From Wikipedia, the free encyclopedia
Jump to: navigation, search
Original author(s) Paul Kranenburg
Developer(s) Dmitry Levin
Stable release 4.9 / August 15, 2014; 4 months ago (2014-08-15)
Written in C
Operating system Linux
Type Debugging
License BSD

strace is a diagnostic, debugging and instructional userspace utility for Linux. strace is used to monitor interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state. The operation of strace is made possible by the kernel feature known as ptrace.

Other Unix-like systems provide diagnostic tools (such as truss) that are usually similar to strace.


The most common usage is to start a program using strace, which prints a list of system calls made by the program. This is useful if the program continually crashes, or does not behave as expected; for example using strace may reveal that the program is attempting to access a file which does not exist or cannot be read.

An alternative application is to use the -p flag to attach to a running process. This is useful if a process has stopped responding, and might reveal, for example, that the process is blocking whilst attempting to make a network connection.

As strace only details system calls, it cannot be used to detect as many problems as a code debugger such as GNU Debugger (gdb). It is, however, easier to use than a code debugger, and is an extremely useful tool for system administrators. It is also used by researchers to generate system call traces for later system call replay.[1] [2] [3]

Example strace output[edit]

The following is an example of typical output of the strace command:

fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
fcntl64(3, F_GETFD)                     = 0x1 (flags FD_CLOEXEC)
getdents64(3, /* 18 entries */, 4096)   = 496
getdents64(3, /* 0 entries */, 4096)    = 0
close(3)                                = 0
fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2c000
write(1, "autofs\nbackups\ncache\nflexlm\ngames"..., 86autofsA

The above fragment is only a small part of the output of strace when run on the 'ls' command. It shows that the current working directory is opened, inspected and its contents retrieved. The resulting list of file names is written to standard output.

Other tools[edit]

Different operating systems feature other similar (and sometimes more powerful) instrumentation tools, for example:

See also[edit]


  1. ^ Horky, Jiri (2013). "The ioapps IO profiler and IO traces replayer". Retrieved 2013-09-16. 
  2. ^ Waterland, Amos (2007). "The sreplay system call replayer". Retrieved 2013-09-16. 
  3. ^ Burton, Ariel (1998). "Workload characterization using lightweight system call tracing and reexecution". Retrieved 2013-09-16. 
  4. ^ "XTrace - trace X protocol connections". Retrieved 2014-08-12. 
  5. ^ "dtrace(1) Mac OS X Manual Page". Retrieved 2014-07-23. 
  6. ^ "Products - StraceNT - Strace for Windows". IntellectualHeaven. Retrieved 2014-07-23. 

External links[edit]