1 .\" Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
2 .\" Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
3 .\" Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
4 .\" Copyright (c) 1996-2017 The strace developers.
5 .\" All rights reserved.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. The name of the author may not be used to endorse or promote products
16 .\" derived from this software without specific prior written permission.
18 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40 .\" Like .OP, but with ellipsis at the end in order to signify that option
41 .\" can be provided multiple times. Based on .OP definition in groff's
45 . RI "[\fB\\$1\fP" "\ \\$2" "]...\&"
47 . RB "[" "\\$1" "]...\&"
52 . RI "\fB\\$1\fP" "\ \\$2"
56 .TH STRACE 1 "@MANPAGE_DATE@" "strace @VERSION@"
58 strace \- trace system calls and signals
61 .if '@ENABLE_STACKTRACE_TRUE@'#' .ig end_unwind_opt
62 .OP \-ACdffhikqrtttTvVxxy
64 .if '@ENABLE_STACKTRACE_FALSE@'#' .ig end_no_unwind_opt
65 .OP \-ACdffhiqrtttTvVxxy
80 .OM \-E var\fR[=\fIval\fR]
82 .IR command " [" args ]
99 .OM \-E var\fR[=\fIval\fR]
101 .IR command " [" args ]
106 .IX "strace command" "" "\fLstrace\fR command"
113 It intercepts and records the system calls which are called
114 by a process and the signals which are received by a process.
115 The name of each system call, its arguments and its return value
116 are printed on standard error or to the file specified with the
121 is a useful diagnostic, instructional, and debugging tool.
122 System administrators, diagnosticians and trouble-shooters will find
123 it invaluable for solving problems with
124 programs for which the source is not readily available since
125 they do not need to be recompiled in order to trace them.
126 Students, hackers and the overly-curious will find that
127 a great deal can be learned about a system and its system calls by
128 tracing even ordinary programs. And programmers will find that
129 since system calls and signals are events that happen at the user/kernel
130 interface, a close examination of this boundary is very
131 useful for bug isolation, sanity checking and
132 attempting to capture race conditions.
134 Each line in the trace contains the system call name, followed
135 by its arguments in parentheses and its return value.
136 An example from stracing the command "cat /dev/null" is:
138 open("/dev/null", O_RDONLY) = 3
140 Errors (typically a return value of \-1) have the errno symbol
141 and error string appended.
143 open("/foo/bar", O_RDONLY) = \-1 ENOENT (No such file or directory)
145 Signals are printed as signal symbol and decoded siginfo structure.
146 An excerpt from stracing and interrupting the command "sleep 666" is:
148 sigsuspend([] <unfinished ...>
149 --- SIGINT {si_signo=SIGINT, si_code=SI_USER, si_pid=...} ---
150 +++ killed by SIGINT +++
152 If a system call is being executed and meanwhile another one is being called
153 from a different thread/process then
155 will try to preserve the order of those events and mark the ongoing call as
158 When the call returns it will be marked as
161 [pid 28772] select(4, [3], NULL, NULL, NULL <unfinished ...>
162 [pid 28779] clock_gettime(CLOCK_REALTIME, {1130322148, 939977000}) = 0
163 [pid 28772] <... select resumed> ) = 1 (in [3])
165 Interruption of a (restartable) system call by a signal delivery is processed
166 differently as kernel terminates the system call and also arranges its
167 immediate reexecution after the signal handler completes.
169 read(0, 0x7ffff72cf5cf, 1) = ? ERESTARTSYS (To be restarted)
171 rt_sigreturn(0xe) = 0
174 Arguments are printed in symbolic form with passion.
175 This example shows the shell performing ">>xyzzy" output redirection:
177 open("xyzzy", O_WRONLY|O_APPEND|O_CREAT, 0666) = 3
179 Here, the third argument of
181 is decoded by breaking down the
182 flag argument into its three bitwise-OR constituents and printing the
183 mode value in octal by tradition. Where the traditional or native
184 usage differs from ANSI or POSIX, the latter forms are preferred.
187 output is proven to be more readable than the source.
189 Structure pointers are dereferenced and the members are displayed
190 as appropriate. In most cases, arguments are formatted in the most C-like
192 For example, the essence of the command "ls \-l /dev/null" is captured as:
194 lstat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
196 Notice how the 'struct stat' argument is dereferenced and how each member is
197 displayed symbolically. In particular, observe how the
199 member is carefully decoded into a bitwise-OR of symbolic and numeric values.
200 Also notice in this example that the first argument to
202 is an input to the system call and the second argument is an output.
203 Since output arguments are not modified if the system call fails, arguments may
204 not always be dereferenced. For example, retrying the "ls \-l" example
205 with a non-existent file produces the following line:
207 lstat("/foo/bar", 0xb004) = \-1 ENOENT (No such file or directory)
209 In this case the porch light is on but nobody is home.
213 are printed raw, with the unknown system call number printed in hexadecimal form
214 and prefixed with "syscall_":
216 syscall_0xbad(0x1, 0x2, 0x3, 0x4, 0x5, 0x6) = -1 ENOSYS (Function not implemented)
219 Character pointers are dereferenced and printed as C strings.
220 Non-printing characters in strings are normally represented by
221 ordinary C escape codes.
224 (32 by default) bytes of strings are printed;
225 longer strings have an ellipsis appended following the closing quote.
226 Here is a line from "ls \-l" where the
228 library routine is reading the password file:
230 read(3, "root::0:0:System Administrator:/"..., 1024) = 422
232 While structures are annotated using curly braces, simple pointers
233 and arrays are printed using square brackets with commas separating
234 elements. Here is an example from the command "id" on a system with
235 supplementary group ids:
237 getgroups(32, [100, 0]) = 2
239 On the other hand, bit-sets are also shown using square brackets
240 but set elements are separated only by a space. Here is the shell,
241 preparing to execute an external command:
243 sigprocmask(SIG_BLOCK, [CHLD TTOU], []) = 0
245 Here, the second argument is a bit-set of two signals,
246 .BR SIGCHLD " and " SIGTTOU .
247 In some cases, the bit-set is so full that printing out the unset
248 elements is more valuable. In that case, the bit-set is prefixed by
251 sigprocmask(SIG_UNBLOCK, ~[], NULL) = 0
253 Here, the second argument represents the full set of all signals.
258 Align return values in a specific column (default column 40).
261 Print the instruction pointer at the time of the system call.
262 .if '@ENABLE_STACKTRACE_TRUE@'#' .ig end_unwind
265 Print the execution stack trace of the traced processes after each system call.
269 Write the trace output to the file
271 rather than to stderr.
276 If the argument begins with '|' or '!', the rest of the
277 argument is treated as a command and all output is piped to it.
278 This is convenient for piping the debugging output to a program
279 without affecting the redirections of executed programs.
280 The latter is not compatible with
285 Open the file provided in the
287 option in append mode.
290 Suppress messages about attaching, detaching etc. This happens
291 automatically when output is redirected to a file and the command
292 is run directly instead of attaching.
295 If given twice, suppress messages about process exit status.
298 Print a relative timestamp upon entry to each system call. This
299 records the time difference between the beginning of successive
303 option uses the monotonic clock time for measuring time difference and not the
304 wall clock time, its measurements can differ from the difference in time
310 Specify the maximum string size to print (the default is 32). Note
311 that filenames are not considered strings and are always printed in
315 Prefix each line of the trace with the wall clock time.
318 If given twice, the time printed will include the microseconds.
321 If given thrice, the time printed will include the microseconds
322 and the leading portion will be printed as the number
323 of seconds since the epoch.
326 Show the time spent in system calls. This records the time
327 difference between the beginning and the end of each system call.
330 Print all non-ASCII strings in hexadecimal string format.
333 Print all strings in hexadecimal string format.
336 Set the format for printing of named constants and flags.
343 Raw number output, without decoding.
346 Output a named constant or a set of flags instead of the raw number if they are
353 Output both the raw value and the decoded string (as a comment).
357 Print paths associated with file descriptor arguments.
360 Print protocol specific information associated with socket file descriptors,
361 and block/character device number associated with device file descriptors.
365 Count time, calls, and errors for each system call and report a summary on
366 program exit, suppressing the regular output.
367 This attempts to show system time (CPU time spent running
368 in the kernel) independent of wall clock time. If
372 only aggregate totals for all traced processes are kept.
377 but also print regular output while processes are running.
380 Set the overhead for tracing system calls to
383 This is useful for overriding the default heuristic for guessing
384 how much time is spent in mere measuring when timing system calls using
387 option. The accuracy of the heuristic can be gauged by timing a given
388 program run without tracing (using
390 and comparing the accumulated
391 system call time to the total produced using
395 Sort the output of the histogram printed by the
397 option by the specified criterion. Legal values are
407 Summarise the time difference between the beginning and end of
408 each system call. The default is to summarise the system time.
412 A qualifying expression which modifies which events to trace
413 or how to trace them. The format of the expression is:
416 [\,\fIqualifier\/\fB=\fR][\fB!\fR][\fB?\fR]\,\fIvalue1\/\fR[\fB,\fR[\fB?\fR]\,\fIvalue2\/\fR]...
434 is a qualifier-dependent symbol or number. The default
437 Using an exclamation mark negates the set of values. For example,
440 .BR \-e "\ " trace = open
441 which in turn means trace only the
443 system call. By contrast,
444 .BR \-e "\ " trace "=!" open
445 means to trace every system call except
447 Question mark before the syscall qualification allows suppression of error
448 in case no syscalls matched the qualification provided.
449 In addition, the special values
453 have the obvious meanings.
455 Note that some shells use the exclamation point for history
456 expansion even inside quoted arguments. If so, you must escape
457 the exclamation point with a backslash.
459 \fB\-e\ trace\fR=\,\fIset\fR
460 Trace only the specified set of system calls. The
462 option is useful for determining which system calls might be useful
463 to trace. For example,
464 .BR trace = open,close,read,write
466 trace those four system calls. Be careful when making inferences
467 about the user/kernel boundary if only a subset of system calls
468 are being monitored. The default is
471 \fB\-e\ trace\fR=/\,\fIregex\fR
472 Trace only those system calls that match the
476 Extended Regular Expression syntax (see
479 .BR "\-e\ trace" = %file
481 .BR "\-e\ trace" = file " (deprecated)"
482 Trace all system calls which take a file name as an argument. You
483 can think of this as an abbreviation for
484 .BR "\-e\ trace" = open , stat , chmod , unlink ,...
485 which is useful to seeing what files the process is referencing.
486 Furthermore, using the abbreviation will ensure that you don't
487 accidentally forget to include a call like
489 in the list. Betchya woulda forgot that one.
491 .BR "\-e\ trace" = %process
493 .BR "\-e\ trace" = process " (deprecated)"
494 Trace all system calls which involve process management. This
495 is useful for watching the fork, wait, and exec steps of a process.
497 .BR "\-e\ trace" = %network
499 .BR "\-e\ trace" = network " (deprecated)"
500 Trace all the network related system calls.
502 .BR "\-e\ trace" = %signal
504 .BR "\-e\ trace" = signal " (deprecated)"
505 Trace all signal related system calls.
507 .BR "\-e\ trace" = %ipc
509 .BR "\-e\ trace" = ipc " (deprecated)"
510 Trace all IPC related system calls.
512 .BR "\-e\ trace" = %desc
514 .BR "\-e\ trace" = desc " (deprecated)"
515 Trace all file descriptor related system calls.
517 .BR "\-e\ trace" = %memory
519 .BR "\-e\ trace" = memory " (deprecated)"
520 Trace all memory mapping related system calls.
522 .BR "\-e\ trace" = %stat
523 Trace stat syscall variants.
525 .BR "\-e\ trace" = %lstat
526 Trace lstat syscall variants.
528 .BR "\-e\ trace" = %fstat
529 Trace fstat and fstatat syscall variants.
531 .BR "\-e\ trace" = %%stat
532 Trace syscalls used for requesting file status (stat, lstat, fstat, fstatat,
533 statx, and their variants).
535 .BR "\-e\ trace" = %statfs
536 Trace statfs, statfs64, statvfs, osf_statfs, and osf_statfs64 system calls.
537 The same effect can be achieved with
538 .BR "\-e\ trace" = /^(.*_)?statv?fs
541 .BR "\-e\ trace" = %fstatfs
542 Trace fstatfs, fstatfs64, fstatvfs, osf_fstatfs, and osf_fstatfs64 system calls.
543 The same effect can be achieved with
544 .BR "\-e\ trace" = /fstatv?fs
547 .BR "\-e\ trace" = %%statfs
548 Trace syscalls related to file system statistics (statfs-like, fstatfs-like,
549 and ustat). The same effect can be achieved with
550 .BR "\-e\ trace" = /statv?fs|fsstat|ustat
553 .BR "\-e\ trace" = %pure
554 Trace syscalls that always succeed and have no arguments.
555 Currently, this list includes
556 .BR arc_gettls "(2), " getdtablesize "(2), " getegid "(2), " getegid32 "(2),"
557 .BR geteuid "(2), " geteuid32 "(2), " getgid "(2), " getgid32 "(2),"
558 .BR getpagesize "(2), " getpgrp "(2), " getpid "(2), " getppid "(2),"
559 .BR get_thread_area (2)
560 (on architectures other than x86),
561 .BR gettid "(2), " get_tls "(2), " getuid "(2), " getuid32 "(2),"
562 .BR getxgid "(2), " getxpid "(2), " getxuid "(2), " kern_features "(2), and"
563 .BR metag_get_tls "(2)"
566 \fB\-e\ abbrev\fR=\,\fIset\fR
567 Abbreviate the output from printing each member of large structures.
572 option has the effect of
575 \fB\-e\ verbose\fR=\,\fIset\fR
576 Dereference structures for the specified set of system calls. The
580 \fB\-e\ raw\fR=\,\fIset\fR
581 Print raw, undecoded arguments for the specified set of system calls.
582 This option has the effect of causing all arguments to be printed
583 in hexadecimal. This is mostly useful if you don't trust the
584 decoding or you need to know the actual numeric value of an
590 \fB\-e\ signal\fR=\,\fIset\fR
591 Trace only the specified subset of signals. The default is
594 .BR signal "=!" SIGIO
599 signals not to be traced.
601 \fB\-e\ read\fR=\,\fIset\fR
602 Perform a full hexadecimal and ASCII dump of all the data read from
603 file descriptors listed in the specified set. For example, to see
604 all input activity on file descriptors
609 \fB\-e\ read\fR=\,\fI3\fR,\fI5\fR.
610 Note that this is independent from the normal tracing of the
612 system call which is controlled by the option
613 .BR -e "\ " trace = read .
615 \fB\-e\ write\fR=\,\fIset\fR
616 Perform a full hexadecimal and ASCII dump of all the data written to
617 file descriptors listed in the specified set. For example, to see
618 all output activity on file descriptors
623 \fB\-e\ write\fR=\,\fI3\fR,\,\fI5\fR.
624 Note that this is independent from the normal tracing of the
626 system call which is controlled by the option
627 .BR -e "\ " trace = write .
629 \fB\-e\ inject\fR=\,\fIset\/\fR[:\fBerror\fR=\,\fIerrno\/\fR|:\fBretval\fR=\,\fIvalue\/\fR][:\fBsignal\fR=\,\fIsig\/\fR][:\fBdelay_enter\fR=\,\fIusecs\/\fR][:\fBdelay_exit\fR=\,\fIusecs\/\fR][:\fBwhen\fR=\,\fIexpr\/\fR]
630 Perform syscall tampering for the specified set of syscalls.
639 options has to be specified.
643 are mutually exclusive.
645 If :\fBerror\fR=\,\fIerrno\/\fR option is specified,
646 a fault is injected into a syscall invocation:
647 the syscall number is replaced by -1 which corresponds to an invalid syscall,
648 and the error code is specified using a symbolic
652 or a numeric value within 1..4095 range.
654 If :\fBretval\fR=\,\fIvalue\/\fR option is specified,
655 success injection is performed: the syscall number is replaced by -1,
656 but a bogus success value is returned to the callee.
658 If :\fBsignal\fR=\,\fIsig\/\fR option is specified with either a symbolic value
661 or a numeric value within 1..\fBSIGRTMAX\fR range,
662 that signal is delivered on entering every syscall specified by the
665 If :\fBdelay_enter\fR=\,\fIusecs\/\fR or :\fBdelay_exit\fR=\,\fIusecs\/\fR
666 options are specified, delay injection is performed: the tracee is delayed
669 microseconds on entering or exiting the syscall.
671 If :\fBsignal\fR=\,\fIsig\/\fR option is specified without
672 :\fBerror\fR=\,\fIerrno\/\fR, :\fBretval\fR=\,\fIvalue\/\fR or
673 :\fBdelay_{enter,exit}\fR=\,\fIusecs\/\fR options,
676 is delivered without a syscall fault or delay injection.
677 Conversely, :\fBerror\fR=\,\fIerrno\/\fR or
678 :\fBretval\fR=\,\fIvalue\/\fR option without
679 :\fBdelay_enter\fR=\,\fIusecs\/\fR,
680 :\fBdelay_exit\fR=\,\fIusecs\/\fR or
681 :\fBsignal\fR=\,\fIsig\/\fR options injects a fault without delivering a signal
682 or injecting a delay, etc.
684 If both :\fBerror\fR=\,\fIerrno\/\fR or :\fBretval\fR=\,\fIvalue\/\fR
685 and :\fBsignal\fR=\,\fIsig\/\fR options are specified, then both
686 a fault or success is injected and a signal is delivered.
688 Unless a :\fBwhen\fR=\,\fIexpr\fR subexpression is specified,
689 an injection is being made into every invocation of each syscall from the
692 The format of the subexpression is one of the following:
697 For every syscall from the
699 perform an injection for the syscall invocation number
706 For every syscall from the
708 perform injections for the syscall invocation number
710 and all subsequent invocations.
713 \fIfirst\/\fB+\fIstep\fR
715 For every syscall from the
717 perform injections for syscall invocations number
720 .IR first + step + step ,
725 For example, to fail each third and subsequent chdir syscalls with
728 \fB\-e\ inject\fR=\,\fIchdir\/\fR:\fBerror\fR=\,\fIENOENT\/\fR:\fBwhen\fR=\,\fI3\/\fB+\fR.
730 The valid range for numbers
736 An injection expression can contain only one
740 specification, and only one
742 specification. If an injection expression contains multiple
744 specifications, the last one takes precedence.
746 Accounting of syscalls that are subject to injection
747 is done per syscall and per tracee.
749 Specification of syscall injection can be combined
750 with other syscall filtering options, for example,
751 \fB\-P \fI/dev/urandom \fB\-e inject\fR=\,\fIfile\/\fR:\fBerror\fR=\,\fIENOENT\fR.
754 \fB\-e\ fault\fR=\,\fIset\/\fR[:\fBerror\fR=\,\fIerrno\/\fR][:\fBwhen\fR=\,\fIexpr\/\fR]
755 Perform syscall fault injection for the specified set of syscalls.
757 This is equivalent to more generic
758 \fB\-e\ inject\fR= expression with default value of
765 Trace only system calls accessing
769 options can be used to specify several paths.
772 Print unabbreviated versions of environment, stat, termios, etc.
773 calls. These structures are very common in calls and so the default
774 behavior displays a reasonable subset of structure members. Use
775 this option to get all of the gory details.
779 If specified syscall is reached, detach from traced process.
782 syscall is supported. This option is useful if you want to trace
783 multi-threaded process and therefore require -f, but don't want
784 to trace its (potentially very complex) children.
787 Run tracer process as a detached grandchild, not as parent of the
788 tracee. This reduces the visible effect of
790 by keeping the tracee a direct child of the calling process.
793 Trace child processes as they are created by currently traced
794 processes as a result of the
799 system calls. Note that
803 will attach all threads of process PID if it is multi-threaded,
804 not only thread with thread_id = PID.
810 option is in effect, each processes trace is written to
812 where pid is the numeric process id of each process.
813 This is incompatible with
815 since no per-process counts are kept.
817 One might want to consider using
818 .BR strace-log-merge (1)
819 to obtain a combined strace log view.
821 .BI "\-I " interruptible
822 When strace can be interrupted by signals (such as pressing ^C).
823 1: no signals are blocked; 2: fatal signals are blocked while decoding syscall
824 (default); 3: fatal signals are always blocked (default if '-o FILE PROG');
825 4: fatal signals and SIGTSTP (^Z) are always blocked (useful to make
826 strace -o FILE PROG not stop on ^Z).
829 \fB\-E\ \fIvar\fR=\,\fIval\fR
832 in its list of environment variables.
837 from the inherited list of environment variables before passing it on to
841 Attach to the process with the process
845 The trace may be terminated
846 at any time by a keyboard interrupt signal (\c
849 will respond by detaching itself from the traced process(es)
850 leaving it (them) to continue running.
853 options can be used to attach to many processes in addition to
855 (which is optional if at least one
859 "`pidof PROG`" syntax is supported.
862 Run command with the user \s-1ID\s0, group \s-2ID\s0, and
863 supplementary groups of
865 This option is only useful when running as root and enables the
866 correct execution of setuid and/or setgid binaries.
867 Unless this option is used setuid and setgid programs are executed
868 without effective privileges.
872 Show some debugging output of
874 itself on the standard error.
877 This option is deprecated. It is retained for backward compatibility only
878 and may be removed in future releases.
879 Usage of multiple instances of
881 option is still equivalent to a single
883 and it is ignored at all if used along with one or more instances of
888 Print the help summary.
891 Print the version number of
898 exits with the same exit status.
901 is terminated by a signal,
903 terminates itself with the same signal, so that
905 can be used as a wrapper process transparent to the invoking parent process.
906 Note that parent-child relationship (signal stop notifications,
907 getppid() value, etc) between traced process and its parent are not preserved
918 is zero unless no processes has been attached or there was an unexpected error
919 in doing the tracing.
920 .SH "SETUID INSTALLATION"
923 is installed setuid to root then the invoking user will be able to
924 attach to and trace processes owned by any user.
925 In addition setuid and setgid programs will be executed and traced
926 with the correct effective privileges.
927 Since only users trusted with full root privileges should be allowed
929 it only makes sense to install
931 as setuid to root when the users who can execute it are restricted
932 to those users who have this trust.
933 For example, it makes sense to install a special version of
935 with mode 'rwsr-xr--', user
941 group are trusted users.
942 If you do use this feature, please remember to install
943 a regular non-setuid version of
945 for ordinary users to use.
946 .SH "MULTIPLE PERSONALITY SUPPORT"
947 On some architectures,
949 supports decoding of syscalls for processes that use different ABI rather than
953 Specifically, in addition to decoding native ABI,
955 can decode the following ABIs on the following architectures:
960 Architecture ABIs supported
961 x86_64 i386, x32 (when built as an x86_64 application); i386 (when built as an x32 application)
962 AArch64 ARM 32-bit EABI
963 PowerPC 64-bit PowerPC 32-bit
964 RISC-V 64-bit RISC-V 32-bit
966 SPARC 64-bit SPARC 32-bit
967 TILE 64-bit TILE 32-bit
970 This support is optional and relies on ability to generate and parse structure
971 definitions during the build time.
972 Please refer to the output of the
974 command in order to figure out what support is available in your strace build
975 ("non-native" refers to an ABI that differs from the ABI strace has):
979 can trace and properly decode non-native 32-bit binaries.
983 can trace, but cannot properly decode non-native 32-bit binaries.
987 can trace and properly decode non-native 32-on-64-bit binaries.
991 can trace, but cannot properly decode non-native 32-on-64-bit binaries.
993 If the output contains neither
997 then decoding of non-native 32-bit binaries is not implemented at all
1000 Likewise, if the output contains neither
1004 then decoding of non-native 32-on-64-bit binaries is not implemented at all
1007 It is a pity that so much tracing clutter is produced by systems
1008 employing shared libraries.
1010 It is instructive to think about system call inputs and outputs
1011 as data-flow across the user/kernel boundary. Because user-space
1012 and kernel-space are separate and address-protected, it is
1013 sometimes possible to make deductive inferences about process
1014 behavior using inputs and outputs as propositions.
1016 In some cases, a system call will differ from the documented behavior
1017 or have a different name. For example, the
1019 system call does not have
1023 library function uses
1025 system call on modern (2.6.38+) kernels. These
1026 discrepancies are normal but idiosyncratic characteristics of the
1027 system call interface and are accounted for by C library wrapper
1030 Some system calls have different names in different architectures and
1031 personalities. In these cases, system call filtering and printing
1032 uses the names that match corresponding
1034 kernel macros of the tracee's architecture and personality.
1035 There are two exceptions from this general rule:
1036 .BR arm_fadvise64_64 (2)
1038 .BR xtensa_fadvise64_64 (2)
1039 Xtensa syscall are filtered and printed as
1040 .BR fadvise64_64 (2).
1042 On x32, syscalls that are intended to be used by 64-bit processes and not x32
1045 that has syscall number 19 on x86_64, with its x32 counterpart has syscall
1046 number 515), but called with
1047 .B __X32_SYSCALL_BIT
1048 flag being set, are designated with "#64" suffix.
1050 On some platforms a process that is attached to with the
1052 option may observe a spurious EINTR return from the current
1053 system call that is not restartable. (Ideally, all system calls
1054 should be restarted on strace attach, making the attach invisible
1055 to the traced process, but a few system calls aren't.
1056 Arguably, every instance of such behavior is a kernel bug.)
1057 This may have an unpredictable effect on the process
1058 if the process takes no action to restart the system call.
1062 executes the specified
1064 directly and does not employ a shell for that, scripts without shebang
1065 that usually run just fine when invoked by shell fail to execute with
1068 It is advisable to manually supply a shell as a
1070 with the script as its argument.
1072 Programs that use the
1077 privileges while being traced.
1079 A traced process runs slowly.
1081 Traced processes which are descended from
1083 may be left running after an interrupt signal (\c
1088 was written by Paul Kranenburg
1089 for SunOS and was inspired by its
1092 The SunOS version of
1094 was ported to Linux and enhanced
1095 by Branko Lankester, who also wrote the Linux kernel support.
1096 Even though Paul released
1099 Branko's work was based on Paul's
1101 1.5 release from 1991.
1102 In 1993, Rick Sladkey merged
1104 2.5 for SunOS and the second release of
1106 for Linux, added many of the features of
1108 from SVR4, and produced an
1110 that worked on both platforms. In 1994 Rick ported
1112 to SVR4 and Solaris and wrote the
1113 automatic configuration support. In 1995 he ported
1116 and tired of writing about himself in the third person.
1118 Beginning with 1996,
1120 was maintained by Wichert Akkerman.
1123 development migrated to CVS; ports to FreeBSD and many architectures on Linux
1124 (including ARM, IA-64, MIPS, PA-RISC, PowerPC, s390, SPARC) were introduced.
1125 In 2002, the burden of
1127 maintainership was transferred to Roland McGrath.
1130 gained support for several new Linux architectures (AMD64, s390x, SuperH),
1131 bi-architecture support for some of them, and received numerous additions and
1132 improvements in syscalls decoders on Linux;
1134 development migrated to
1139 is actively maintained by Dmitry Levin.
1141 gained support for AArch64, ARC, AVR32, Blackfin, Meta, Nios II, OpenSISC 1000,
1142 RISC-V, Tile/TileGx, Xtensa architectures since that time.
1143 In 2012, unmaintained and apparently broken support for non-Linux operating
1144 systems was removed.
1147 gained support for path tracing and file descriptor path decoding.
1148 In 2014, support for stack traces printing was added.
1149 In 2016, syscall fault injection was implemented.
1151 For the additional information, please refer to the
1155 repository commit log.
1159 should be reported to the
1161 mailing list at <strace\-devel@lists.strace.io>.
1163 .BR strace-log-merge (1),