II, OpenSISC 1000, RISC-V, Tile/TileGx, Xtensa architectures since that time.

The last version of strace that had some (evidently dead) code for non-Linux operating systems was 4.6, released in March 2011. In strace version 4.7, released in May 2012, all non-Linux code had been removed; since strace 4.13, the project follows Linux kernel's release schedule, and as of version 5.0, it follows Linux's versioning scheme as well.

In 2012 strace also gained support for path tracing and file descriptor path decoding. In August 2014, strace 4.9 was released, where support for stack traces printing was added. In December 2016, syscall fault injection feature was implemented.

Version history

::data[format=table]

VersionRelease dateNotable changes
6.2Implemented collision resolution for overlapping terminal/sound ioctl commands
6.1Enhanced decoding of statx syscall and terminal ioctl commands
6.0Enhanced decoding of setns syscall and PTP_* ioctl commands
5.19The "(deleted)" marker of unlinked file descriptor paths is no longer interpreted as a part of a path; enhanced decoding of arch_prctl, io_uring_register, and prctl syscalls; enhanced decoding of siginfo_t structure
5.18
5.17Added support for a new set_mempolicy_home_node syscall on Linux
5.16Added support for printing SELinux context mismatches (--secontext=mismatch option); added support for a new futex_waitv syscall on Linux
5.15
5.14Added support for the new memfd_secret and quotactl_fd syscalls decoding
5.13Implemented System Call Vectored ABI support on the IBM POWER architecture
5.12Added support for the new mount_setattr syscall decoding
5.11Added option for injecting data on syscall entry/exit (poke_enter= and poke_exit= parameters of the --inject option); added support for the new epoll_pwait2 syscall decoding; imlemented decoding of FS_IOC_FS[GS]ETXATTR, FS_IOC{,32}_[GS]ETFLAGS, GPIO_*, SIOCADDMULTI, SIOCDELMULTI, SIOCGIFENCAP, SIOCOUTQNSD, SIOCSIFENCAP, SIOCSIFHWBROADCAST, UBI_IOCRPEB, UBI_IOCSPEB, V4L2_BUF_TYPE_META_CAPTURE, V4L2_BUF_TYPE_META_OUTPUT, and VIDIOC_QUERY_EXT_CTRL ioctl commands
5.10Stack tracing is supported for non-native personalities when compiled with libdw; added support for process_madvise syscall decoding
5.9Added support for close_range syscall decoding; added support for TEE_* ioctl decoding; implemented decoding of {msg,msq,sem}info and {msg,msq,sem}id_ds structures used in the respective System V IPC syscalls commands
5.8Changed the list of syscalls covered by the %process group to contain syscalls associated with process lifecycle: kill, tkill, tgkill, pidfd_send_signal, and rt_sigqueueinfo were added, arch_prctl and unshare were removed; added support for faccessat2 syscall decoding; added support for LOOP_CONFIGURE ioctl decoding
5.7
5.6Added long option aliases along with possibilities for more precise option specifications via -e quiet/--quiet, -e decode-fds/--decode-fds, --absolute-timestamps, --relative-timestamps, and --syscall-times options; implemented various syscall statistics improvements
5.5
5.4
5.3
5.2
5.1
5.0
4.26
4.25
4.24
4.23
4.22
4.21
4.20
4.19
4.18
4.17
4.16
4.15
4.14
4.13
4.12
4.11
4.10
4.9
4.8
4.7All non-Linux code had been removed
4.6
4.5.20Added support for new inotify_init1, perf_event_open, preadv, pwritev, recvmmsg, rt_tgsigqueueinfo syscalls on Linux; -C option added, that combines regular and summary output; added Tile architecture support on Linux
4.5.19Maintainership passed to Dmitry Levin; strace now terminates with the same exit code/signal as the traced program (if it was started by strace); added support for new accept4, dup3, epoll_create1, eventfd2, inotify_init1, pipe2, signalfd4 syscalls on Linux; added Blackfin, AVR32, and CRIS architecture support on Linux
4.5.18Added support for subpage_prot POWER-specific syscall on Linux
4.5.17-F flag is deprecated, as -f traces vfork on Linux since long time
4.5.16
4.5.15Added support for new *at, inotify*, pselect6, ppoll and unshare syscalls on Linux
4.5.14System call number can be supplied in -e specification
4.5.13Add desc syscall group support to -e trace=
4.5.12
4.5.11
4.5.10
4.5.9
4.5.8Decode mbind, [sg]et_mempolicy, waitid, fadvise64{,_64}, and epoll_* syscalls, RTC_* ioctls on Linux
4.5.7
4.5.6Added support for 64-bit SPARC architecture on Linux.
4.5.5
4.5.4-p attaches to all NPTL threads on Linux only when -f is supplied
4.5.3Added support for mq_* syscalls on Linux; -p now attaches to all NPTL threads on Linux
4.5.2
4.5.1
4.5Maintainership passed to Roland McGrath; added x86-64 support on Linux with support of tracing of compat processes; added support for SH and SH64 architectures on Linux; -E option added
4.4
4.3.1
4.3Added support for HP PA/RISC and IA-64 architectures on Linux; added support for 32-bit UID/GID syscalls on Linux; added support for FreeBSD on x86
4.2Added support for IBM Z architecture on Linux
4.1Added support for MIPS architecture on Linux; strace-graph script added
4.0.1
4.0Fixed 64-bit struct stat decoding on Linux; Irix 64 updates; Solaris updates
3.99.1
3.99New maintainer, Wichert Akkerman; added support for IBM POWER, SPARC, and ARM architectures on Linux; added support for many syscalls on Linux
3.1Added support for the Irix OS, m68k and DEC Alpha architectures on Linux; added support for -o! option syntax; added support for syscall classes (file, process); added support for IPC syscalls on Sun OS
3.0Initial cross-platform version by Richard Sladkey. Includes support for -x, -q, -e (trace, abbrev, verbose, raw, signal, read, and write qualifiers), -c, -i options
::

Usage and features

The most common use is to start a program using strace, which prints a list of system calls made by the program. This is useful if the program continually crashes, or does not behave as expected; for example using strace may reveal that the program is attempting to access a file which does not exist or cannot be read.

An alternative application is to use the flag to attach to a running process. This is useful if a process has stopped responding, and might reveal, for example, that the process is blocking whilst attempting to make a network connection.

Among other features, strace allows the following:

  • Specifying a filter of syscall names that should be traced (via the -e trace= option): by name, like ; using one of the predefined groups, like or ; or (since strace 4.17) using regular expression syntax, like -e trace=/clock_.*.
  • Specifying a list of paths to be traced (-P /etc/ld.so.cache, for example).
  • Specifying a list of file descriptors whose I/O should be dumped (-e read= and -e write= options).
  • Counting syscall execution time and count (-T, -c, -C, and -w options; -U option enables printing of additional information, like minimum and maximum syscall execution time).
  • Printing relative or absolute time stamps (-t and -r options).
  • Tampering with the syscalls being executed (-e inject=*syscall specification*:*tampering specification* option): modifying return (:retval=; since strace 4.16) and error code (:error=; since strace 4.15) of the specified syscalls, inject signals (:signal=; since strace 4.16), delays (:delay_enter= and :delay_exit=; since strace 4.22), and modify data pointed by syscall arguments (:poke_enter= and :poke_exit=; since strace 5.11) upon their execution.
  • Extracting information about file descriptors (including sockets, -y option; -yy option provides some additional information, like endpoint addresses for sockets, paths and device major/minor numbers for files).
  • Printing stack traces, including (since strace 4.21) symbol demangling (-k option).
  • Filtering by syscall return status (-e status= option; since strace 5.2Its shorthand for showing only successful calls, -z option, was originally added in strace 4.5, but was never documented as it did not work properly.).
  • Perform translation of thread, process, process group, and session IDs appearing in the trace into strace's PID namespace (--pidns-translation option; since strace 5.9).
  • Decoding SELinux context information associated with processes, files, and descriptors (--secontext option; since strace 5.12).

strace supports decoding of arguments of some classes of ioctl commands, such as BTRFS_*, V4L2_*, DM_*, NSFS_*, MEM*, EVIO*, KVM_*, and several others; it also supports decoding of various netlink protocols.

As strace only details system calls, it cannot be used to detect as many problems as a code debugger such as GNU Debugger (gdb). It is, however, easier to use than a code debugger, and is a very useful tool for system administrators. It is also used by researchers to generate system call traces for later system call replay. |last = Horky |first = Jiri | year = 2013 | title = The ioapps IO profiler and IO traces replayer | url = http://code.google.com/p/ioapps/ | accessdate = 2013-09-16}} |last = Waterland |first = Amos |year = 2007 |title = The sreplay system call replayer |url = http://people.seas.harvard.edu/~apw/sreplay/ |accessdate = 2013-09-16 |archive-date = 2016-04-01 |archive-url = https://web.archive.org/web/20160401224445/http://people.seas.harvard.edu/~apw/sreplay/ |url-status = dead |last = Burton |first = Ariel |year = 1998 | title = Workload characterization using lightweight system call tracing and reexecution | url = http://www.doc.ic.ac.uk/~phjk/Publications/WkldChctrsnUsngTracesReex.pdf | accessdate = 2013-09-16}}

Examples

The following is an example of typical output of the strace command:

::code[lang=console] user@server:~$ strace ls ... open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3 fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) getdents64(3, /* 18 entries /, 4096) = 496 getdents64(3, / 0 entries */, 4096) = 0 close(3) = 0 fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2c000 write(1, "autofs\nbackups\ncache\nflexlm\ngames"..., 86autofsA ::

The above fragment is only a small part of the output of strace when run on the 'ls' command. It shows that the current working directory is opened, inspected and its contents retrieved. The resulting list of file names is written to standard output.

{{Anchor|XTRACE}}Similar tools

Different operating systems feature other similar or related instrumentation tools, offering similar or more advanced features; some of the tools (although using the same or a similar name) may use completely different work mechanisms, resulting in different feature sets or results. Such tools include the following:

Notes

References

References

  1. "The strace Open Source Project on Open Hub". Openhub.net.
  2. Paul Kranenburg. (March 2, 1992). "Strace - an alternative syscall tracer".
  3. Branko Lankester. (November 5, 1992). "first Linux release of strace".
  4. Branko Lankester. (June 18, 1993). "second Linux release of strace".
  5. (June 21, 1994). "strace". manned.org.
  6. "SUNET's Index of /pub/usenet/ftp.uu.net/comp.sources.misc/volume43/strace".
  7. Denys Vlasenko. (February 7, 2012). "How about removing non-Linux code?".
  8. Dmitry V. Levin. (March 16, 2011). "strace 4.6 released".
  9. Dmitry V. Levin. (May 2, 2012). "strace 4.7 released".
  10. Dmitry V. Levin. (April 20, 2012). "Noteworthy changes in release 4.7".
  11. Dmitry V. Levin. (October 4, 2016). "strace 4.14 released".
  12. Dmitry V. Levin. (March 19, 2019). "strace 5.0 released".
  13. Dmitry V. Levin. (May 1, 2012). "Noteworthy changes in release 4.7".
  14. Dmitry V. Levin. (August 15, 2014). "strace 4.9 released".
  15. Dmitry V. Levin. (August 15, 2014). "Noteworthy changes in release 4.9".
  16. Dmitry V. Levin. (December 14, 2016). "strace 4.15 released".
  17. Dmitry V. Levin. (December 14, 2016). "Noteworthy changes in release 4.15".
  18. Dmitry V. Levin. (2023-02-26). "strace 6.2 released".
  19. Dmitry V. Levin. (2022-12-12). "strace 6.1 released".
  20. Dmitry V. Levin. (2022-10-29). "strace 6.0 released".
  21. Dmitry V. Levin. (2022-08-12). "strace 5.19 released".
  22. Dmitry V. Levin. (2022-06-18). "strace 5.18 released".
  23. Dmitry V. Levin. (2022-03-27). "strace 5.17 released".
  24. Dmitry V. Levin. (2022-01-10). "strace 5.16 released".
  25. Dmitry V. Levin. (2021-12-01). "strace 5.15 released".
  26. Dmitry V. Levin. (2021-09-02). "strace 5.14 released".
  27. Dmitry V. Levin. (2021-07-18). "strace 5.13 released".
  28. Dmitry V. Levin. (2021-04-26). "strace 5.12 released".
  29. Dmitry V. Levin. (2021-02-17). "strace 5.11 released".
  30. Dmitry V. Levin. (2020-12-14). "strace 5.10 released".
  31. Dmitry V. Levin. (2020-09-24). "strace 5.9 released".
  32. Dmitry V. Levin. (2020-08-06). "strace 5.8 released".
  33. Dmitry V. Levin. (2020-06-01). "strace 5.7 released".
  34. Dmitry V. Levin. (2020-04-07). "strace 5.6 released".
  35. Dmitry V. Levin. (2020-02-06). "strace 5.5 released".
  36. Dmitry V. Levin. (2019-11-28). "strace 5.4 released".
  37. Dmitry V. Levin. (2019-09-25). "strace 5.3 released".
  38. Dmitry V. Levin. (2019-07-12). "strace 5.2 released".
  39. Dmitry V. Levin. (2019-05-22). "strace 5.1 released".
  40. Dmitry V. Levin. (2019-03-19). "strace 5.0 released".
  41. Dmitry V. Levin. (2018-12-26). "strace 4.26 released".
  42. Dmitry V. Levin. (2018-10-30). "strace 4.25 released".
  43. Dmitry V. Levin. (2018-08-14). "strace 4.24 released".
  44. Dmitry V. Levin. (2018-06-14). "strace 4.23 released".
  45. Dmitry V. Levin. (2018-04-05). "strace 4.22 released".
  46. Dmitry V. Levin. (2018-02-13). "strace 4.21 released".
  47. Dmitry V. Levin. (2017-11-13). "strace 4.20 released".
  48. Dmitry V. Levin. (2017-09-05). "strace 4.19 released".
  49. Dmitry V. Levin. (2017-07-05). "strace 4.18 released".
  50. Dmitry V. Levin. (2017-05-24). "strace 4.17 released".
  51. Dmitry V. Levin. (2017-02-14). "strace 4.16 released".
  52. Dmitry V. Levin. (2016-12-14). "strace 4.15 released".
  53. Dmitry V. Levin. (2016-10-04). "strace 4.14 released".
  54. Dmitry V. Levin. (2016-07-26). "strace 4.13 released".
  55. Dmitry V. Levin. (2016-05-31). "strace 4.12 released".
  56. Dmitry V. Levin. (2015-12-21). "strace 4.11 released".
  57. Dmitry V. Levin. (2015-03-06). "strace 4.10 released".
  58. Dmitry V. Levin. (2014-08-15). "strace 4.9 released".
  59. Dmitry V. Levin. (2013-06-03). "strace 4.8 released".
  60. Dmitry V. Levin. (2012-05-02). "strace 4.7 released".
  61. Dmitry V. Levin. (2011-03-15). "strace 4.6 released".
  62. Rick Sladkey. (1994-07-09). "v43i075: strace - system call tracer for sunos, linux, svr4, solaris2, Part01/10".
  63. "XTrace - trace X protocol connections".
  64. "dtrace(1) Mac OS X Manual Page". Developer.apple.com.
  65. "IntellectualHeaven - Strace For Windows". intellectualheaven.com.

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::

command-line-softwaredebuggersfree-software-programmed-in-csoftware-using-the-gnu-lesser-general-public-licenseunix-programming-tools