Strace: Monitoring The Kernel-User-Space Conversation
summary
Strace monitors every syscall a process makes via ptrace, decoding names, flags and structures symbolically (strings default to 32 bytes) and shows surprising library/kernel mismatches like fork→clone and _exit→exit_group. It handles thousands of calls (common programs make tens of thousands), can attach live (-p), produce summaries (-c), and can tamper with calls using -e inject to make, for example, the third close fail with EINVAL (22). Tampering is recent and effective but tracing can slow programs by about two orders of magnitude.
AI-written summary · about
chapters (4)
- 0:00Start
- 26:24bypass the execution of a system call
- 34:21give me a summary of the system calls
- 36:50trace all the threads
related talks
54mStrace - Swiss Army Knife to Trace, Analyze, RT Debug
01h 31mUnderstanding Linux with Strace
23mSecuring Your Software Delivery Chain with Process Auditing
37mKernel and userspace tracing with LTTng and friends
47mWhat is that Process Doing?
01h 00mInvestigating C++ Applications in Production on Linux and Windows
45mThe Container Escape Room: An Exploration of Container Escapes
56mPostgreSQL at low Level: stay curious!