1 .\" Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
2 .\" Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
3 .\" Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
4 .\" Copyright (c) 1996-2017 The strace developers.
5 .\" All rights reserved.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. The name of the author may not be used to endorse or promote products
16 .\" derived from this software without specific prior written permission.
18 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40 .\" Like .OP, but with ellipsis at the end in order to signify that option
41 .\" can be provided multiple times. Based on .OP definition in groff's
45 . RI "[\fB\\$1\fP" "\ \\$2" "]...\&"
47 . RB "[" "\\$1" "]...\&"
52 . RI "\fB\\$1\fP" "\ \\$2"
56 .TH STRACE 1 "@MANPAGE_DATE@" "strace @VERSION@"
58 strace \- trace system calls and signals
61 .if '@ENABLE_STACKTRACE_TRUE@'#' .ig end_unwind_opt
62 .OP \-ACdffhikqrtttTvVxxy
64 .if '@ENABLE_STACKTRACE_FALSE@'#' .ig end_no_unwind_opt
65 .OP \-ACdffhiqrtttTvVxxy
80 .OM \-E var\fR[=\fIval\fR]
82 .IR command " [" args ]
99 .OM \-E var\fR[=\fIval\fR]
101 .IR command " [" args ]
106 .IX "strace command" "" "\fLstrace\fR command"
113 It intercepts and records the system calls which are called
114 by a process and the signals which are received by a process.
115 The name of each system call, its arguments and its return value
116 are printed on standard error or to the file specified with the
121 is a useful diagnostic, instructional, and debugging tool.
122 System administrators, diagnosticians and trouble-shooters will find
123 it invaluable for solving problems with
124 programs for which the source is not readily available since
125 they do not need to be recompiled in order to trace them.
126 Students, hackers and the overly-curious will find that
127 a great deal can be learned about a system and its system calls by
128 tracing even ordinary programs. And programmers will find that
129 since system calls and signals are events that happen at the user/kernel
130 interface, a close examination of this boundary is very
131 useful for bug isolation, sanity checking and
132 attempting to capture race conditions.
134 Each line in the trace contains the system call name, followed
135 by its arguments in parentheses and its return value.
136 An example from stracing the command "cat /dev/null" is:
138 open("/dev/null", O_RDONLY) = 3
140 Errors (typically a return value of \-1) have the errno symbol
141 and error string appended.
143 open("/foo/bar", O_RDONLY) = \-1 ENOENT (No such file or directory)
145 Signals are printed as signal symbol and decoded siginfo structure.
146 An excerpt from stracing and interrupting the command "sleep 666" is:
148 sigsuspend([] <unfinished ...>
149 --- SIGINT {si_signo=SIGINT, si_code=SI_USER, si_pid=...} ---
150 +++ killed by SIGINT +++
152 If a system call is being executed and meanwhile another one is being called
153 from a different thread/process then
155 will try to preserve the order of those events and mark the ongoing call as
158 When the call returns it will be marked as
161 [pid 28772] select(4, [3], NULL, NULL, NULL <unfinished ...>
162 [pid 28779] clock_gettime(CLOCK_REALTIME, {1130322148, 939977000}) = 0
163 [pid 28772] <... select resumed> ) = 1 (in [3])
165 Interruption of a (restartable) system call by a signal delivery is processed
166 differently as kernel terminates the system call and also arranges its
167 immediate reexecution after the signal handler completes.
169 read(0, 0x7ffff72cf5cf, 1) = ? ERESTARTSYS (To be restarted)
171 rt_sigreturn(0xe) = 0
174 Arguments are printed in symbolic form with passion.
175 This example shows the shell performing ">>xyzzy" output redirection:
177 open("xyzzy", O_WRONLY|O_APPEND|O_CREAT, 0666) = 3
179 Here, the third argument of
181 is decoded by breaking down the
182 flag argument into its three bitwise-OR constituents and printing the
183 mode value in octal by tradition. Where the traditional or native
184 usage differs from ANSI or POSIX, the latter forms are preferred.
187 output is proven to be more readable than the source.
189 Structure pointers are dereferenced and the members are displayed
190 as appropriate. In most cases, arguments are formatted in the most C-like
192 For example, the essence of the command "ls \-l /dev/null" is captured as:
194 lstat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
196 Notice how the 'struct stat' argument is dereferenced and how each member is
197 displayed symbolically. In particular, observe how the
199 member is carefully decoded into a bitwise-OR of symbolic and numeric values.
200 Also notice in this example that the first argument to
202 is an input to the system call and the second argument is an output.
203 Since output arguments are not modified if the system call fails, arguments may
204 not always be dereferenced. For example, retrying the "ls \-l" example
205 with a non-existent file produces the following line:
207 lstat("/foo/bar", 0xb004) = \-1 ENOENT (No such file or directory)
209 In this case the porch light is on but nobody is home.
213 are printed raw, with the unknown system call number printed in hexadecimal form
214 and prefixed with "syscall_":
216 syscall_0xbad(0xfedcba9876543210, 0xfedcba9876543211, 0xfedcba9876543212,
217 0xfedcba9876543213, 0xfedcba9876543214, 0xfedcba9876543215) = -1 (errno 38)
220 Character pointers are dereferenced and printed as C strings.
221 Non-printing characters in strings are normally represented by
222 ordinary C escape codes.
225 (32 by default) bytes of strings are printed;
226 longer strings have an ellipsis appended following the closing quote.
227 Here is a line from "ls \-l" where the
229 library routine is reading the password file:
231 read(3, "root::0:0:System Administrator:/"..., 1024) = 422
233 While structures are annotated using curly braces, simple pointers
234 and arrays are printed using square brackets with commas separating
235 elements. Here is an example from the command "id" on a system with
236 supplementary group ids:
238 getgroups(32, [100, 0]) = 2
240 On the other hand, bit-sets are also shown using square brackets
241 but set elements are separated only by a space. Here is the shell,
242 preparing to execute an external command:
244 sigprocmask(SIG_BLOCK, [CHLD TTOU], []) = 0
246 Here, the second argument is a bit-set of two signals,
247 .BR SIGCHLD " and " SIGTTOU .
248 In some cases, the bit-set is so full that printing out the unset
249 elements is more valuable. In that case, the bit-set is prefixed by
252 sigprocmask(SIG_UNBLOCK, ~[], NULL) = 0
254 Here, the second argument represents the full set of all signals.
259 Align return values in a specific column (default column 40).
262 Print the instruction pointer at the time of the system call.
263 .if '@ENABLE_STACKTRACE_TRUE@'#' .ig end_unwind
266 Print the execution stack trace of the traced processes after each system call.
270 Write the trace output to the file
272 rather than to stderr.
277 If the argument begins with '|' or '!', the rest of the
278 argument is treated as a command and all output is piped to it.
279 This is convenient for piping the debugging output to a program
280 without affecting the redirections of executed programs.
281 The latter is not compatible with
286 Open the file provided in the
288 option in append mode.
291 Suppress messages about attaching, detaching etc. This happens
292 automatically when output is redirected to a file and the command
293 is run directly instead of attaching.
296 If given twice, suppress messages about process exit status.
299 Print a relative timestamp upon entry to each system call. This
300 records the time difference between the beginning of successive
304 option uses the monotonic clock time for measuring time difference and not the
305 wall clock time, its measurements can differ from the difference in time
311 Specify the maximum string size to print (the default is 32). Note
312 that filenames are not considered strings and are always printed in
316 Prefix each line of the trace with the wall clock time.
319 If given twice, the time printed will include the microseconds.
322 If given thrice, the time printed will include the microseconds
323 and the leading portion will be printed as the number
324 of seconds since the epoch.
327 Show the time spent in system calls. This records the time
328 difference between the beginning and the end of each system call.
331 Print all non-ASCII strings in hexadecimal string format.
334 Print all strings in hexadecimal string format.
337 Set the format for printing of named constants and flags.
344 Raw number output, without decoding.
347 Output a named constant or a set of flags instead of the raw number if they are
354 Output both the raw value and the decoded string (as a comment).
358 Print paths associated with file descriptor arguments.
361 Print protocol specific information associated with socket file descriptors,
362 and block/character device number associated with device file descriptors.
366 Count time, calls, and errors for each system call and report a summary on
367 program exit, suppressing the regular output.
368 This attempts to show system time (CPU time spent running
369 in the kernel) independent of wall clock time. If
373 only aggregate totals for all traced processes are kept.
378 but also print regular output while processes are running.
381 Set the overhead for tracing system calls to
384 This is useful for overriding the default heuristic for guessing
385 how much time is spent in mere measuring when timing system calls using
388 option. The accuracy of the heuristic can be gauged by timing a given
389 program run without tracing (using
391 and comparing the accumulated
392 system call time to the total produced using
396 Sort the output of the histogram printed by the
398 option by the specified criterion. Legal values are
408 Summarise the time difference between the beginning and end of
409 each system call. The default is to summarise the system time.
413 A qualifying expression which modifies which events to trace
414 or how to trace them. The format of the expression is:
417 [\,\fIqualifier\/\fB=\fR][\fB!\fR][\fB?\fR]\,\fIvalue1\/\fR[\fB,\fR[\fB?\fR]\,\fIvalue2\/\fR]...
435 is a qualifier-dependent symbol or number. The default
438 Using an exclamation mark negates the set of values. For example,
441 .BR \-e "\ " trace = open
442 which in turn means trace only the
444 system call. By contrast,
445 .BR \-e "\ " trace "=!" open
446 means to trace every system call except
448 Question mark before the syscall qualification allows suppression of error
449 in case no syscalls matched the qualification provided.
450 In addition, the special values
454 have the obvious meanings.
456 Note that some shells use the exclamation point for history
457 expansion even inside quoted arguments. If so, you must escape
458 the exclamation point with a backslash.
460 \fB\-e\ trace\fR=\,\fIset\fR
461 Trace only the specified set of system calls. The
463 option is useful for determining which system calls might be useful
464 to trace. For example,
465 .BR trace = open,close,read,write
467 trace those four system calls. Be careful when making inferences
468 about the user/kernel boundary if only a subset of system calls
469 are being monitored. The default is
472 \fB\-e\ trace\fR=/\,\fIregex\fR
473 Trace only those system calls that match the
477 Extended Regular Expression syntax (see
480 .BR "\-e\ trace" = %file
482 .BR "\-e\ trace" = file " (deprecated)"
483 Trace all system calls which take a file name as an argument. You
484 can think of this as an abbreviation for
485 .BR "\-e\ trace" = open , stat , chmod , unlink ,...
486 which is useful to seeing what files the process is referencing.
487 Furthermore, using the abbreviation will ensure that you don't
488 accidentally forget to include a call like
490 in the list. Betchya woulda forgot that one.
492 .BR "\-e\ trace" = %process
494 .BR "\-e\ trace" = process " (deprecated)"
495 Trace all system calls which involve process management. This
496 is useful for watching the fork, wait, and exec steps of a process.
498 .BR "\-e\ trace" = %network
500 .BR "\-e\ trace" = network " (deprecated)"
501 Trace all the network related system calls.
503 .BR "\-e\ trace" = %signal
505 .BR "\-e\ trace" = signal " (deprecated)"
506 Trace all signal related system calls.
508 .BR "\-e\ trace" = %ipc
510 .BR "\-e\ trace" = ipc " (deprecated)"
511 Trace all IPC related system calls.
513 .BR "\-e\ trace" = %desc
515 .BR "\-e\ trace" = desc " (deprecated)"
516 Trace all file descriptor related system calls.
518 .BR "\-e\ trace" = %memory
520 .BR "\-e\ trace" = memory " (deprecated)"
521 Trace all memory mapping related system calls.
523 .BR "\-e\ trace" = %stat
524 Trace stat syscall variants.
526 .BR "\-e\ trace" = %lstat
527 Trace lstat syscall variants.
529 .BR "\-e\ trace" = %fstat
530 Trace fstat and fstatat syscall variants.
532 .BR "\-e\ trace" = %%stat
533 Trace syscalls used for requesting file status (stat, lstat, fstat, fstatat,
534 statx, and their variants).
536 .BR "\-e\ trace" = %statfs
537 Trace statfs, statfs64, statvfs, osf_statfs, and osf_statfs64 system calls.
538 The same effect can be achieved with
539 .BR "\-e\ trace" = /^(.*_)?statv?fs
542 .BR "\-e\ trace" = %fstatfs
543 Trace fstatfs, fstatfs64, fstatvfs, osf_fstatfs, and osf_fstatfs64 system calls.
544 The same effect can be achieved with
545 .BR "\-e\ trace" = /fstatv?fs
548 .BR "\-e\ trace" = %%statfs
549 Trace syscalls related to file system statistics (statfs-like, fstatfs-like,
550 and ustat). The same effect can be achieved with
551 .BR "\-e\ trace" = /statv?fs|fsstat|ustat
554 .BR "\-e\ trace" = %pure
555 Trace syscalls that always succeed and have no arguments.
556 Currently, this list includes
557 .BR arc_gettls "(2), " getdtablesize "(2), " getegid "(2), " getegid32 "(2),"
558 .BR geteuid "(2), " geteuid32 "(2), " getgid "(2), " getgid32 "(2),"
559 .BR getpagesize "(2), " getpgrp "(2), " getpid "(2), " getppid "(2),"
560 .BR get_thread_area (2)
561 (on architectures other than x86),
562 .BR gettid "(2), " get_tls "(2), " getuid "(2), " getuid32 "(2),"
563 .BR getxgid "(2), " getxpid "(2), " getxuid "(2), " kern_features "(2), and"
564 .BR metag_get_tls "(2)"
567 \fB\-e\ abbrev\fR=\,\fIset\fR
568 Abbreviate the output from printing each member of large structures.
573 option has the effect of
576 \fB\-e\ verbose\fR=\,\fIset\fR
577 Dereference structures for the specified set of system calls. The
581 \fB\-e\ raw\fR=\,\fIset\fR
582 Print raw, undecoded arguments for the specified set of system calls.
583 This option has the effect of causing all arguments to be printed
584 in hexadecimal. This is mostly useful if you don't trust the
585 decoding or you need to know the actual numeric value of an
588 \fB\-e\ signal\fR=\,\fIset\fR
589 Trace only the specified subset of signals. The default is
592 .BR signal "=!" SIGIO
597 signals not to be traced.
599 \fB\-e\ read\fR=\,\fIset\fR
600 Perform a full hexadecimal and ASCII dump of all the data read from
601 file descriptors listed in the specified set. For example, to see
602 all input activity on file descriptors
607 \fB\-e\ read\fR=\,\fI3\fR,\fI5\fR.
608 Note that this is independent from the normal tracing of the
610 system call which is controlled by the option
611 .BR -e "\ " trace = read .
613 \fB\-e\ write\fR=\,\fIset\fR
614 Perform a full hexadecimal and ASCII dump of all the data written to
615 file descriptors listed in the specified set. For example, to see
616 all output activity on file descriptors
621 \fB\-e\ write\fR=\,\fI3\fR,\,\fI5\fR.
622 Note that this is independent from the normal tracing of the
624 system call which is controlled by the option
625 .BR -e "\ " trace = write .
627 \fB\-e\ inject\fR=\,\fIset\/\fR[:\fBerror\fR=\,\fIerrno\/\fR|:\fBretval\fR=\,\fIvalue\/\fR][:\fBsignal\fR=\,\fIsig\/\fR][:\fBdelay_enter\fR=\,\fIusecs\/\fR][:\fBdelay_exit\fR=\,\fIusecs\/\fR][:\fBwhen\fR=\,\fIexpr\/\fR]
628 Perform syscall tampering for the specified set of syscalls.
637 options has to be specified.
641 are mutually exclusive.
643 If :\fBerror\fR=\,\fIerrno\/\fR option is specified,
644 a fault is injected into a syscall invocation:
645 the syscall number is replaced by -1 which corresponds to an invalid syscall,
646 and the error code is specified using a symbolic
650 or a numeric value within 1..4095 range.
652 If :\fBretval\fR=\,\fIvalue\/\fR option is specified,
653 success injection is performed: the syscall number is replaced by -1,
654 but a bogus success value is returned to the callee.
656 If :\fBsignal\fR=\,\fIsig\/\fR option is specified with either a symbolic value
659 or a numeric value within 1..\fBSIGRTMAX\fR range,
660 that signal is delivered on entering every syscall specified by the
663 If :\fBdelay_enter\fR=\,\fIusecs\/\fR or :\fBdelay_exit\fR=\,\fIusecs\/\fR
664 options are specified, delay injection is performed: the tracee is delayed
667 microseconds on entering or exiting the syscall.
669 If :\fBsignal\fR=\,\fIsig\/\fR option is specified without
670 :\fBerror\fR=\,\fIerrno\/\fR, :\fBretval\fR=\,\fIvalue\/\fR or
671 :\fBdelay_{enter,exit}\fR=\,\fIusecs\/\fR options,
674 is delivered without a syscall fault or delay injection.
675 Conversely, :\fBerror\fR=\,\fIerrno\/\fR or
676 :\fBretval\fR=\,\fIvalue\/\fR option without
677 :\fBdelay_enter\fR=\,\fIusecs\/\fR,
678 :\fBdelay_exit\fR=\,\fIusecs\/\fR or
679 :\fBsignal\fR=\,\fIsig\/\fR options injects a fault without delivering a signal
680 or injecting a delay, etc.
682 If both :\fBerror\fR=\,\fIerrno\/\fR or :\fBretval\fR=\,\fIvalue\/\fR
683 and :\fBsignal\fR=\,\fIsig\/\fR options are specified, then both
684 a fault or success is injected and a signal is delivered.
686 Unless a :\fBwhen\fR=\,\fIexpr\fR subexpression is specified,
687 an injection is being made into every invocation of each syscall from the
690 The format of the subexpression is one of the following:
695 For every syscall from the
697 perform an injection for the syscall invocation number
704 For every syscall from the
706 perform injections for the syscall invocation number
708 and all subsequent invocations.
711 \fIfirst\/\fB+\fIstep\fR
713 For every syscall from the
715 perform injections for syscall invocations number
718 .IR first + step + step ,
723 For example, to fail each third and subsequent chdir syscalls with
726 \fB\-e\ inject\fR=\,\fIchdir\/\fR:\fBerror\fR=\,\fIENOENT\/\fR:\fBwhen\fR=\,\fI3\/\fB+\fR.
728 The valid range for numbers
734 An injection expression can contain only one
738 specification, and only one
740 specification. If an injection expression contains multiple
742 specifications, the last one takes precedence.
744 Accounting of syscalls that are subject to injection
745 is done per syscall and per tracee.
747 Specification of syscall injection can be combined
748 with other syscall filtering options, for example,
749 \fB\-P \fI/dev/urandom \fB\-e inject\fR=\,\fIfile\/\fR:\fBerror\fR=\,\fIENOENT\fR.
752 \fB\-e\ fault\fR=\,\fIset\/\fR[:\fBerror\fR=\,\fIerrno\/\fR][:\fBwhen\fR=\,\fIexpr\/\fR]
753 Perform syscall fault injection for the specified set of syscalls.
755 This is equivalent to more generic
756 \fB\-e\ inject\fR= expression with default value of
763 Trace only system calls accessing
767 options can be used to specify several paths.
770 Print unabbreviated versions of environment, stat, termios, etc.
771 calls. These structures are very common in calls and so the default
772 behavior displays a reasonable subset of structure members. Use
773 this option to get all of the gory details.
777 If specified syscall is reached, detach from traced process.
780 syscall is supported. This option is useful if you want to trace
781 multi-threaded process and therefore require -f, but don't want
782 to trace its (potentially very complex) children.
785 Run tracer process as a detached grandchild, not as parent of the
786 tracee. This reduces the visible effect of
788 by keeping the tracee a direct child of the calling process.
791 Trace child processes as they are created by currently traced
792 processes as a result of the
797 system calls. Note that
801 will attach all threads of process PID if it is multi-threaded,
802 not only thread with thread_id = PID.
808 option is in effect, each processes trace is written to
810 where pid is the numeric process id of each process.
811 This is incompatible with
813 since no per-process counts are kept.
815 One might want to consider using
816 .BR strace-log-merge (1)
817 to obtain a combined strace log view.
819 .BI "\-I " interruptible
820 When strace can be interrupted by signals (such as pressing ^C).
821 1: no signals are blocked; 2: fatal signals are blocked while decoding syscall
822 (default); 3: fatal signals are always blocked (default if '-o FILE PROG');
823 4: fatal signals and SIGTSTP (^Z) are always blocked (useful to make
824 strace -o FILE PROG not stop on ^Z).
827 \fB\-E\ \fIvar\fR=\,\fIval\fR
830 in its list of environment variables.
835 from the inherited list of environment variables before passing it on to
839 Attach to the process with the process
843 The trace may be terminated
844 at any time by a keyboard interrupt signal (\c
847 will respond by detaching itself from the traced process(es)
848 leaving it (them) to continue running.
851 options can be used to attach to many processes in addition to
853 (which is optional if at least one
857 "`pidof PROG`" syntax is supported.
860 Run command with the user \s-1ID\s0, group \s-2ID\s0, and
861 supplementary groups of
863 This option is only useful when running as root and enables the
864 correct execution of setuid and/or setgid binaries.
865 Unless this option is used setuid and setgid programs are executed
866 without effective privileges.
870 Show some debugging output of
872 itself on the standard error.
875 This option is deprecated. It is retained for backward compatibility only
876 and may be removed in future releases.
877 Usage of multiple instances of
879 option is still equivalent to a single
881 and it is ignored at all if used along with one or more instances of
886 Print the help summary.
889 Print the version number of
896 exits with the same exit status.
899 is terminated by a signal,
901 terminates itself with the same signal, so that
903 can be used as a wrapper process transparent to the invoking parent process.
904 Note that parent-child relationship (signal stop notifications,
905 getppid() value, etc) between traced process and its parent are not preserved
916 is zero unless no processes has been attached or there was an unexpected error
917 in doing the tracing.
918 .SH "SETUID INSTALLATION"
921 is installed setuid to root then the invoking user will be able to
922 attach to and trace processes owned by any user.
923 In addition setuid and setgid programs will be executed and traced
924 with the correct effective privileges.
925 Since only users trusted with full root privileges should be allowed
927 it only makes sense to install
929 as setuid to root when the users who can execute it are restricted
930 to those users who have this trust.
931 For example, it makes sense to install a special version of
933 with mode 'rwsr-xr--', user
939 group are trusted users.
940 If you do use this feature, please remember to install
941 a regular non-setuid version of
943 for ordinary users to use.
944 .SH "MULTIPLE PERSONALITY SUPPORT"
945 On some architectures,
947 supports decoding of syscalls for processes that use different ABI rather than
951 Specifically, in addition to decoding native ABI,
953 can decode the following ABIs on the following architectures:
958 Architecture ABIs supported
959 x86_64 i386, x32 (when built as an x86_64 application); i386 (when built as an x32 application)
960 AArch64 ARM 32-bit EABI
961 PowerPC 64-bit PowerPC 32-bit
962 RISC-V 64-bit RISC-V 32-bit
964 SPARC 64-bit SPARC 32-bit
965 TILE 64-bit TILE 32-bit
968 This support is optional and relies on ability to generate and parse structure
969 definitions during the build time.
970 Please refer to the output of the
972 command in order to figure out what support is available in your strace build
973 ("non-native" refers to an ABI that differs from the ABI strace has):
977 can trace and properly decode non-native 32-bit binaries.
981 can trace, but cannot properly decode non-native 32-bit binaries.
985 can trace and properly decode non-native 32-on-64-bit binaries.
989 can trace, but cannot properly decode non-native 32-on-64-bit binaries.
991 If the output contains neither
995 then decoding of non-native 32-bit binaries is not implemented at all
998 Likewise, if the output contains neither
1002 then decoding of non-native 32-on-64-bit binaries is not implemented at all
1005 It is a pity that so much tracing clutter is produced by systems
1006 employing shared libraries.
1008 It is instructive to think about system call inputs and outputs
1009 as data-flow across the user/kernel boundary. Because user-space
1010 and kernel-space are separate and address-protected, it is
1011 sometimes possible to make deductive inferences about process
1012 behavior using inputs and outputs as propositions.
1014 In some cases, a system call will differ from the documented behavior
1015 or have a different name. For example, the
1017 system call does not have
1021 library function uses
1023 system call on modern (2.6.38+) kernels. These
1024 discrepancies are normal but idiosyncratic characteristics of the
1025 system call interface and are accounted for by C library wrapper
1028 Some system calls have different names in different architectures and
1029 personalities. In these cases, system call filtering and printing
1030 uses the names that match corresponding
1032 kernel macros of the tracee's architecture and personality.
1033 There are two exceptions from this general rule:
1034 .BR arm_fadvise64_64 (2)
1036 .BR xtensa_fadvise64_64 (2)
1037 Xtensa syscall are filtered and printed as
1038 .BR fadvise64_64 (2).
1040 On x32, syscalls that are intended to be used by 64-bit processes and not x32
1043 that has syscall number 19 on x86_64, with its x32 counterpart has syscall
1044 number 515), but called with
1045 .B __X32_SYSCALL_BIT
1046 flag being set, are designated with "#64" suffix.
1048 On some platforms a process that is attached to with the
1050 option may observe a spurious EINTR return from the current
1051 system call that is not restartable. (Ideally, all system calls
1052 should be restarted on strace attach, making the attach invisible
1053 to the traced process, but a few system calls aren't.
1054 Arguably, every instance of such behavior is a kernel bug.)
1055 This may have an unpredictable effect on the process
1056 if the process takes no action to restart the system call.
1060 executes the specified
1062 directly and does not employ a shell for that, scripts without shebang
1063 that usually run just fine when invoked by shell fail to execute with
1066 It is advisable to manually supply a shell as a
1068 with the script as its argument.
1070 Programs that use the
1075 privileges while being traced.
1077 A traced process runs slowly.
1079 Traced processes which are descended from
1081 may be left running after an interrupt signal (\c
1086 was written by Paul Kranenburg
1087 for SunOS and was inspired by its
1090 The SunOS version of
1092 was ported to Linux and enhanced
1093 by Branko Lankester, who also wrote the Linux kernel support.
1094 Even though Paul released
1097 Branko's work was based on Paul's
1099 1.5 release from 1991.
1100 In 1993, Rick Sladkey merged
1102 2.5 for SunOS and the second release of
1104 for Linux, added many of the features of
1106 from SVR4, and produced an
1108 that worked on both platforms. In 1994 Rick ported
1110 to SVR4 and Solaris and wrote the
1111 automatic configuration support. In 1995 he ported
1114 and tired of writing about himself in the third person.
1116 Beginning with 1996,
1118 was maintained by Wichert Akkerman.
1121 development migrated to CVS; ports to FreeBSD and many architectures on Linux
1122 (including ARM, IA-64, MIPS, PA-RISC, PowerPC, s390, SPARC) were introduced.
1123 In 2002, the burden of
1125 maintainership was transferred to Roland McGrath.
1128 gained support for several new Linux architectures (AMD64, s390x, SuperH),
1129 bi-architecture support for some of them, and received numerous additions and
1130 improvements in syscalls decoders on Linux;
1132 development migrated to
1137 is actively maintained by Dmitry Levin.
1139 gained support for AArch64, ARC, AVR32, Blackfin, Meta, Nios II, OpenSISC 1000,
1140 RISC-V, Tile/TileGx, Xtensa architectures since that time.
1141 In 2012, unmaintained and apparently broken support for non-Linux operating
1142 systems was removed.
1145 gained support for path tracing and file descriptor path decoding.
1146 In 2014, support for stack traces printing was added.
1147 In 2016, syscall fault injection was implemented.
1149 For the additional information, please refer to the
1153 repository commit log.
1157 should be reported to the
1159 mailing list at <strace\-devel@lists.strace.io>.
1161 .BR strace-log-merge (1),